ci: add root-ci workflow to close root-only-PR blind spot by nazarli-shabnam · Pull Request #243 · Devlaner/devlane

nazarli-shabnam · 2026-07-03T17:34:05Z

Summary

api-ci.yml and ui-ci.yml are path-filtered to apps/api/** and apps/web/** respectively. A PR that only touches root-level files — docker-compose.yml, root package.json/package-lock.json, commitlint.config.cjs, lint-staged.config.mjs, .husky/**, or any other .github/workflows/*.yml — triggers zero checks and merges with an empty/green status. GitHub's default CodeQL scanning (the Analyze (*) checks visible on every PR) doesn't cover this either — that's security pattern scanning, not functional/syntax validation.

Fixes #148

What changed

Added .github/workflows/root-ci.yml, triggered on pull_request with paths covering exactly the root files not already covered by the other two workflows (plus .github/workflows/** broadly, so any workflow-file edit gets validated by something). Steps, kept intentionally minimal per the issue's "at minimum validates the compose/config files":

docker compose config --quiet — validates docker-compose.yml parses/resolves
node --check lint-staged.config.mjs / node --check commitlint.config.cjs — syntax-only checks (no execution/side effects)
npm ci — validates root package.json/package-lock.json are consistent and installable

Deliberately not duplicating api-ci/ui-ci's full npm run validate here — this workflow's job is only to close the root-file blind spot, not re-run existing coverage.

Test plan

Ran all four checks locally before pushing: docker compose config --quiet, both node --check calls, and npm ci --dry-run — all pass
Will confirm on this PR itself that root-ci actually triggers (it touches .github/workflows/root-ci.yml, matching its own path filter) and passes for real

AI assistance

Implemented with Claude Code (Sonnet 5).

Summary by CodeRabbit

Chores
- Added a new CI check for pull requests that validates key root-level project configuration and dependency setup.
- The workflow runs Node.js 22, confirms Docker Compose config is valid, syntax-checks lint/commit message scripts, and installs dependencies using cached npm for faster runs.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

strix-security · 2026-07-03T17:34:11Z

Strix Security Review

No security issues found.

_{Updated for 606469f.}

Reviewed by Strix
_{Re-run review · Configure security review settings}

coderabbitai · 2026-07-03T17:34:29Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7125739d-785f-4e6a-8d06-377b30833aea

📥 Commits

Reviewing files that changed from the base of the PR and between d5268ca and 606469f.

📒 Files selected for processing (1)

.github/workflows/root-ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/root-ci.yml

📝 Walkthrough

Walkthrough

Added a new GitHub Actions workflow for pull requests that touch root-level configuration files on main. It checks out the repository, sets up Node.js 22, validates docker-compose.yml and config syntax, and installs root dependencies.

Changes

Root CI Workflow

Layer / File(s)	Summary
Workflow trigger and validate job `.github/workflows/root-ci.yml`	New workflow triggers on pull requests to `main` for root-level config paths and defines a `validate` job that checks out code, sets up Node.js 22, validates `docker-compose.yml`, syntax-checks lint-staged/commitlint configs, and installs dependencies via `npm ci`.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

A tiny CI burrow now guards the root,
For compose and configs, it takes a careful route.
Node hops in, then checks begin,
No more silent roots slipping past again. 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description has a summary, change details, and test plan, but misses many required template sections and the explicit linked-issue block.	Add the missing template sections: linked issue heading, type/surface, why approach, breaking changes, migrations, rollout, checklist, screenshots, and fuller test details.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: adding a root CI workflow to cover the root-only PR blind spot.
Linked Issues check	✅ Passed	The new workflow covers root-level files from `#148` and validates compose/config files with a lightweight job, matching the issue's fix.
Out of Scope Changes check	✅ Passed	The added least-privilege workflow settings stay within the CI fix and no unrelated code areas appear changed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 148-ci-root-path-filter

_{Comment @coderabbitai help to get the list of available commands.}

strix-security

Strix flagged 2 new security findings below. See the pinned summary comment for the full PR status.

