From 32992a22a98c356686283a65969532c2d7428eb5 Mon Sep 17 00:00:00 2001
From: MK <fengmk2@gmail.com>
Date: Sat, 17 Oct 2026 10:53:27 +0800
Subject: [PATCH] ci: add Fallow pull request audits

---
 .fallowrc.jsonc          | 24 ++++++++++++++++++++++++
 .github/workflows/ci.yml | 18 ++++++++++++++++++
 .gitignore               |  1 +
 CONTRIBUTING.md          |  8 ++++++++
 4 files changed, 51 insertions(+)
 create mode 100644 .fallowrc.jsonc

diff --git a/.fallowrc.jsonc b/.fallowrc.jsonc
new file mode 100644
index 0000000000..255bec424c
--- /dev/null
+++ b/.fallowrc.jsonc
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/v3.33.1/schema.json",
+  "entry": [
+    // Tests use vite-plus/test and are run by the root Vite config.
+    "**/*.{test,spec}.{js,jsx,ts,tsx,mjs,cjs,mts,cts}",
+    ".github/scripts/__tests__/*.mjs",
+    // Standalone scripts also run outside package.json scripts.
+    "bench/*.ts",
+    "ecosystem-ci/*.ts",
+  ],
+  "ignorePatterns": [
+    // Fixture projects and templates are inputs to other programs.
+    "crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/**",
+    "packages/cli/src/__tests__/fixtures/**",
+    "packages/cli/templates/**",
+    // Native bindings and task types are generated by the Rust build.
+    "packages/*/binding/**",
+    "packages/cli/src/run-config.ts",
+  ],
+  "workspaces": {
+    // The documentation site has its own pnpm workspace.
+    "patterns": ["docs"],
+  },
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cdfac7e291..c0196f81a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,23 @@ defaults:
     shell: bash
 
 jobs:
+  fallow:
+    name: Fallow audit
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: fallow-rs/fallow@fccff887da0d83db1711379e0a3696dfc2460fdd # v3.33.1
+        with:
+          command: audit
+          version: '3.33.1'
+          gate: new-only
+
   detect-changes:
     runs-on: ubuntu-latest
     permissions:
@@ -1647,6 +1664,7 @@ jobs:
     runs-on: ubuntu-latest
     if: always()
     needs:
+      - fallow
       - docs-fmt
       - test
       - build-windows-tests
diff --git a/.gitignore b/.gitignore
index c904cdf975..c93eb929c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ vite
 /crates/vp_global_cli/vp
 .void/
 .direnv
+/.fallow/
 
 # PTY snapshot runner failure artifacts (reviewed via the diff, never committed)
 crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/*/snapshots/*.md.new
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1a79a9c18a..2915dbfa43 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -173,6 +173,14 @@ You can run this command to build, test and check if there are any snapshot chan
 pnpm bootstrap-cli && pnpm test && git status
 ```
 
+Pull requests also run [Fallow](https://github.com/fallow-rs/fallow) to check for new unused code, duplication, and complexity findings. The audit compares the pull request with its base; existing findings do not fail the check. Run the same version locally with:
+
+```bash
+pnpm dlx fallow@3.33.1 audit --base origin/main
+```
+
+The audit needs Git history for the base comparison, but does not need a build or installed project dependencies. [`.fallowrc.jsonc`](.fallowrc.jsonc) defines additional entry points and excludes fixture projects, templates, and generated code.
+
 ## CLI Snapshot Tests (PTY runner)
 
 CLI output and interactive flows (prompts, pickers, keystrokes, ctrl-c) are tested with the PTY snapshot suite in `crates/vp_cli_snapshots/`. Every step runs in a real pseudo-terminal; snapshots are Markdown files compared with real pass/fail semantics. **Write new CLI tests here**, one fixture directory per scenario with a `snapshots.toml` declaring the cases.