fix(build): build gittensory-engine before the gittensory-api deploy

[JSONbored]

Summary

• The Cloudflare Workers Build for gittensory-api has failed on every push to main since 487d26ac (PR feat(mcp): add gittensory_find_opportunities to hosted Worker (#2308) #3986, 2026-07-07T09:36:46Z): wrangler deploy's bundler can't resolve @jsonbored/gittensory-engine because packages/gittensory-miner/lib/opportunity-fanout.js (committed, pre-built, newly reachable from src/mcp/find-opportunities.ts since feat(mcp): add gittensory_find_opportunities to hosted Worker (#2308) #3986) imports it, and that package's dist/ is gitignored and only produced by an explicit build step that Cloudflare's npm run deploy:api never runs.
• Fixes it by building the engine package first, exactly mirroring the identical fix already applied to the self-host image build (fix(selfhost): build gittensory-engine before bundling the self-host image #4034), the release build (fix(ci): build engine package before the release self-host bundle #4063), and the backend test suite (fix(ci): build engine package before running backend tests #4036) for the same import chain.
• Reproduced locally (mv packages/gittensory-engine/dist /tmp/... && wrangler deploy --dry-run fails with Could not resolve "@jsonbored/gittensory-engine") and confirmed the fix resolves it (same repro, now clean).
• Closes gittensory-api Workers Build fails: @jsonbored/gittensory-engine unresolved (dist/ not built before deploy) #4081.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — this is a one-line package.json script change with no src/** lines touched, so codecov/patch has nothing to measure here; ran the full suite anyway as part of npm run test:ci.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• No new tests: this is a build/deploy-pipeline ordering fix (an npm script string in package.json), not application logic — nothing under src/** changed. Verified instead by direct reproduction of the actual failure and fix against wrangler deploy --dry-run (see Summary). Matches precedent: the three prior identical fixes (fix(selfhost): build gittensory-engine before bundling the self-host image #4034, fix(ci): build engine package before the release self-host bundle #4063, fix(ci): build engine package before running backend tests #4036) were also pure build-config changes with no test additions.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS logic touched; this only changes build ordering for an existing deploy command.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP behavior changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Visible UI changes include a UI Evidence section below with screenshots. (N/A — no visible UI change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

UI Evidence

N/A — no visible UI, frontend, docs, or extension changes.

Notes

• Filed and root-caused as gittensory-api Workers Build fails: @jsonbored/gittensory-engine unresolved (dist/ not built before deploy) #4081, including the exact reproduction steps and a survey of the three prior PRs that fixed this identical class of bug for other pipelines.
• The hosted gittensory-api Worker is currently ~60 commits behind main (last successful deploy: 2026-07-07T09:33:24Z) as a result of this being broken; merging this should let the very next push to main redeploy it and catch back up automatically.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.63%. Comparing base (cd1d0a1) to head (deaab28).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4084   +/-   ##
=======================================
  Coverage   93.63%   93.63%           
=======================================
  Files         384      384           
  Lines       35827    35827           
  Branches    13150    13150           
=======================================
  Hits        33548    33548           
  Misses       1618     1618           
  Partials      661      661           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-08 00:06:43 UTC}

1 file · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): package.json (matched package.json), package.json (matched **/package.json).

Review summary
One-line package.json change adding `npm --workspace @​jsonbored/gittensory-engine run build` before `wrangler d1 migrations apply` and `wrangler deploy` in the `deploy:api` script, fixing a Cloudflare Workers Build failure where wrangler's bundler can't resolve `@​jsonbored/gittensory-engine` because its gitignored `dist/` was never built before deploy. This exactly mirrors the same fix already landed for `build:miner` (visible in the same file: `npm --workspace @​jsonbored/gittensory-engine run build && npm --workspace @​jsonbored/gittensory-miner run build`), so the pattern is consistent with existing repo convention rather than novel. The change is minimal, correctly scoped to the single broken script, linked to an open issue (#4081), and CI is green with no `src/**` lines touched so coverage has nothing to measure here.

Nits — 4 non-blocking

• Consider whether `deploy:api`'s engine build should itself depend on `build:miner`/other existing composite scripts to avoid drift if the engine build command changes again in one place but not another — worth a one-line comment or a shared script alias if this fix pattern needs to be replicated a 5th time.
• Since this is the 4th time the same `npm --workspace @​jsonbored/gittensory-engine run build && ...` prefix has been copy-pasted (self-host image, release build, backend test suite, now deploy:api per the PR description), consider a small composite script like `build:engine` that each of these call, so a future engine build-flag change doesn't require hunting down 4 call sites.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4081
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 496 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 496 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The PR prepends `npm --workspace @​jsonbored/gittensory-engine run build` to the `deploy:api` script, exactly matching the fix's stated approach and mirroring the analogous fixes in #4034/#4036/#4063 for the same unresolved-import issue.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 496 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review