chore: enforce no unused deps or code in ci (#4654)

Author: carderne

.github/workflows/code-quality.yml

@@ -36,3 +36,6 @@ jobs:
 
       - name: 🔎 Lint
         run: pnpm exec oxlint .
+
+      - name: ✂️ Check unused code and dependencies
+        run: pnpm run knip

AGENTS.md

@@ -81,6 +81,18 @@ pnpm run lint:fix    # oxlint — auto-fixes lint violations
 pnpm run lint        # oxlint — check only (no fixes)
 ```
 
+### Dead code
+
+We use knip to control unused dependencies and code. It is enforced by CI `code-quality`.
+
+Scan your code before pushing with:
+
+```bash
+pnpm run knip
+```
+
+If there are false positives, edit ./knip.json so that it passes.
+
 ### Imports
 
 **Prefer static imports over dynamic imports.** Only use dynamic `import()` when:

CONTRIBUTING.md

@@ -238,10 +238,11 @@ This never affects correctness — CI enforces the same checks on every PR; the
 1. **Always open your PR in draft status first.** Do not mark it as "Ready for Review" until the steps below are complete.
 2. **Run format and lint locally before pushing:**
    ```bash
-   pnpm run format      # auto-fixes formatting (oxfmt)
-   pnpm run lint:fix    # auto-fixes lint violations (oxlint)
+   pnpm run format
+   pnpm run lint
+   pnpm run knip
    ```
-   Both are enforced by CI — the `code-quality` check will fail if either produces a diff or errors.
+   These are enforced by CI — the `code-quality` check will fail if either produces a diff or errors.
 3. **Address all CodeRabbit code review comments.** Our CI runs an automated code review via CodeRabbit. Go through each comment and either fix the issue or resolve it with a comment explaining why no change is needed.
 4. **Wait for all CI checks to pass.** Do not mark the PR as "Ready for Review" until every check is green.
 5. **Then mark the PR as "Ready for Review"** so a maintainer can take a look.

apps/supervisor/src/backpressure/backpressureMonitor.ts

@@ -1,6 +1,6 @@
 import type { BackpressureMetrics } from "./backpressureMetrics.js";
 
-export interface BackpressureLogger {
+interface BackpressureLogger {
   info(message: string, meta?: Record<string, unknown>): void;
   error(message: string, meta?: Record<string, unknown>): void;
 }

apps/supervisor/src/clients/kubernetes.ts

@@ -3,7 +3,7 @@ import type { Informer, KubernetesObject, ListPromise } from "@kubernetes/client
 import { assertExhaustive } from "@trigger.dev/core/utils";
 import { SimpleStructuredLogger } from "@trigger.dev/core/v3/utils/structuredLogger";
 
-export const RUNTIME_ENV = process.env.KUBERNETES_PORT ? "kubernetes" : "local";
+const RUNTIME_ENV = process.env.KUBERNETES_PORT ? "kubernetes" : "local";
 
 const logger = new SimpleStructuredLogger("kubernetes-client");
 

apps/supervisor/src/wideEvents/index.ts

@@ -7,18 +7,14 @@
  * Off by default behind a kill switch - the dispatch hotpath runs at high
  * QPS, so logging pressure must be cleanly removable.
  */
-export { type Env, isValidRequestId, newState, type NewStateOptions } from "./new.js";
-export { emit, EmitMessage } from "./emit.js";
-export { parseTraceId } from "./traceparent.js";
-export { fromContext, wideEventStorage } from "./context.js";
-export { type PhaseOpt, recordPhase, recordPhaseSince, timePhase } from "./record.js";
+export { fromContext } from "./context.js";
+export { recordPhaseSince } from "./record.js";
 export {
   emitOneShot,
   runWideEvent,
   setExtra,
   setMeta,
-  type WideEventLifecycleOptions,
   type WideEventOptions,
 } from "./middleware.js";
-export type { ErrorInfo, PhaseRecord, State } from "./state.js";
+export type { State } from "./state.js";
 export { encodeBaggage } from "./baggage.js";

apps/supervisor/src/wideEvents/state.ts

@@ -76,7 +76,7 @@ export type PhaseRecord = {
 };
 
 /** Top-level error summary for a failed operation. */
-export type ErrorInfo = {
+type ErrorInfo = {
   code: string;
   message: string;
   /** Coarse classification - "client" | "upstream" | "internal" | "timeout". */

apps/supervisor/src/workloadToken.ts

@@ -28,7 +28,6 @@ const mintCounter = new Counter({
 });
 
 export type WorkloadAuthTransport = "http" | "ws";
-export type WorkloadAuthOutcome = "jwt_valid" | "jwt_invalid" | "legacy_bare" | "token_absent";
 
 const verifyCounter = new Counter({
   name: "workload_auth_verify_total",