ci: hygiene gates — matrix unblock, scope, cancel, gitleaks, RAG offline by BigSimmo · Pull Request #1413 · BigSimmo/Database

BigSimmo · 2026-07-30T05:41:13Z

Summary

Implements the recommended CI hygiene items from the testing-approach review (everything Grok can safely do without tackling #093):

Unblock weekly release-browser-matrix — depends on changes/static-pr/build/ui-critical success, not pr-required, so a blocking scheduled npm audit can no longer skip Firefox/WebKit (#023 structural half).
Narrow scopes — src/app/api/** no longer sets ui_changed; API routes no longer set db_changed.
#095 cancelled diagnosis — landed on main via PR Distinguish a cancelled PR-required run from a real failure #1409. This PR aligns with it (if: always(), stay red, clear cancelled vs failure). Does not use !cancelled() (skipped required checks count as passing).
Pin Gitleaks (#097) — event head checkout + pinned base..head range.
Critical-first UI — test:e2e:critical then full test:e2e:pr on PR/merge_group; aggregate tests cover UI_FAST_RESULT.
Wire eval:rag:offline when rag_eval_changed.

Merge readiness: MERGEABLE + CLEAN, tip CI green including PR required (run 30520428391 on 7cdb4dc1). Still draft — mark ready, then merge. I did not merge.

Not in this PR: #093. Confirm CI_TRIAGE_ENABLED manually.

Clinical Governance Preflight

Intended clinical behavior change is documented above (or N/A) — N/A: CI/process only.
Privacy / tenancy / owner-scope impact assessed — N/A.
Source governance / citation / document-access impact assessed — N/A.
Failure behavior remains conservative (no new guessy fallback / silent success) — cancelled stays red with clear diagnosis; failures fail closed.
Verification evidence recorded below (commands + results) — see Verification.
Rollback path is identified — revert this PR.

RAG impact

RAG impact: no retrieval behaviour change — adds offline eval:rag:offline when retrieval/answer paths change; no ranking/selection/imputation/live-eval threshold change.

Verification

check:ci-scope / gitleaks-pinned / gate-manifest / outstanding-issues  # pass
npx vitest run tests/ci-cache-safety.test.ts   # 13 passed
git merge-tree origin/main HEAD                # clean
Hosted CI 30520428391 on tip 7cdb4dc1          # success incl. PR required

Follow-ups

Mark ready for review → merge.
Confirm CI_TRIAGE_ENABLED=true.
Watch next weekly release-browser-matrix (#023 remainder).
#093 separately.
Optional: checksum-pin Gitleaks; add pin script to workflow scope patterns.

@critical

Unblock the weekly release-browser-matrix from pr-required so a blocking scheduled dependency audit cannot skip Firefox/WebKit. Narrow ui_changed away from src/app/api and db_changed away from API routes; fail-fast @critical UI on PRs before the full suite; treat aggregate cancelled as neutral; pin Gitleaks to event SHAs; wire eval:rag:offline when rag_eval_changed. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

supabase · 2026-07-30T05:41:18Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

coderabbitai · 2026-07-30T05:41:20Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 2 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4eeb10e6-c2c8-43c6-a621-4dcde03981fd

📥 Commits

Reviewing files that changed from the base of the PR and between 41c7433 and 80733c6.

📒 Files selected for processing (12)

.github/workflows/ci.yml
.github/workflows/secret-scan.yml
docs/branch-review-ledger.md
docs/outstanding-issues.md
docs/process-hardening.md
docs/testing.md
package.json
scripts/ci-change-scope.mjs
scripts/run-gitleaks-pinned.mjs
scripts/verify-pr-local.mjs
tests/ci-cache-safety.test.ts
tests/verify-pr-local.test.ts

_{Comment @coderabbitai help to get the list of available commands.}

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Static PR failed format:check on docs/outstanding-issues.md after the #95/#97 resolution rows were rewritten. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Resolve verify:cheap conflict by keeping both check:gitleaks-pinned and check:outstanding-issues. Rebuild the resolved archive with #95/#97 from this branch and #112 from main, and keep the archive as one contiguous table so the new outstanding-issues gate stays green. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

github-actions · 2026-07-30T06:26:54Z

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #6744 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

