Restore Biome checks for JavaScript sources

[snowyukitty]

Fixes #406.

Summary

• add src/assets/js/**/*.js back to Biome's configured file set
• annotate declarations consumed by other classic scripts or inline handlers
  without changing their runtime bindings
• remove genuinely unused arguments and apply the requested optional-chain
  cleanups without weakening Biome's recommended rules
• keep the two touched complex functions within DeepSource's configured
  threshold by consolidating layered audio sequences and extracting
  Space Invaders movement and bullet access
• expose playSound at its definition through the repository's existing
  window.* convention
• update the pre-commit hook description to match the files it checks

Restoring the JavaScript include exposes 32 warnings that Super-Linter 8.7.0
treats as errors. The targeted suppressions only cover declarations that Biome
cannot see being consumed outside their source file; unrelated unused
declarations remain protected by the rule.

Scope

Biome still reports 20 informational diagnostics: 16 useTemplate
suggestions, two useParseIntRadix suggestions, and two configuration
migration notices. They do not fail --error-on-warnings and are left for
separate style/version work.

This change also leaves the pre-commit warning policy and unpinned local Biome
dependency unchanged. Aligning those with Super-Linter's pinned Biome 2.5.0
should be handled together as a follow-up.

Testing

• uvx prek run --all-files
• npm run build
• Biome 2.5.0 lint, format, and check over configured tracked files with
  --error-on-warnings --no-errors-on-unmatched
• Biome 2.5.0 lint and format over all 142 tracked files with the same
  Super-Linter flags
• behavior-trace comparison against the pre-refactor code for 15 audio
  state/type cases and seven Space Invaders update scenarios
• focused cyclomatic-complexity cross-check at a maximum of five
• git diff --check origin/main...HEAD
• DeepSource JavaScript and Secrets checks
• Socket Project Report and Pull Request Alerts

A browser comparison was subsequently recorded on July 31 in
#567 (comment):
headless Chromium exercised audio creation after a genuine click and Space
Invaders keyboard input, comparing that branch build against aa10215.
That is historical validation; browser interaction has not been rerun for this
description-only update.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 5b7f746...56f35a1 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 3, 2026 3:55a.m.	Review ↗
Secrets		Oct 3, 2026 3:55a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[snowyukitty]

Following up on the one caveat in the description: I've now exercised the two refactored areas in a real browser (headless Chromium, local build of this branch against aa10215).

Audio — with a genuine click to start the AudioContext, I traced every createOscillator/createGain call, the oscillator type, each frequency and gain value, and the start/stop offsets, for click, levelUp, secret, restore, and an unrecognised type. All five traces are identical on both builds, so the LAYERED_SOUND_CONFIGS lookup builds exactly the same audio graph the previous branch chain did.

Space Invaders — the game boots and renders, and under real key presses ArrowLeft/ArrowRight still drive setVelocityX(-400)/(+400), no input leaves it at 0, and Space still fires bullets. Same on both builds.

No console errors or failed requests beyond the ones the pre-change build already produces.

The five DeepSource comments above are all outdated — each was raised against an intermediate commit and answered by the next one; both analyzers are green on f78699ab.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new suppression for buildGameConfig conceals a genuinely unused declaration despite the PR’s stated linting policy.

Review effort: Balanced
Findings: 1

Open (1)

• Unused buildGameConfig helper is incorrectly suppressed · New

What changed in this PR

Restores Biome linting for JavaScript sources to address #406 while preserving classic-script integrations.

Changes:

• Re-enables JavaScript checks and updates hook documentation.
• Adds targeted lint suppressions and removes unused parameters.
• Refactors audio and Space Invaders logic to reduce complexity.

File	Description
biome.json	Includes JavaScript sources in Biome checks.
.pre-commit-config.yaml	Updates the Biome hook description.
src/​assets/​js/​script.js	Exposes audio globally and reduces complexity.
src/​assets/​js/​games/​space-invaders.js	Extracts movement and bullet helpers.
src/​assets/​js/​games/​game-manager.js	Annotates its cross-script global.
src/​assets/​js/​games/​dev-duel.js	Removes unused callback and function parameters.
src/​assets/​js/​games/​config.js	Annotates shared globals, including one unused helper.
src/​assets/​js/​games/​code-breaker.js	Removes unused parameters and applies optional chaining.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jbampton]

@deepsourcebot review

[jbampton]

Thanks looks good 🏂

Sorry for the delay