Found while making flow-runas-unscoped blocking in #3760.
lintFlowPatterns has exactly one call site — packages/cli/src/commands/compile.ts:411. os build inherits it (build.ts extends Compile), but os validate does not run it at all.
That was tolerable while every flow-lint finding was advisory. Since #3760 one of them (flow-runas-unscoped) fails the build, so the surfaces now disagree:
os validate → clean
os build → fails
os validate is documented as the read-only superset of os build's gates (see the comment at validate.ts:566, which says the security-posture check is "the same gate `os compile`/`os build`" runs), so this is a real "validate says OK, build fails" trap — worst for CI setups that gate on validate.
Fix: run lintFlowPatterns in validate.ts alongside the other 3x gates, failing on severity: 'error' and printing the rest as warnings — mirroring what compile.ts now does.
Why it wasn't done in #3760: wiring the lint into validate surfaces all its rules there for the first time, including the advisory ones, which is a behavior change for existing projects beyond that PR's scope.
Refs #3760, #1874.
Found while making
flow-runas-unscopedblocking in #3760.lintFlowPatternshas exactly one call site —packages/cli/src/commands/compile.ts:411.os buildinherits it (build.tsextendsCompile), butos validatedoes not run it at all.That was tolerable while every flow-lint finding was advisory. Since #3760 one of them (
flow-runas-unscoped) fails the build, so the surfaces now disagree:os validateis documented as the read-only superset ofos build's gates (see the comment atvalidate.ts:566, which says the security-posture check is "the same gate `os compile`/`os build`" runs), so this is a real "validate says OK, build fails" trap — worst for CI setups that gate onvalidate.Fix: run
lintFlowPatternsinvalidate.tsalongside the other 3x gates, failing onseverity: 'error'and printing the rest as warnings — mirroring whatcompile.tsnow does.Why it wasn't done in #3760: wiring the lint into
validatesurfaces all its rules there for the first time, including the advisory ones, which is a behavior change for existing projects beyond that PR's scope.Refs #3760, #1874.