Two independent papercuts in the circular reference check, both hit while
investigating a failure on another PR.
`npm run check-cycle-references` could not run on Windows at all. It spawned
the extensionless `node_modules/.bin/depcruise` shim through `execFileSync`,
which Windows cannot launch; the `.cmd` sibling does not help either, since
Node >=18 refuses to spawn `.cmd` without a shell (CVE-2024-27980). Resolve
dependency-cruiser's own entry point and run it with `process.execPath`
instead — no shell, works everywhere.
The check also fails on baseline drift (cycles recorded in the baseline that
no longer exist), which is correct: the baseline is a ratchet, and leaving a
fixed cycle in it would silently keep permitting its reintroduction. But CI
labelled every non-success outcome "New circular references detected", so a PR
that *removed* two cycles was reported as having added some. That cost real
debugging time.
Give the script distinct exit codes — 1 for a new cycle, 2 for drift alone —
and have the workflow capture and map them to separate messages. The failure
behaviour is unchanged; only the wording is now accurate. Renamed the final
step to match what it actually gates on.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Summary
- Replaces the madge-based `check-cycle-references` with a `dependency-cruiser`-based check, cruised once per npm workspace package.
- Keeps the checker, dependency-cruiser config, and known-cycle baseline together under `scripts/circular-references/`.
- Uses a committed baseline to grandfather existing cycles while failing on new cycles and stale baseline entries.
- Cleans the existing `insomnia-inso` type cycle by using `insomnia-data`'s `AllTypes` instead of importing the database container type.
- CI explicitly uses Bash for correct `tee`/pipeline failure propagation, safely handles skipped checks, and posts a PR report.
- Dropped `madge`/`.madgerc`, added `dependency-cruiser`.