Use always() && !cancelled() so superseded concurrency cancels leave the aggregate cancelled/skipped instead of false-red, without treating cancelled needs as success when the tip never produced proof. Format the merged outstanding-issues archive for Prettier. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Adopt main's cancelled-vs-failure aggregate (stay red, clear diagnosis) and drop the unsafe always() && !cancelled() approach — skipped required checks count as passing on GitHub. Keep critical-first UI wiring and teach the #1409 aggregate tests about UI_FAST_RESULT. Restore main's FIXED #95 open row; keep #97 archived from this branch. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

…es-1bf5 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Verify the linux_x64 release archive against the published SHA-256 before install, keep the pin in the gitleaks self-test, and treat scripts/run-gitleaks-pinned.mjs as a workflow-scope change. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

main's #1418 (ledger merge dedupe + L4 quarterly archive rotation) and #1413 both edited docs/outstanding-issues.md, so this was a real content conflict rather than staleness: git merge-tree --write-tree confirmed CONFLICT before any resolution was attempted. Resolved by taking main's version of the ledger wholesale and re-applying this branch's five-row archive move on top, so neither side's work is lost: - from main: #88 and #97 archived, new open row #126 (quarterly ledger rotation) with queue order 35, the #23 "When" update (release-browser-matrix no longer blocked by pr-required), the #86 detail update, and the issues:next-id bump to 127. - from this branch: #95, #96, #104, #109 and #115 moved from Open items to Resolved / archive. No row from either side was dropped, and no id appears in both tables. Verified: 121 rows (52 open, 69 archived), marker next-id=127 above the highest; each of #88, #97, #95, #96, #104, #109, #115 resolves to exactly one archive row and #126 to one open row; zero conflict markers remain. npm run verify:cheap -> EXIT=0; "Gate-manifest OK: all 29 verify:cheap gates are enforced in CI"; "Test Files 431 passed (431)"; "Tests 4496 passed | 4 skipped (4500)". npx prettier --check . -> "All matched files use Prettier code style!" Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011YdPS2KhKqz2buzsUgmX3c

cursoragent and others added 5 commits July 30, 2026 05:43

docs(ledger): record ci-hygiene-gates implementation review

b6a7dcf

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

merge(main): sync PR #1413 with latest main

98b49c0

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

merge(main): sync PR #1413 with latest main

c115737

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

style: format outstanding-issues after CI hygiene ledger edits

69c6819

Static PR failed format:check on docs/outstanding-issues.md after the #95/#97 resolution rows were rewritten. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

cursoragent and others added 7 commits July 30, 2026 06:27

docs: record PR #1413 merge-readiness ledger row

b00ad97

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

docs: supersede PR #1413 merge-readiness ledger at tip

7cdb4dc

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into cursor/ci-hygiene-gat…

3d9a368

…es-1bf5 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into cursor/ci-hygiene-gat…

75df2ec

…es-1bf5 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

cursor Bot marked this pull request as ready for review July 30, 2026 07:38

cursoragent and others added 2 commits July 30, 2026 07:40

ci: retrigger checks after gitleaks checksum pin

a9f7d66

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Merge branch 'main' into cursor/ci-hygiene-gates-1bf5

80733c6

BigSimmo enabled auto-merge (squash) July 30, 2026 07:52

BigSimmo merged commit 3569e78 into main Jul 30, 2026
20 checks passed

BigSimmo deleted the cursor/ci-hygiene-gates-1bf5 branch July 30, 2026 07:55

BigSimmo mentioned this pull request Jul 31, 2026

issues: capture closed PR #1515 archive handoff (#159) #1519

Merged

Navigation Menu

ci: hygiene gates — matrix unblock, scope, cancel, gitleaks, RAG offline - #1413

ci: hygiene gates — matrix unblock, scope, cancel, gitleaks, RAG offline#1413
BigSimmo merged 15 commits into
mainfrom
cursor/ci-hygiene-gates-1bf5

BigSimmo commented Jul 30, 2026 •

edited by cursor Bot

Loading

Uh oh!

supabase Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

BigSimmo commented Jul 30, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Clinical Governance Preflight

RAG impact

Verification

Follow-ups

Uh oh!

supabase Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Jul 30, 2026

CI triage

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BigSimmo commented Jul 30, 2026 •

edited by cursor Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading