audit: monorepo audit findings — 2026-05-01

[claude]

Monorepo Audit Report — 2026-05-01

Skills Audited

• Turborepo (best practices from .agents/skills/turborepo/)
• pnpm (best practices from .agents/skills/pnpm/)
• Workleap React Best Practices (best practices from .agents/skills/workleap-react-best-practices/)

Summary

#	Severity	Skill	Finding	File
1	Medium	Turborepo	PR test step bypasses Turborepo caching	.github/workflows/ci.yml
2	Low	Turborepo	build task missing inputs to exclude CHANGELOG.md	turbo.json

Details

1. PR test step bypasses Turborepo caching

Severity: Medium
Skill: Turborepo
File: .github/workflows/ci.yml
Issue: The "Test packages" step uses pnpm test --filter=...[$SHA] on PRs, which applies pnpm's workspace filter and invokes each package's test script directly (vitest), bypassing Turborepo entirely. All other tasks use pnpm turbo run <task> --filter=...[$SHA] explicitly. Because turbo is bypassed, the .turbo cache is never populated with test results on PRs, so every PR commit re-runs tests from scratch even when source files haven't changed.

Recommendation: Change the PR branch of the test step to use turbo directly:

- name: Test packages
  run: |
    if [ "${{ github.event_name }}" == "pull_request" ]; then
        pnpm turbo run test --filter=...[${{ github.event.pull_request.base.sha }}]
    else
        pnpm test
    fi

---

2. build task missing inputs to exclude CHANGELOG.md

Severity: Low
Skill: Turborepo
File: turbo.json
Issue: The build task has no inputs defined, so Turborepo uses all tracked files in the package as its cache key — including CHANGELOG.md. Because packages/logging/CHANGELOG.md is rewritten by changesets on every release version bump, each release invalidates the build cache unnecessarily on the next CI run. The eslint task already demonstrates awareness of this pattern by using "inputs": ["$TURBO_DEFAULT$", "!README.md"] to exclude non-source files.

Recommendation: Add inputs to the build task to exclude CHANGELOG.md:

"build": {
    "dependsOn": ["^build"],
    "inputs": ["$TURBO_DEFAULT$", "!CHANGELOG.md"],
    "outputs": ["dist/**"]
}

---