ci: enforce mockup import boundary + enable dependency report (maturity X1, N2)

[BigSimmo]

Summary

Phase 2 of the maturity backlog (docs/maturity-backlog-workorders.md, landing via #985): the two items that were scoped and safe to execute now.

• X1 — import-boundary linter. Adds a no-restricted-imports rule to eslint.config.mjs that fences design-scratch mockup modules out of production code, converting a prose rule (docs/frontend-architecture.md: "Production routes must not import fixture/mockup modules") into a CI gate. Scoped to exempt exactly the legitimate mockup sources: src/app/mockups/** (all 404 in production) and the *-mockups component dirs. Verified against every current mockup importer — zero false positives.
• N2 — dependency report. Enables the fortnightly schedule on .github/workflows/dependency-report.yml (previously workflow_dispatch-only). Report-only — it surfaces outdated direct deps + npm audit into a rolling issue; it never updates dependencies.

Both were verified READY/recommended in the Phase 1 work-order doc.

Verification

• npm run lint — exit 0 (full repo; zero new violations from the rule).
• Negative test — a probe importing @/components/tools-page-mockups is correctly rejected by the rule (no-restricted-imports), confirming it fires.
• npm run check:github-actions — pass (validates the dependency-report.yml edit).
• npm run format:check — pass. npm run docs:check-links — pass (944 refs).
• No dependency added (rule uses ESLint's built-in no-restricted-imports); package.json/package-lock.json unchanged.

Risk and rollout

• Risk: low. The lint rule is verified zero-violation on the current tree; the report workflow is report-only. If a future mockup import is genuinely needed in a shipped path, the rule message points to the exemption.
• Rollback: revert the PR.
• Provider or production effects: None (the dependency report runs npm audit + posts a GitHub issue on a cron; no deps changed).

Clinical Governance Preflight

N/A — no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed.

Notes

Phase 1 (#985) carries the audit + work-order docs and is auto-merging. The remaining higher-risk backlog items (src/lib/rag extraction, monolith decomposition, SAST-blocking, ACL-migration consolidation, coverage floors) stay as their own dedicated work orders — each needs a full-suite/provider-gated verification pass, so they are not bundled here.

---

Generated by Claude Code

Summary by CodeRabbit

• Chores

  • Dependency reports will now run automatically on the 1st and 15th of each month, while remaining available for manual execution.
  • Added automated checks to help prevent mockup and design-only code from being included in production routes.

• Documentation

  • Clarified architecture guidance around production safety boundaries and mockup code usage.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

📝 Walkthrough

Walkthrough

The dependency report workflow now runs twice monthly, and ESLint enforces production import boundaries that prevent mockup modules from being imported outside permitted mockup locations. Documentation describes the restriction and exceptions.

Changes

Production mockup import boundaries

Layer / File(s)	Summary
Mockup import enforcement eslint.config.mjs, docs/frontend-architecture.md	ESLint blocks mockup imports in production TypeScript files, while the architecture documentation records the CI enforcement and permitted exception paths.

Dependency report scheduling

Layer / File(s)	Summary
Scheduled dependency report .github/workflows/dependency-report.yml	The dependency report workflow runs at 07:00 UTC on the 1st and 15th, while retaining manual dispatch.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• BigSimmo/Database#618: Adds the dependency report workflow referenced by this schedule update.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the two main changes: the mockup import boundary and the dependency-report schedule.
Description check	✅ Passed	The description includes the required summary, verification, risk/rollback, and governance sections with concrete details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/maturity-phase-2-import-boundary

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.