test(ai-action): prove built CLI and GitHub Action forwarding end to end

[kunaldhongade]

Problem

The new AI-first command has useful source-level CLI tests, but release-risk proof is incomplete:

• built CLI coverage checks ai --help, not a complete built ai or ai preflight workflow
• GitHub Action tests mostly assert that shell fragments exist in action.yml
• string-presence assertions can pass even if mode guards, argument ordering, environment forwarding, output handling, or exit propagation are broken

This is a follow-up to the broader child-repository acceptance work in #655.

Acceptance criteria

Built CLI

• Run the packed/built CLI for ai --format json against an isolated git repository.
• Cover Codex default profile and at least one alternate profile.
• Cover ai preflight --task using the built artifact.
• Cover --cwd, --output, --base, --head, task filters, and invalid input.
• Cover --with-checks passing, failing, skipped, and safety-blocked states.
• Prove the bundle is written before documented non-zero --fail-on or verification exits.
• Confirm no workspace-only imports or protocol dependencies are required.

GitHub Action

• Execute the Action argument-building shell path with a fake CLI that records argv, environment, stdout/stderr, and exit status.
• Prove mode: ai forwards profile, refs, cwd, output, format, fail-on, and with-checks correctly.
• Prove with-checks is not forwarded to unsupported modes.
• Prove agent mode does not receive fail-on.
• Prove CLI failure propagates to the Action's final status while the summary/comment path remains best effort as designed.
• Avoid tests whose only proof is actionYaml.toContain(...) for runtime behavior.

Dependency

• Blocked by feat(ai): add the recommended AI-first CLI and GitHub Action workflow #693, which owns the public codedecay ai and Action mode: ai implementation.
• This issue must remain independent acceptance proof and should not reimplement the command.

OSS-first note

Use a small deterministic shell harness or an existing local GitHub Action runner if already available. Do not add a heavy custom runner when a maintained OSS tool fits.

Validation

• pnpm run lint
• pnpm typecheck
• focused built CLI and Action tests
• pnpm test
• pnpm build
• pnpm --filter @submuxhq/codedecay pack --dry-run

[kunaldhongade]

Pre-code test contract

This contract was defined before production implementation. The shared method is in docs/rfcs/0003-test-first-uat-usability-agentic-qa.md.

User job: run the published AI-first workflow locally or in GitHub Actions
and receive the same documented arguments, artifacts, and failure behavior.

UAT

• UAT-667-1: Pack/build the CLI, install or invoke only the artifact, and run
  ai plus ai preflight in an isolated git repository.
• UAT-667-2: Cover default and alternate profiles, refs, cwd, output, task
  filters, invalid input, checks, safety blocking, and fail thresholds.
• UAT-667-3: Execute the Action argument-building/runtime path with a fake CLI
  recorder; assert exact argv, environment, output, stderr, and status.
• UAT-667-4: Unsupported argument/mode combinations are not forwarded.
• UAT-667-5: Failure propagates while the documented report/summary behavior
  remains best effort.

Usability

• Built help and errors let a new user choose the correct mode and fix invalid
  input without reading source.
• Local and Action terminology match.
• Output artifact location and non-zero exit reason are obvious.

Agentic closed-loop QA

• Use the built artifact against a seeded child repository, hand its bundle to a
  deterministic fake agent, apply one repair, and re-run the built artifact.
• Verify the final report reflects the repair and no workspace-only imports are
  required.
• Corrupt/missing fake CLI, blocked checks, and failing agent paths remain
  explicit.

Automation target: built-artifact Vitest fixtures and a deterministic shell
harness. Evaluate a maintained local Action runner before building a larger
custom runner.