fix(cargo-gamma-lib): exempt vendored mutation viewer from SDL ESLint at the source

[Pato Sandaña (psandana)]

Problem

The SDLSources stage of the publish pipeline breaks on three @microsoft/sdl/no-inner-html ESLint errors in crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js — the minified mutation-testing-elements 3.9.0 bundle we inline via include_str! for offline report rendering.

PR #112 tried to baseline these with a repo-root guardian_baselines.gdnbaselines. It did not work: the next per-commit run — build 40353400 on main — still failed, with the Guardian Break step logging:

Baseline Files: D:\a\_work\1\s\guardian_baselines.gdnbaselines
Baselines: guardian-baseline
...
##[error]8.  ESLint Error @microsoft/sdl/no-inner-html - ...mutation-test-elements.js. Line: 2. ...
Baselined results: 0        ← nothing matched
Guardian detected one or more breaking results.
Error: Guardian exited with an error exit code: 8

The signatures captured from an earlier run didn't match the ones Guardian recomputed on the merge commit, so nothing was suppressed.

Fix

Exempt the vendored file at the source instead of chasing Guardian signatures:

1. Prepend a file-level /* eslint-disable */ banner to the vendored bundle. The SDL ESLint task runs without --no-inline-config, so the directive is honored and ESLint emits an empty result set — there is nothing left for Guardian to break on. The exemption is self-documenting and lives in the one place a re-vendor will surface it.
2. Remove the non-functional guardian_baselines.gdnbaselines; the pipeline already tolerates its absence.

This is a fix rather than a suppression: the vendored, minified, third-party code is not ours to rewrite, so marking it exempt is the correct treatment — and now ESLint itself reports clean.

Verification

Reproduced with the exact SDL toolchain the pipeline installs (eslint 7.32.0, @microsoft/eslint-plugin-sdl@0.1.7, @typescript-eslint/parser@4.27.0, --parser-options project:true):

Case	Result
vendored file without banner	4 errors at 2:2315, 4:26833, 4:74545, 89:440 — matches the build SARIF
vendored file with banner	0 problems (exit 0)

cargo test -p cargo-gamma-lib --lib html:: (7 viewer-inlining tests) and the license-header check both pass.

Follow-up to #112 (which landed the clippy fix — that part is confirmed green on main).

/cc Martin Taillefer (@geeknoid)

[Copilot]

Pull request overview

This PR fixes SDL ESLint/Guardian pipeline failures by exempting the vendored, minified mutation-testing-elements viewer bundle from linting at the source, avoiding brittle Guardian baseline signature matching.

Changes:

• Adds a file-level ESLint disable directive to the vendored mutation-test-elements.js bundle so SDL ESLint emits no findings for that file.
• Removes the ineffective guardian_baselines.gdnbaselines file from the repo root.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
guardian_baselines.gdnbaselines	Removes a baseline file that was not successfully suppressing the SDL ESLint findings.
crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js	Prepends a file-level eslint-disable banner to exempt the vendored minified bundle from SDL ESLint findings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.7%. Comparing base (c4ee270) to head (c335a42).

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #122   +/-   ##
=====================================
  Coverage   97.7%   97.7%           
=====================================
  Files        286     286           
  Lines      62460   62460           
=====================================
+ Hits       61032   61033    +1     
+ Misses      1428    1427    -1     

Flag	Coverage Δ
linux	93.9% <ø> (?)
linux-arm	93.9% <ø> (?)
windows	94.7% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Sander Saares (sandersaares)]

[Copilot speaking]

Published 2 findings. No finding follows up on an existing discussion thread.

See diagnostics

Diagnostic	Value
Cache	Hit

[Sander Saares (sandersaares)]

[Copilot speaking]

Preserve the lint exemption when refreshing the vendored viewer

Refreshing the vendored viewer means replacing the checked-in browser bundle with a newer upstream distribution. At the reviewed commit, the local file is exactly the published 3.9.0 bundle after its first line is removed, so the ESLint directive is a repository-only patch. The adjacent VERSION file records only 3.9.0, and the repository contains no refresh procedure or invariant that says to restore the patch after replacement.

