Expert · Performance and Node.js · topic 56 of 61 · 25 min
Real project tooling
Explanation
Why tooling?
Code is read far more often than it is written, by many people. Tools catch whole classes of mistakes automatically, keep style arguments out of code reviews, and protect secrets. Setting them up takes an hour and saves weeks.
ESLint: find problems
ESLint is a linter: it reads your code without running it and warns about likely bugs (unused variables, == instead of ===, a missing await, an unreachable line) and risky patterns. Rules are configured in eslint.config.js.
npm install --save-dev eslint @eslint/js
npx eslint . # report problems
npx eslint . --fix # fix what can be fixed automaticallyPrettier: format code
Prettier rewrites the layout of your code (spaces, quotes, line breaks) into one consistent style. Everyone's editor formats on save, and nobody argues about semicolons again. Let Prettier handle formatting and ESLint handle correctness.
Environment variables and secrets
Settings that change between your laptop, the test server and production (database URL, API keys, port) should come from environment variables, not be written in the code. Locally they often live in a .env file. Node can load it with node --env-file=.env app.js in recent versions, or with the dotenv package.
# .env (NEVER commit this file; add it to .gitignore)
PORT=3000
PAYMENT_API_KEY=test_key_here
DATABASE_URL=postgres://localhost/shop_devconst port = Number(process.env.PORT ?? 3000);
const apiKey = process.env.PAYMENT_API_KEY;
if (!apiKey) throw new Error('PAYMENT_API_KEY is not set');Debugging with breakpoints
- In VS Code, click left of a line number to set a breakpoint (a red dot).
- Start "Run and Debug" (or run node --inspect app.js and open chrome://inspect in Chrome).
- When execution stops, hover variables, look at the call stack, and step over / into / out of lines.
- Add a debugger; statement in code to pause there when DevTools is open.
A debugger shows every variable at the moment of the bug, which is usually faster than adding and removing console.log lines.
Bundlers and running TypeScript
Front-end code is usually bundled: a bundler (Vite, esbuild, webpack, Rollup) follows your imports, combines and minifies files, and handles TypeScript and JSX. For Node, you can compile TypeScript with tsc, run it with a tool like tsx during development, or, in recent Node versions, run simple .ts files directly because Node can strip the types; check the Node.js documentation for your version.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Real project tooling · 1/7
In this lesson you will set up the tools every professional JavaScript project uses.
Prefer a video by a teacher? Find free videos on “eslint prettier setup node project dotenv environment variables” on YouTube ↗
In real life: The API key that leaked
A student pushed a project to a public GitHub repository with a payment-gateway test key inside config.js. Within an hour, automated scanners had found it. Because it was a test key, no money was lost, but the provider disabled it. The fix was moving the key to .env, adding .env to .gitignore, and generating a new key.
// config.js (safe version)
export const config = {
port: Number(process.env.PORT ?? 3000),
paymentKey: process.env.PAYMENT_API_KEY, // read at start-up, never hard-coded
};Practice (0/3 done)
Write loadConfig(env) that reads PORT (default 3000, as a number) and PAYMENT_API_KEY (required) from an env object like process.env. Throw an Error "PAYMENT_API_KEY is not set" when the key is missing or empty.
Write parseDotEnv(text) that parses .env text into an object: one KEY=VALUE per line, ignore empty lines and lines starting with #, trim spaces around keys and values, and remove surrounding double quotes from values. Only split at the FIRST = sign.
In a small Node project: add ESLint (npm init @eslint/config@latest) and Prettier, create .env and .env.example, add .env and node_modules to .gitignore, and debug one function with a breakpoint in VS Code.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Memory and garbage collectionPerformance and Node.js · same module
- Environment variables and secretsFull-Stack Development · Deploying and running the app
- Environment variables and configBackend Development · Node.js and Express
- Why TypeScriptFrontend Web Development · TypeScript basics
- Building for productionFrontend Web Development · Build, deploy and get hired
- Modules, npm and ViteFrontend Web Development · Async JavaScript, modules and tools
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
What does ESLint do?
Answer: Reads code without running it and reports likely problems
ESLint is a static analysis tool (a linter).
Where should an API key live?
Answer: In an environment variable / .env file that is not committed
Secrets stay out of the code and out of Git.
A key was committed to a public repo. What first?
Answer: Rotate the key: create a new one and disable the old one
Assume it is already copied; make it useless.
What does a bundler like Vite do?
Answer: Combines and optimises front-end modules for the browser
Bundlers follow imports and produce optimised files.
A session secret was pushed to a public GitHub repo. What fixes the problem?Related
Answer: Rotate: make a new secret, deploy it, and stop using the old one
The old value stays in git history and may already be copied. Only replacing it makes it useless.
How can modern Node.js load a .env file without any package?Related
Answer: node --env-file=.env server.js
Node.js 20.6 and later understand the --env-file flag. Older projects use the dotenv package.
Recent Node.js versions can run a .ts file directly. What do they do with the types?Related
Answer: Strip (remove) them without checking
Node.js strips the types so the code can run. Type checking still needs tsc or your editor.
From Why TypeScript
When does TypeScript report type errors?Related
Answer: Before running, when you compile or in the editor
Type checking happens at compile time.
From Why TypeScript
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Performance and Node.js”. The module exam comes next.
- Module 11 exam: Performance and Node.js · 12 questions · 25 min, without help. 5 topics of this module still to finish first.
- Then the next module, Interview preparation and career. 61 topics left in the course before the final exam.