# ci: reject unused tailscale exports with Knip · PR \#10012 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/10012)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: t3code/knip-tailscale-export-gate

Target branch: t3code/knip-stricter-entry-audit

Head commit: 7ccaaf0727aa68ed029b847f28b4730a981e7241

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/10012)

[Commits](https://git.cafe/pingdotgg/t3code/pull/10012/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/10012/diffs?format=markdown)

## Description

---

CI currently rejects unused files and dependencies but does not reject unused exports. The Tailscale package is export-clean after the preceding layer, so it can now enforce those checks without a backlog baseline.

Extend the existing knip:check command with a Tailscale export/type audit. Keep the repository-wide file/dependency gate and existing entrypoint handling. Add no dependencies, suppressions, or baseline. Update the existing maintainer instructions so the checked scope is explicit and can grow workspace by workspace. The full repository export audit remains available and still reports the backlog.

Verification: the exact CI command passes. Temporarily re-exporting one unused value and type makes it exit 1 and name both findings; restoring the cleanup makes it pass again. Formatting and diff checks pass. No product behavior changes.

Model: gpt-6 astra. Harness: Codex in T3 Code.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Tooling and CI script changes only; no runtime or product behavior is modified.
> 
> **Overview**
> **CI now fails on unused exports and types in `packages/tailscale`**, in addition to the existing repo-wide unused-file and dependency checks.
> 
> The root `knip:check` script chains a second Knip run (`--workspace packages/tailscale --exports`). The CI step is renamed to **Check unused code** with comments/docs that spell out the split: repo-wide files/deps vs export gates only for workspaces that are clean enough to enforce.
> 
> Maintainer docs note the full export audit is still optional and can grow workspace-by-workspace as backlogs shrink.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 7ccaaf0727aa68ed029b847f28b4730a981e7241. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- Macroscope's pull request summary starts here -->
<!-- Macroscope will only edit the content between these invisible markers, and the markers themselves will not be visible in the GitHub rendered markdown. -->
<!-- If you delete either of the start / end markers from your PR's description, Macroscope will append its summary at the bottom of the description. -->
> [!NOTE]
> ### Reject unused `tailscale` exports in `knip:check` CI script
> - Extends the `knip:check` script in [package.json](https://github.com/pingdotgg/t3code/pull/10012/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519) to run an export check scoped to `packages/tailscale` after the repo-wide files and dependencies check passes.
> - Updates [docs/operations/development.md](https://github.com/pingdotgg/t3code/pull/10012/files#diff-d4193c695085935050d7dd7572ae2c767e26244ca27f5ae7fd015ff4c97c8ba2) and renames the CI step in [ci.yml](https://github.com/pingdotgg/t3code/pull/10012/files#diff-b803fcb7f17ed9235f1e5cb1fcd2f5d3b2838429d4368ae4c57ce4436577f03f) to reflect the new check.
> - Behavioral Change: CI now fails if `packages/tailscale` contains unused exports or types.
>
> <!-- Macroscope's review summary starts here -->
>
> <sup><a href="https://app.macroscope.com">Macroscope</a> summarized 7ccaaf0.</sup>
> <!-- Macroscope's review summary ends here -->
>
<!-- Macroscope's pull request summary ends here -->