[HandyS11]

Summary

SonarQube's only open issues on develop were two javascript:S9383 findings ("Promises should not be left unhandled") in apps/RustPlusApi.CredentialsWeb/wwwroot/app.js: the delegated paste handler's submitPaste() call and the delegated copy button's copyText() call. Both functions report their own failures beside the control that triggered them, so the calls are now marked void with a comment saying where the failure handling lives.

Nothing checked that file locally: the C# side fails the build through SonarAnalyzer.CSharp, but the browser script had no analyzer behind it and Sonar.yml only analyzes develop after the merge. This PR adds the local guard so the same class of smell fails before the push.

Changes

• app.js: the two intentionally unawaited calls are marked void, each with a one-line justification.
• Dev-only Node toolchain in the app directory (package.json, eslint.config.mjs, tsconfig.json): npm run lint mirrors SonarQube's JavaScript rules — typescript-eslint's type-aware no-floating-promises (S9383) and no-misused-promises configured as Sonar's S6544 is (checksVoidReturn off), plus eslint-plugin-sonarjs recommended and ESLint recommended. Run before the fix it reported exactly Sonar's two findings and nothing else.
• CI: new lint-web job runs the lint on every push and PR.
• Pre-push hook: also runs the lint when a push touches the script or its lint setup. Verified by dry-run: passes on this branch, rejects an injected floating promise.
• Pre-push hook bug fix (second commit): ReSharper exits 3 ("No items were found to cleanup") when a push's only C#-family files are .csproj/.props/.targets, and the hook rejected that. Pre-existing on develop; exit 3 now passes.
• Dependabot: weekly npm group for the toolchain.
• csproj: the Web SDK was publishing the three JSON files into the app output and Docker image; they are removed from Content. TypeScriptCompileBlocked stops Visual Studio's TypeScript build acting on tsconfig.json. node_modules added to .dockerignore.
• Docs: docs/development/testing.md, docs/development/formatting.md, CLAUDE.md, AGENTS.md.

Test plan

• npm run lint in the app directory: clean after the fix, two S9383 findings before it
• dotnet build RustPlusApi.sln and the web app's 211 unit tests pass
• dotnet publish of the web app no longer contains package.json, package-lock.json, tsconfig.json
• Pre-push hook dry-run passes on this branch and rejects an injected unhandled promise
• lint-web CI job green on this PR
• SonarQube shows 0 open issues after the merge to develop

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

An unresolved moderate issue remains in the Web project, where node_modules is not excluded from the SDK's recursive Content globs, causing local builds and publishes to pick up thousands of unintended files.

1 open issue

• Exclude node_modules from SDK content globs · New

1 file not reviewed

• apps/RustPlusApi.CredentialsWeb/package-lock.json: Generated file

What changed in this PR

This PR resolves the two outstanding SonarQube javascript:S9383 ("Promises should not be left unhandled") findings in the credentials web app's browser script, and, more substantially, closes the gap that let those smells reach develop undetected: the browser JavaScript previously had no analyzer behind it locally or in pre-merge CI. It fits into the repo's existing "fail fast locally and in CI" philosophy (ReSharper formatting hook, strict C# analyzers) by giving wwwroot/app.js an ESLint toolchain that mirrors SonarQube's JS rules.

Changes:

• Mark the two intentionally unawaited calls (submitPaste(), copyText()) with void plus a justifying comment.
• Add a dev-only Node lint toolchain (package.json, package-lock.json, eslint.config.mjs, tsconfig.json) mirroring Sonar's no-floating-promises/no-misused-promises, wired into a new CI lint-web job, the pre-push hook, and a weekly Dependabot npm group.
• Secondary fixes: pre-push hook now treats ReSharper exit code 3 ("No items to cleanup") as a pass; csproj stops the Web SDK from publishing the toolchain JSON files; node_modules added to .dockerignore; docs updated.

File	Description
apps/​RustPlusApi.CredentialsWeb/​wwwroot/​app.js	Marks the two floating-promise calls with void and comments.
apps/​RustPlusApi.CredentialsWeb/​eslint.config.mjs	New flat ESLint config mirroring SonarQube JS rules via typescript-eslint.
apps/​RustPlusApi.CredentialsWeb/​tsconfig.json	Minimal TS program so ESLint can run type-aware rules over the JS.
apps/​RustPlusApi.CredentialsWeb/​package.json /​ package-lock.json	Pinned dev-only lint toolchain.
apps/​RustPlusApi.CredentialsWeb/​RustPlusApi.CredentialsWeb.csproj	Blocks TS build step; removes three toolchain JSON files from Content — but does not exclude node_modules from the SDK globs (see comment).
.github/​workflows/​CI.yml	Adds a lint-web job running the lint on push/PR.
.githooks/​pre-push	Runs the web lint when the script/lint-setup changes; treats ReSharper exit 3 as a pass.
.github/​dependabot.yml	Adds a weekly grouped npm update for the toolchain.
.dockerignore	Excludes node_modules from the Docker build context.
CLAUDE.md, AGENTS.md, docs/​development/​formatting.md, docs/​development/​testing.md	Document the new lint workflow.

_{Review effort: Balanced}