Reproducible reasoning: html.rs embeds this file with include_str!, so copying a future upstream dist/mutation-test-elements.js preserves the runtime integration but discards line 1. ESLint 7.32 uses that line to suppress reports from the file, and the unsuccessful Guardian baseline that attempted to match the @microsoft/sdl/no-inner-html results is deleted in the same diff. A refresh that omits the directive therefore sends those SDL findings back into Guardian with no baseline fallback and can break publishing. The banner makes the local difference visible in review, but a source-adjacent refresh instruction or repeatable check would make preserving it deliberate rather than relying on a maintainer recognizing the deletion.

Consequence: A routine viewer upgrade can reintroduce the publish failure even though the bundled viewer still works in generated reports, adding avoidable diagnosis and repair work.

Recommended action: Document the refresh operation next to the vendored assets, for example in src/vendor/README.md, including the upstream URL and version plus the step that reapplies the final ESLint directive chosen for this file. If refreshes are scripted, have the script assert or prepend that directive. This keeps the safeguard proportional to the vendored artifact without introducing a crate-wide implementation guide.

References:

• crates/cargo-gamma-lib/src/vendor/VERSION
• crates/cargo-gamma-lib/src/html.rs
• Published mutation-testing-elements 3.9.0 browser bundle
• ESLint 7.32 file-level disable comments

Impacted locations:

• crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js:1
• crates/cargo-gamma-lib/src/vendor/VERSION:1
• crates/cargo-gamma-lib/src/html.rs:22

[Sander Saares (sandersaares)]

[Copilot speaking]

Keep unrelated ESLint checks enabled for the vendored viewer

Guardian baselines and ESLint disable comments act at different layers. The deleted baseline attempted to match three @microsoft/sdl/no-inner-html results after ESLint analyzed the file; although those signatures failed to match the reported build, the baseline's declared scope was still those individual results rather than the whole file. The new bare /* eslint-disable */ acts inside ESLint and suppresses every configured rule for the entire viewer before Guardian receives any result. That broadens the exemption beyond the rule failure this change addresses.

Reproducible reasoning: ESLint 7.32 supports file-level directives that name specific rules. Replacing line 1 with /* eslint-disable @microsoft/sdl/no-inner-html -- ... */ keeps the source-local fix: ESLint still parses the file and omits the known no-inner-html reports, while every other configured rule continues to run and can report. This avoids the signature-matching problem without requiring an all-rule exclusion. Upstream linting is not equivalent coverage for this artifact: mutation-testing-elements v3.9.0 globally ignores its generated dist directory and does not run the Microsoft SDL plugin. The blanket directive therefore removes repository-specific lint signal without being needed to solve the demonstrated diagnostics.

Consequence: Any present or future rule other than no-inner-html that flags this executable bundle is hidden automatically, so maintainers lose the chance to evaluate the result, update the upstream dependency, or record a deliberate exception.

Recommended action: Keep the baseline deletion, but scope line 1 to @microsoft/sdl/no-inner-html and retain a -- explanation for why that rule is exceptional. The named directive suppresses the demonstrated diagnostics while allowing other rule results to continue through Guardian at essentially the same maintenance cost. If an all-rule exemption is intentional, state that broader trade-off explicitly rather than treating upstream linting as equivalent coverage.

References:

• ESLint 7.32 rule-specific file-level disable comments
• Microsoft SDL no-inner-html rule documentation
• mutation-testing-elements 3.9.0 shared ESLint configuration

Impacted locations:

• crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js:1
• guardian_baselines.gdnbaselines:26-28
• guardian_baselines.gdnbaselines:42-44
• guardian_baselines.gdnbaselines:58-60