Skip to content

fix(ci): unblock main — race in sse, lighthouse cert, e2e selectors - #345

Merged
krisarmstrong merged 2 commits into
mainfrom
fix/main-ci-recovery
May 27, 2026
Merged

fix(ci): unblock main — race in sse, lighthouse cert, e2e selectors#345
krisarmstrong merged 2 commits into
mainfrom
fix/main-ci-recovery

Conversation

@krisarmstrong

Copy link
Copy Markdown
Collaborator

Summary

Stem main CI has been failing since #338 (Phase 0 tokenization) merged. Three independent root causes — none were Phase-0 regressions, but Phase-0 was the first change broad enough to trip the path filters and surface them. Each blocked release-please from firing (workflow_run conclusion = failure ⇒ skip).

Backend (race detector)

SSEBroadcaster.Publish() released the read lock before sending. A concurrent unsubscribe() could close the channel between the snapshot and the send → write-on-closed-channel race that was tripped by TestSSEBroadcaster_ConcurrentSubscribePublish.

Fix: hold the read lock across the (non-blocking, select default) sends. Stalled-subscriber cleanup runs after the rlock releases so unsubscribe's write lock can proceed.

E2E

  • history-page: locator('text=/...|history|.../') matched the sidebar "History" label first (hidden on mobile viewport) before reaching main content. Scoped the match to the page's <section>.
  • language-switch: tests asserted on "Test Modules" / "Módulos de Prueba" but the i18n key common.sections.modules was never wired into any rendered UI — the sidebar Tests group was hardcoded label: 'Tests'. Wired Sidebar to use t(label, { defaultValue: label }) so existing display strings still work, then set Tests group label to the i18n key. Now the marker actually renders in both languages.

Lighthouse

treosh/lighthouse-ci-action was invoked with inline urls: override but no configPath, so .lighthouserc.json settings were ignored. Workflow targets https://localhost:8444 (stem is HTTPS-only post-Wave-1) with a mkcert dev cert that the CI runner doesn't trust → INSECURE_DOCUMENT_REQUEST / ERR_CERT_AUTHORITY_INVALID on every audit, blocking every release-please run for the past several merges.

Fix: add chromeFlags: --ignore-certificate-errors --allow-insecure-localhost to .lighthouserc.json settings, pass configPath: ./.lighthouserc.json so the action loads them, and switch the config's example URLs from http → https to match.

Test plan

  • go test -race -count=3 ./internal/api -run TestSSEBroadcaster — clean (3× iterations)
  • npx tsc --noEmit — clean
  • npm run build — clean
  • CI Backend (race detector) — primary verification
  • CI E2E Browser Tests — primary verification
  • CI Lighthouse Audit — primary verification
  • release-please fires after merge → release PR refreshes / opens

main ci has been failing since phase 0 tokenization (#338) merged.
three independent root causes — none were phase-0 regressions but
phase-0 was the first change broad enough to trip the path filters
and surface them.

backend (race detector):
sse broadcaster's publish() released the read lock before sending,
so a concurrent unsubscribe could close the channel between the
"copy subs" snapshot and the send → write-on-closed-channel race.
fix: hold the read lock across the (non-blocking, select-default)
sends; the stalled-subscriber cleanup happens after the rlock is
released so unsubscribe's write lock can proceed.

e2e:
- history-page "result snapshot or empty hint": locator
  `text=/...|history|.../` matched the sidebar "history" label
  first (hidden on mobile viewport) before reaching the main
  content. scope to the page section.
- language-switch tests asserted on "test modules" /
  "módulos de prueba" but the i18n key common.sections.modules
  was never wired into any rendered ui — sidebar tests group was
  hardcoded `label: 'tests'`. wire sidebar via t() with
  defaultvalue fallback so existing display strings still work,
  set tests group label to the i18n key. now the marker actually
  renders, in both languages.

lighthouse audit:
treosh/lighthouse-ci-action was called with an inline urls:
override but no configpath, so .lighthouserc.json's settings were
ignored. workflow targets https://localhost:8444 (stem is https-
only post-wave-1) with a mkcert dev cert that the ci runner does
not trust → INSECURE_DOCUMENT_REQUEST / ERR_CERT_AUTHORITY_INVALID
on every audit, blocking every release-please run for the past
several merges. fix: add chromeflags (--ignore-certificate-errors
--allow-insecure-localhost) to .lighthouserc.json settings and
pass configpath: ./.lighthouserc.json so the action loads them.

unblocks release-please for stem.
@qodo-code-review

Copy link
Copy Markdown

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

@krisarmstrong
krisarmstrong enabled auto-merge (squash) May 27, 2026 20:27
@github-actions

Copy link
Copy Markdown
Contributor

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

  • Unknown: 31 package(s)
  • MIT: 26 package(s)
  • BSD-3-Clause: 16 package(s)
  • Apache-2.0: 11 package(s)
  • BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

- Sidebar.tsx: biome format pass after the t() wrapping refactor
  (re-indentation inside the new `=> { ... }` body)
- useLocale.test.ts: the two `biome-ignore lint/suspicious/noExplicitAny`
  comments stopped suppressing anything after a biome upgrade — the
  underlying `any` was already type-safe enough that biome no longer
  flagged it. replace `as any` with explicit cast through
  `UseTranslationResponse<...>['i18n'|'t']` and drop the dead
  suppressions. tests still pass (3/3 in useLocale.test.ts).
@github-actions

Copy link
Copy Markdown
Contributor

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

  • Unknown: 31 package(s)
  • MIT: 26 package(s)
  • BSD-3-Clause: 16 package(s)
  • Apache-2.0: 11 package(s)
  • BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant