Adopt ESLint 9: move the lint stack and convert to flat config

[jasonleenaylor]

@typescript-eslint/parser 6→8 (#38) and super-linter 5→8 (#43) cannot land separately. Both are facets of one ESLint 9 migration, verified locally in a worktree off b266802.

What is actually blocking

#38 fails at install, not at lint. All three of its red checks share one cause:

npm error ERESOLVE could not resolve
npm error While resolving: @typescript-eslint/eslint-plugin@6.21.0
npm error Found: @typescript-eslint/parser@8.69.0

Dependabot moved the parser and left the plugin at 6.21.0, which requires parser ^6.

Bumping the pair is not enough either. eslint-plugin-jest@27.9.0 peer-caps the plugin at ^5 || ^6 || ^7, so it blocks 8 as well.

#43 fails for an unrelated reason that lands in the same migration. Lint Codebase dies with:

[FATAL]   Neither main, nor origin/main exist in /github/workspace

linter.yml:22 checks out with no fetch-depth, so the clone is shallow. Note this check was introduced in super-linter v6.0.0, not v8 — v5 is simply the last release without it, and it is not in super-linter's upgrade guide at any version.

What I verified locally

• Moving eslint@9, @typescript-eslint/parser@8.70.0, @typescript-eslint/eslint-plugin@8.70.0, eslint-plugin-jest, eslint-plugin-github, eslint-plugin-prettier and eslint-plugin-jsonc together installs cleanly. The graph resolves; it is only the piecemeal bumps that fail.
• The test suite passes unchanged on that stack — 16/16. No source change is needed.
• Lint is the whole remaining problem. Under ESLint 9, npm run lint fails with TypeError [ERR_UNKNOWN_FILE_EXTENSION]: Unknown file extension ".yml" — ESLint 9 loads flat config by default and tries to import .github/linters/.eslintrc.yml as a module.

The work

1. Move the whole lint stack in one commit: eslint 9, typescript-eslint 8 (both packages), and the four eslint plugins.
2. Convert .github/linters/.eslintrc.yml to flat config (eslint.config.mjs).
3. Update the lint script in package.json, which currently passes -c ./.github/linters/.eslintrc.yml.
4. Add fetch-depth: 0 to the checkout step in .github/workflows/linter.yml. checkout@v7 (Bump actions/checkout from 4 to 7 #41) does not fix this; it still defaults to depth 1.
5. Optional cleanup while there: DEFAULT_BRANCH: main is discouraged in super-linter v8 (auto-detected from the event payload), and v8.4+ defaults ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT to true, which warns without issues: write / pull-requests: write. Neither fails the job.

Not verified

super-linter v8 ships ESLint 9 and changes its default config filename to eslint.config.mjs; I could not execute the container locally (no Docker), so step 2 being sufficient for super-linter specifically is inferred from its docs, not observed. Steps 1-4 are all observed.

Closes out #38 and #43 once done.

[jasonleenaylor]

#48 (eslint-plugin-github 4.10.2 -> 6.1.2) is a third facet of this, and it fails for a reason that cannot be worked around in eslintrc.

Its lint step dies with ESLint couldn't find the config "plugin:github/recommended". The config was not removed -- 6.1.2 still ships lib/configs/recommended.js. The cause is that 6.0.0 set "type": "module", so ESLint 8's eslintrc loader require()s the package and gets a namespace object:

top-level keys: [ '__esModule', 'default' ]
has .configs: false
default.configs: [ 'browser', 'internal', 'recommended', 'typescript', 'react' ]

The configs sit under .default, unreachable from legacy config. So plugin 6 needs flat config, exactly as step 2 describes -- there is no eslintrc form of it.

Two things verified at #48's head that bear on the plan:

• eslint-plugin-github@5.1.8 is the last CommonJS release and supports eslint ^8 || ^9. Installed over 6.1.2 on that branch, npm run lint, npm run format:check and the 16 tests all pass. That is an escape hatch if this migration stays parked -- a 4->5 bump the current config can load -- not a substitute for it.
• Super-linter v5 bundles eslint ^8.54.0 and no eslint-plugin-github, so it resolves the plugin from the repo's node_modules and hits the same ESM failure; v8 bundles eslint ^9.39.2. That is from dependencies/package.json on each tag. It confirms the "not verified" note above on v8 shipping ESLint 9, and means step 2 and Bump super-linter/super-linter from 5 to 8 #43 must land together: flat config under v5 leaves TYPESCRIPT_ES red whatever the repo's own lint script does.

Closing out #48 as well, then.