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/root-ci.yml (1)
16-17: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

Consider adding a job timeout-minutes.

No timeout is set for validate; a hung npm ci or docker step would otherwise run until the default GitHub Actions ceiling. A small explicit timeout is cheap insurance.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/root-ci.yml around lines 16 - 17, The validate job
currently has no explicit timeout, so add a small job-level timeout to the
validate job in the root CI workflow. Update the validate job definition itself
(the one using runs-on: ubuntu-latest) to include timeout-minutes so hung steps
like npm ci or docker won’t run indefinitely.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/root-ci.yml:
- Around line 19-20: The Checkout step in the root-ci workflow is leaving GitHub
credentials in the local git config, which exposes the token to later job steps.
Update the actions/checkout configuration to disable credential persistence by
setting persist-credentials to false on the existing Checkout step, since this
job does not need to push. Use the Checkout step in root-ci.yml as the place to
make the change.
- Around line 15-18: The validate job in the root CI workflow is missing an
explicit permissions block, so the default GITHUB_TOKEN scope is broader than
needed. Add a permissions section under the validate job in the workflow and
restrict it to the minimum read-only access required for this job, keeping the
change localized to the validate job definition.

---

Nitpick comments:
In @.github/workflows/root-ci.yml:
- Around line 16-17: The validate job currently has no explicit timeout, so add
a small job-level timeout to the validate job in the root CI workflow. Update
the validate job definition itself (the one using runs-on: ubuntu-latest) to
include timeout-minutes so hung steps like npm ci or docker won’t run
indefinitely.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8713ec26-539f-4499-8363-613519dbe1f1

📥 Commits

Reviewing files that changed from the base of the PR and between f4d0a09 and dce04db.

📒 Files selected for processing (1)

.github/workflows/root-ci.yml

…cripts

…out credentials

nazarli-shabnam · 2026-07-03T17:47:54Z

All bot findings addressed and re-verified:

Strix: untrusted-code-execution via npm ci → fixed with --ignore-scripts (commit d5268ca)
CodeQL + CodeRabbit + Strix (independently, all 3): missing least-privilege permissions: block and missing persist-credentials: false on checkout → fixed (commit 606469f)

All 7 CI checks green, all 6 review threads resolved. Ready for merge.

ci: add root-ci workflow to cover config/docker-compose/husky changes

dce04db

Copilot AI review requested due to automatic review settings July 3, 2026 17:34

Copilot AI reviewed Jul 3, 2026

github-advanced-security Bot found potential problems Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/root-ci.yml Fixed

strix-security Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/root-ci.yml Outdated

Comment thread .github/workflows/root-ci.yml

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/root-ci.yml

Comment thread .github/workflows/root-ci.yml

ci(root): use npm ci --ignore-scripts to avoid running untrusted PR s…

d5268ca

…cripts

github-advanced-security Bot found potential problems Jul 3, 2026

View reviewed changes

Comment thread .github/workflows/root-ci.yml Fixed

ci(root): add least-privilege permissions and disable persisted check…

606469f

…out credentials

nazarli-shabnam merged commit 3191a34 into main Jul 3, 2026
9 checks passed

Navigation Menu

Uh oh!

ci: add root-ci workflow to close root-only-PR blind spot - #243

ci: add root-ci workflow to close root-only-PR blind spot#243
nazarli-shabnam merged 3 commits into
mainfrom
148-ci-root-path-filter

nazarli-shabnam commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

strix-security Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

strix-security Bot left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nazarli-shabnam commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

nazarli-shabnam commented Jul 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Test plan

AI assistance

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

strix-security Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Strix Security Review

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

strix-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nazarli-shabnam commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nazarli-shabnam commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

strix-security Bot commented Jul 3, 2026 •

edited

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading