ci: enable strict mode and publish check results as SARIF - #558
Conversation
Deploying archgate-cli with
|
| Latest commit: |
128405f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8d0ad8c2.archgate-cli.pages.dev |
| Branch Preview URL: | https://claude-jaunty-wiggling-quilt.archgate-cli.pages.dev |
|
Warning Review limit reached
Next review available in: 37 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
📝 WalkthroughWalkthroughThe changes enable strict Archgate mode and add SARIF reporting to the pull request workflow. Claude Code hooks now expose Git Bash diagnostics and use explicit Windows configuration guidance. Loader diagnostics now report project-relative POSIX paths, with tests updated for unreadable and unparseable ADR cases. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/code-pull-request.yml:
- Around line 278-284: Update the final status job’s failure condition to
exclude the archgate-sarif result while retaining archgate-sarif in status.needs
so the job still waits for SARIF publishing. Ensure the required job fails only
when validate reports ADR findings, without changing the upload step’s
non-gating behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e47d0da9-2b57-4c5b-a699-58ee4c89cc6d
📒 Files selected for processing (9)
.archgate/config.json.claude/agent-memory/archgate-developer/MEMORY.md.claude/agent-memory/archgate-developer/project_claude_code_hooks_config.md.claude/settings.json.github/workflows/code-pull-request.ymlCONTRIBUTING.mdsrc/engine/loader.tstests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Analyze (java-kotlin)
- GitHub Check: Analyze (go)
- GitHub Check: Analyze (csharp)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Cloudflare Pages
🧰 Additional context used
📓 Path-based instructions (18)
{src,tests}/**/*.ts
📄 CodeRabbit inference engine (.archgate/adrs/LEGAL-001-spdx-license-headers.md)
{src,tests}/**/*.ts: Every TypeScript source file insrc/andtests/must begin with// SPDX-License-Identifier: Apache-2.0followed by// Copyright 2026 Archgate.
If a TypeScript file has a shebang line (for example#!/usr/bin/env buninsrc/cli.ts), the SPDX license header must appear immediately after the shebang.
Use single-line//comments for the SPDX header; do not use block comments (/* */) or alternate license identifiers.
Files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-006-dependency-policy.md)
**/*.{ts,tsx}: Prefer Bun built-ins for file I/O, HTTP, globbing, testing, and subprocess execution; prefernode:built-in modules over npm alternatives when appropriate.
UseBun.spawnwith array-based arguments for all subprocess execution; do not useBun.$because it can hang on Windows.
Do not add npm packages for functionality already provided by Bun, such asglob,chalk, or utility libraries used for a single function.
Use Bun APIs such asBun.file()instead of Node.js-specific APIs such asfs.readFile()when Bun provides an equivalent.
Use relative imports with Bun's native module resolution; do not use TypeScript path aliases.Use TypeScript strict mode with ESNext and ES modules; derive schema types with
z.infer<>rather than defining separate interfaces.
Files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
{src,tests,lint,scripts,shims}/**/*.ts
📄 CodeRabbit inference engine (.archgate/adrs/GEN-004-concise-forward-only-code-comments.md)
{src,tests,lint,scripts,shims}/**/*.ts: Project-authored TypeScript comments must be concise, describe current behavior only, and never narrate history, relocations, refactors, or how the code came to be.
A contiguous run of whole-line comments must contain at most five lines of narrative prose; longer rationale belongs in an ADR, agent-memory file, issue, or PR with a pointer. Tests and fixtures follow the same limit.
Use structural TSDoc tags such as@param,@returns,@throws,@example, and@seefor structured documentation; tagged sections are exempt from the five-line narrative bound, while@remarks,@description,@summary,@notes,@todo, and@fixmeremain counted as prose.
Files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
tests/**/*.ts
📄 CodeRabbit inference engine (CLAUDE.md)
Tests mirror the
src/structure; shared test fixtures belong undertests/fixtures/.
tests/**/*.ts: Use Bun's built-inbun:testrunner for all tests; do not importnode:test. Test files belong undertests/, mirrorsrc/, usetests/fixtures/for shared fixtures, and follow<module-name>.test.tsnaming.
Filesystem tests must use isolatedmkdtempdirectories and clean them up inafterEachorafterAll; do not touch real user-scope paths or leave temporary files behind.
Close external SDK instances, servers, clients, and transports in test hooks, such asawait server.close()inafterEachorafterAll.
Restore every captured environment variable withrestoreEnv(key, original); never restore with direct assignment such asBun.env.X = original, becauseundefinedbecomes the string"undefined".
Mockos.homedir()via an imported module namespace andspyOn; do not rely on overridingHOMEfor code usingos.homedir(), and keep filesystem writes inside temporary directories.
Shared test helpers, including non-test files undertests/, must restore every captured environment variable withrestoreEnv; isolation responsibilities apply across the entire shared Bun test process.Use
_resetAllCaches()fromsrc/helpers/platform.tsto simulate different platforms in tests rather than mockingprocess.platformdirectly.
Files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
**/*.{js,ts,tsx,mjs,cjs}
📄 CodeRabbit inference engine (.archgate/adrs/GEN-003-tool-invocation-via-scripts.md)
Invoke linting, formatting, and validation through package scripts (
bun run lint,bun run format,bun run format:check, andbun run validate), rather than directly invoking tool binaries such asbunx prettier,bunx oxfmt,npx eslint, oroxlint.
Files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
tests/engine/**/*.test.ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-022-ast-aware-rule-context.md)
AST behavior must be covered for base parsing, throw-versus-null semantics, comment extraction, opt-in comment absence, source locations, string awareness, Ruby character offsets, and normalized block-comment values.
Files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
tests/**/*.test.ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-025-idiomatic-bun-test-parametrization-and-matchers.md)
tests/**/*.test.ts: Usetest.each()ordescribe.each()for the same assertion logic against multiple independent inputs. Do not register tests or callexpect()once per case inside aforor.forEachloop.
Use array rows for positional destructuring and object rows for named fields when passing cases totest.each()ordescribe.each(). Choose descriptive title placeholders such as%s,%p,%d, or$field.
Assert derived facts with the most specific matcher available instead of passing a derived boolean to.toBe(true)or.toBe(false). Compare values directly with.toBe()or.toEqual().
Use specific matchers for common derived checks:.toContain()or.toMatch()for containment,.toBeInstanceOf()for type checks such asArray.isArray,.toHaveLength()for counts, and.find()with.toBeDefined()or.toBeUndefined()for predicate existence checks.
Do not precompute a boolean solely to assert it; assert the underlying values directly with matchers such as.toEqual()or.toBe().
When converting a loop totest.each()ordescribe.each(), preserve every assertion that ran per iteration; do not drop or merge assertions.
tests/**/*.test.ts: Every runnable test must contain anexpect()assertion; usetest.skiportest.todofor placeholders rather than assertion-less or silently skipped tests.
Test public interfaces with descriptive names rather than private implementation details.
Do not usemock.module()for first-party modules. Mock them withimport * as modplusspyOn(mod, "fn"), and restore mocks after each test.mock.module()may be used for approved external modules such asinquirerornode:readline.
For HTTP mocking, saveglobalThis.fetchbefore direct assignment and restore it inafterEach; do not usemock.module("node:fetch"), which does not intercept Bun's global fetch.
Wrap inlinespyOnormockImplementationlifecycles intry/finally, or manage them in hooks, somockRestore()runs wh...
Files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
**
⚙️ CodeRabbit configuration file
**: This project uses Archgate — an AI governance framework based on
Architecture Decision Records (ADRs). The ADRs in.archgate/adrs/
are the authoritative rules for this codebase. Each ADR has a companion
.rules.tsfile with automated checks that run viaarchgate check.When reviewing, you must:
- Treat ADR violations as blocking issues, not suggestions.
- Cite the specific ADR ID when flagging a violation (e.g., "Violates ARCH-006").
- Focus on semantic and contextual violations that automated rules cannot catch —
the.rules.tsfiles already cover syntactic/structural patterns.- If you are unsure whether something violates an ADR, flag it as a question
rather than approving it.
Files:
tests/engine/adr-sections.test.tssrc/engine/loader.tsCONTRIBUTING.mdtests/engine/loader-failure-modes.test.ts
.github/workflows/*.yml
📄 CodeRabbit inference engine (.archgate/adrs/CI-001-pin-github-actions-by-hash.md)
.github/workflows/*.yml: Do not reference third-party Actions or reusable workflows by mutable tags, branches, or abbreviated SHAs; use a full commit SHA instead.
Version comments after pinned Action SHAs must use the exact release tag, such as# v2.4.3; floating major comments such as# v5are prohibited.
The SLSA reusable workflow underslsa-framework/slsa-github-generator/.github/workflows/*is an explicit exception and must be referenced by its required version tag rather than a SHA.
Local reusable workflow and composite action references, such asuses: ./.github/workflows/...anduses: ./.github/actions/..., must not be SHA-pinned.
Docker container references such asuses: docker://image:tagare exempt from this GitHub Action SHA-pinning requirement.
When adding or updating a pinned Action, resolve annotated tags to the underlying commit SHA, verify that the SHA matches the intended tag using a trusted source, and update the SHA and version comment together.
Before adding an Action to a workflow, audit the Action's required permissions.
For unsupported third-party SHA pinning, do not create silent exceptions; document the limitation in the exceptions list and update the enforcement allowlist before merging.
Files:
.github/workflows/code-pull-request.yml
.github/workflows/code-pull-request.yml
📄 CodeRabbit inference engine (.archgate/adrs/CI-002-validate-workflow-syntax-with-actionlint.md)
.github/workflows/code-pull-request.yml: Installactionlintby downloading an explicitly version-pinnedlinux_amd64release tarball, verifying its SHA-256 checksum withsha256sum -c, and extracting the binary; do not uselatest, an unverified download, or an installer script.
Theactionlintjob MUST invoke./actionlint -colorwithout restricting the path, so it scans the entire.github/workflows/directory.
Setpersist-credentials: falseon theactions/checkoutstep used by theactionlintjob.
Do not add areviewdog/action-actionlintwrapper Action; invoke the externally downloadedactionlintbinary directly in CI.
When upgradingactionlint, update the pinned version and SHA-256 together, sourcing the checksum from that release'sactionlint_<version>_checksums.txtasset.
Files:
.github/workflows/code-pull-request.yml
.github/workflows/*
📄 CodeRabbit inference engine (.archgate/adrs/GEN-003-tool-invocation-via-scripts.md)
.github/workflows/*: CI workflows must invoke linting, formatting, and validation through package scripts and must not directly invoke lint or formatting binaries.
Usebun run testrather than barebun testin CI, so package-script flags are preserved.
Files:
.github/workflows/code-pull-request.yml
src/**/*.ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-018-lazy-load-heavy-dependencies.md)
src/**/*.ts: Heavy runtime dependencies such asinquirer,posthog-node, and@sentry/*must be loaded with dynamicimport()at their point of use, never through top-level static value imports.
Type-only imports for heavy dependencies are allowed, but runtime values must be obtained through dynamicimport(); for example, useimport type { PostHog } from "posthog-node".
SDKs that require early initialization may use eager-start/lazy-await: begin initialization before command registration and await the result at first use, such as in apreActionhook.
src/**/*.ts: In all TypeScript source files undersrc/, useBun.envfor every environment-variable read and write; never referenceprocess.env, including in comments.
AccessBun.envproperties directly; do not create wrapper functions around it or destructure it.
Use nullish coalescing for environment-variable defaults, such asBun.env.NODE_ENV ?? "production".
For truthy environment-flag checks, useBoolean(Bun.env.FLAG)only inline, as part of a larger expression, or assign it to a variable before using it as a sole condition; otherwise use an explicit defined-and-nonempty comparison.
src/**/*.ts: Everyinquirer.prompt(...)call must be wrapped inwithPromptFix(() => ...)imported fromsrc/helpers/prompt.ts; keep the wrapper adjacent to the prompt invocation so automated checks can detect it.
Do not callinquirer.prompt(...)directly or reimplement cursor/newline fixes at individual call sites; route all prompt behavior throughwithPromptFix().Every call to
Bun.Glob#scan()(glob.scan(...)) in source must pass{ dot: true }in its options object, including scans whose patterns do not explicitly target dot-directories. Do not usedot: false; intentionally excluded dotfiles must be filtered explicitly after scanning with a comment. Normalize scanned path separators withfile.replaceAll("\\", "/")when performing cross-platform path comparisons.
src/**/*.ts: Use `sty...
Files:
src/engine/loader.ts
src/engine/**/*.ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-023-engine-file-listing-via-in-memory-git-tracked-matching.md)
src/engine/**/*.ts: The rules engine must list files by matching globs in memory against the git-tracked file set, rather than walking the filesystem.
runChecksmust share per-run caches across rule contexts: cache glob results by pattern and tracked mode, cache file text by absolute path using promises, copy cached glob arrays before returning them, and do not cache mutablereadJSONresults.
Do not filter filesystem scan results against the tracked set as a substitute for in-memory matching, and do not hardcode ignore directories; Git's ignore-aware file listing is authoritative.
src/engine/**/*.ts: TypeScript and JavaScript AST parsing must reuse the shared in-processmeriyahparser; scanner andctx.ast()must use the same parsing primitive rather than duplicatingparseModule()logic.
Python and Ruby AST parsing must use the languages’ standard-library AST facilities through guardedBun.spawnsubprocesses, without third-party parsers.
Allctx.ast()implementations must perform guardrails in order: path safety, language plausibility, cached interpreter availability probing, then guarded subprocess invocation. No unguarded subprocess is permitted.
Python subprocesses must use the mandatory-Iisolation flag, and subprocess arguments must be array-based without shell interpolation.
ctx.ast()must throw on unavailable interpreters, parse failures, missing base revisions, or files absent at base; it must never returnnullor another sentinel.fileAtBase()may returnnull.
ast(path, language, { rev: "base" })andfileAtBase(path)must read the same merge-base commit used bychangedFiles; git operations remain insrc/engine/git-files.ts.
ast(..., { comments: true })must opt in to a structured rootcommentsarray ofCommentTokenvalues, with language-appropriate extraction and source-accurate locations where specified.
Do not normalize Python and Ruby ASTs into ESTree; callers must handle each language’s native tree shape. Docum...
Files:
src/engine/loader.ts
src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
src/**/*.{ts,tsx}: For user-scope editors, resolve paths using the editor's actual path helper; do not assume Windows conventions. For opencode, mirrorxdg-basedir, which falls back to~/.configon all platforms.
For opencode-gated behavior, useisOpencodeAvailable()rather thanisOpencodeCliAvailable()alone because the Desktop distribution has no CLI binary and shares the config directory.
For Copilot-gated behavior, useisCopilotAvailable()rather thanisCopilotCliAvailable()alone because desktop and CLI distributions share~/.copilot/.
Files:
src/engine/loader.ts
src/engine/loader.ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-024-rule-file-sandbox-boundary.md)
Call
scanRuleSource()and require it to pass before importing any.rules.tsfile; never import an unscanned rule file or scan afterimport().
Files:
src/engine/loader.ts
src/**/!(platform).ts
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-009-platform-detection-helper.md)
All platform detection in
src/must go throughsrc/helpers/platform.ts(isWindows(),isMacOS(),isLinux(),isWSL(), orgetPlatformInfo()); directprocess.platformaccess and duplicated detection logic are forbidden outsideplatform.ts.
Files:
src/engine/loader.ts
*
📄 CodeRabbit inference engine (.archgate/adrs/GEN-005-repository-root-contents-allowlist.md)
*: Any newly added root-level file must be added to the allowlist in the same change, with the applicable Decision criterion documented in the PR description or commit message.
Place one-off scripts, scratch files, and exploratory helpers inscripts/or a gitignored scratch directory, never directly in the repository root.
Use;or an EXITtrapfor temporary-file cleanup that must run regardless of command failure; do not chain the script and cleanup with&&.
Prefer explicit paths withgit addinstead of habitually usinggit add -Aorgit add .when throwaway files may exist.
Rungit status, or otherwise inspect staged paths explicitly, before committing when scratch files may exist nearby.
Files:
CONTRIBUTING.md
**/*.{md,mdx}
📄 CodeRabbit inference engine (.archgate/adrs/ARCH-021-authored-text-integrity.md)
Markdown and MDX text content MUST NOT contain a backslash-escaped backtick. Use a longer code-span delimiter or restructure the sentence instead. The rule excludes YAML frontmatter, fenced code blocks, and
CHANGELOG.md.
Files:
CONTRIBUTING.md
🧠 Learnings (15)
📚 Learning: 2026-07-25T00:05:58.884Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 496
File: tests/helpers/auth.test.ts:38-46
Timestamp: 2026-07-25T00:05:58.884Z
Learning: When reviewing the Archgate CLI repository’s GEN-004 “concise forward-only narration” comments, don’t rely only on the automated phrase-based narration checks. Those checks can pass even when the comment wording describes historical/transfer semantics rather than current behavior (e.g., saying a prior restore “leaked” a value or a later subprocess “inherited it”). Manually verify that the comment describes the code’s current, forward behavior; flag or adjust comments that imply past/historical state transfer even if GEN-004 enforcement passes.
Applied to files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T00:05:59.109Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 496
File: src/cli.ts:0-0
Timestamp: 2026-07-25T00:05:59.109Z
Learning: Code comments may include a concise issue/PR reference (per GEN-004) when it’s used to point readers to fuller rationale instead of inlining that rationale. During review, flag surrounding comment prose that reads like historical context or narrates refactors/relocations; a bare GEN-004-style reference is allowed and should not be flagged by itself.
Applied to files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-08-04T19:58:05.877Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 543
File: src/helpers/copilot-user-settings.ts:0-0
Timestamp: 2026-08-04T19:58:05.877Z
Learning: In archgate/cli TypeScript code, use `Bun.file(path).exists()` only to check whether a file exists; it must not be used for directory existence checks. For helpers such as `isCopilotAvailable()` that need to detect a configuration directory, use an appropriate directory-aware check such as `existsSync` from `node:fs`.
Applied to files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-08-05T06:56:33.435Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 546
File: tests/integration/stream-guards.test.ts:3-9
Timestamp: 2026-08-05T06:56:33.435Z
Learning: When reviewing GEN-004 comment-block limits in the Archgate CLI repository, count only narrative prose lines within a block comment. Do not count a closing delimiter such as `*/` as a prose line; for example, in `tests/integration/stream-guards.test.ts`, Lines 4–8 contain five prose lines while Line 9 contains only the delimiter.
Applied to files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T15:44:40.668Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 501
File: .archgate/adrs/ARCH-005-testing-standards.md:0-0
Timestamp: 2026-07-25T15:44:40.668Z
Learning: In Archgate CLI test code governed by ARCH-007, only allow `Bun.$` in test suites that are explicitly restricted to a single platform. Any cross-platform test that runs on Linux, macOS, and Windows must avoid `Bun.$` and instead use array-based `Bun.spawn`. For shared git setup used by tests, import and use the `git()` helper from `tests/test-utils.ts` rather than duplicating git setup logic.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-08-05T16:54:13.117Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 550
File: tests/commands/adr/domain/remove.test.ts:21-24
Timestamp: 2026-08-05T16:54:13.117Z
Learning: In the Archgate CLI test suite, continue using `z.object` for JSON output schemas unless a repository-wide testing policy explicitly adopts `z.strictObject`. Do not introduce strict CLI-output schema enforcement as an isolated change in a coverage-focused pull request; require coordinated updates and policy agreement across affected tests.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T22:03:14.216Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 501
File: .archgate/adrs/ARCH-002-error-handling.md:0-0
Timestamp: 2026-07-25T22:03:14.216Z
Learning: In Archgate boundary-wrapped CLI command actions (the handlers that rely on `handleCommandError()` for user-facing error output), expected-failure guards should signal user errors by throwing `new UserError(<message/details>)` rather than directly calling `logError()` followed by `exitWith(1)`. This keeps user-facing logging and the exit path centralized in `handleCommandError()`. For normal/computed command outcomes (e.g., `const exitCode = getExitCode(await runChecks(...))`), use `await exitWith(exitCode)` instead of calling `process.exit(exitCode)` so telemetry/Sentry flushing and outcome tagging still run.
Applied to files:
tests/engine/adr-sections.test.tssrc/engine/loader.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T23:21:11.504Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 512
File: tests/engine/runner-ast-cache.test.ts:82-82
Timestamp: 2026-07-25T23:21:11.504Z
Learning: For Bun/TS tests under tests/engine, it’s acceptable (per ARCH-025) to validate a runtime-sized collection produced by a single operation by looping over items and making direct assertions like `expect(item).toBe(...)` inside the loop. Treat this as an approved alternative to boolean-collapse assertions such as `expect(items.every(predicate)).toBe(true)`. Do NOT conflate this with prohibited “manual loops” that create independent test cases (e.g., calling `test(...)`/`it(...)` inside a loop); that pattern should still be flagged.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T23:21:49.190Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 512
File: tests/engine/git-files.test.ts:98-100
Timestamp: 2026-07-25T23:21:49.190Z
Learning: When reviewing archgate/cli for ARCH-006 (per its ADR frontmatter), only enforce the production-dependency policy scoped to package.json. Do not treat test-only refactors or relocated `node:fs` fixture writes as an ARCH-006 violation (since ARCH-006 does not govern test-file I/O API selection). If there’s a broader/test-wide refactor that would migrate fixture writing to `Bun.write()`, evaluate it separately under the appropriate in-scope rule.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-27T16:05:38.683Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 536
File: tests/commands/adr/sync-strict.test.ts:173-173
Timestamp: 2026-07-27T16:05:38.683Z
Learning: In this Bun + TypeScript repo, for rejected-promise assertions use the unawaited form: `expect(promise).rejects.toThrow(...)`. Do NOT add `await` to `expect(promise).rejects.toThrow(...)` (Bun’s types model this as `void`), because it will violate the type-aware oxlint rules `typescript(await-thenable)` and `typescript(no-confusing-void-expression)`. Only request an `await` if the repo adopts a typed, lint-compliant assertion helper or Bun’s typings change.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-08-05T16:54:50.574Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 550
File: tests/helpers/plugin-install-cursor-hooks.test.ts:44-44
Timestamp: 2026-08-05T16:54:50.574Z
Learning: In this repository, every TypeScript module under `src/` must have a matching `<module-name>.test.ts` file under the mirrored `tests/` directory, as required by ARCH-005. Supplemental behavior-suffixed sibling test files are allowed only when the matching parent test file exists. Use such siblings to keep individual test files below the 500-line oxlint limit.
Applied to files:
tests/engine/adr-sections.test.tstests/engine/loader-failure-modes.test.ts
📚 Learning: 2026-07-25T16:25:02.361Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 501
File: .archgate/adrs/CI-002-validate-workflow-syntax-with-actionlint.md:36-49
Timestamp: 2026-07-25T16:25:02.361Z
Learning: For any GitHub Actions workflow that installs/downloads `actionlint` (e.g., by downloading the pinned tarball and setting `ACTIONLINT_SHA256`), do not hardcode the SHA256. Instead, source the pinned checksum from the `actionlint` release checksum manifest/manifest reference defined by the corresponding `archgate` ADR (CI-002), and verify the workflow’s referenced release asset name matches the ADR. Reconcile any mismatches between the ADR and the workflow so CI follows the documented checksum/asset wiring.
Applied to files:
.github/workflows/code-pull-request.yml
📚 Learning: 2026-06-11T12:50:28.661Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 406
File: .claude/agent-memory/archgate-developer/feedback_prefer_tests_over_adr_rules.md:8-18
Timestamp: 2026-06-11T12:50:28.661Z
Learning: In `archgate/cli`, for markdown files under `.claude/agent-memory/`, follow the established convention: use YAML frontmatter (with a `name:` field used as the document title) and do not require a top-level `#` (H1) heading. During code review, do not flag missing first-line/first-top-level H1 headings (e.g., MD041) for these agent-memory files since markdownlint is not part of the repo’s `bun run validate` lint pipeline (oxlint/oxfmt only).
Applied to files:
.claude/agent-memory/archgate-developer/MEMORY.md.claude/agent-memory/archgate-developer/project_claude_code_hooks_config.md
📚 Learning: 2026-07-25T00:05:20.592Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 496
File: .claude/agent-memory/archgate-developer/project_test_isolation_gotchas.md:10-10
Timestamp: 2026-07-25T00:05:20.592Z
Learning: When reviewing documentation/agent-memory entries under `.claude/agent-memory/**`, do not enforce GEN-004’s “forward-only” comment/narrative requirement. These entries are allowed to keep historical/past-tense incident narratives and dated markers (e.g., `Found YYYY-MM-DD`) because the context is intended to help future agents evaluate edge cases. Outside this scope, GEN-004’s forward-only rule should still apply.
Applied to files:
.claude/agent-memory/archgate-developer/MEMORY.md.claude/agent-memory/archgate-developer/project_claude_code_hooks_config.md
📚 Learning: 2026-08-05T13:34:53.406Z
Learnt from: rhuanbarreto
Repo: archgate/cli PR: 549
File: .archgate/adrs/ARCH-021-authored-text-integrity.md:0-0
Timestamp: 2026-08-05T13:34:53.406Z
Learning: For Markdown files in archgate/cli, rely on the mechanically enforced ARCH-021/no-escaped-backtick-in-markdown rule during archgate check rather than retaining formatter-specific review guidance. Apply the CommonMark rationale: backslash escapes have no meaning inside code spans, and a code span ends at the next backtick run of equal length. Encode enforceable invariants in repository rules instead of free-text agent memory.
Applied to files:
CONTRIBUTING.md
🪛 LanguageTool
CONTRIBUTING.md
[locale-violation] ~44-~44: In American English, ‘afterward’ is the preferred variant. ‘Afterwards’ is more commonly used in British English and other dialects.
Context: ...ariable were unset. Restart Claude Code afterwards; the env block is read at launch. Ea...
(AFTERWARDS_US)
🪛 markdownlint-cli2 (0.23.2)
.claude/agent-memory/archgate-developer/project_claude_code_hooks_config.md
[warning] 8-8: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🔇 Additional comments (7)
.claude/settings.json (1)
34-35: LGTM!Also applies to: 45-45, 59-59
.claude/agent-memory/archgate-developer/project_claude_code_hooks_config.md (1)
8-10: LGTM!CONTRIBUTING.md (1)
30-47: LGTM!.archgate/config.json (1)
1-1: LGTM!src/engine/loader.ts (1)
88-88: LGTM!Also applies to: 171-186, 220-220, 233-233
tests/engine/adr-sections.test.ts (1)
210-214: LGTM!tests/engine/loader-failure-modes.test.ts (1)
162-164: LGTM!Also applies to: 195-197
Strict mode escalates advisory findings (briefing budget, suppression, and unparsed-ADR warnings) plus rule-severity warnings into failures. Setting `strict` in `.archgate/config.json` applies it to `check`, `review-context`, and `adr sync` alike, in CI and in the local hooks, without each call site repeating the flag. A dedicated code-scanning job uploads `check --output sarif` to the Security tab, where findings persist across runs instead of living only in the `validate` job log. That job reports rather than gates: `validate` runs the same check and fails the merge, so a violation here must still reach the upload step. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
GitHub resolves both Actions annotation `file=` values and SARIF `artifactLocation.uri` against the repository root. Skipped ADRs were reported by bare filename, so an unparsed-ADR finding pointed at a nonexistent root-level file and could not anchor to the offending ADR. Skipped ADRs now carry the same project-relative, POSIX-separated form that `briefingWarnings` already used, which is also the form the console reporter is documented as printing. The unreadable-directory branch gets it too, so a runner's absolute filesystem layout stays out of published findings. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
Advisory findings block here with no flag passed, so an over-budget ADR section fails the build rather than warning it. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
fb8a09d to
4b438ac
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Code Coverage
Full HTML report available in workflow artifacts. Per-directory breakdown
|
The index sat near the read limit, so the long-form entries move into topic files and MEMORY.md keeps one line each. Two CI behaviours join them: a conflicting PR builds no merge ref and so runs no workflows at all, and editing a PR body cancels the run in flight — which drops the Windows coverage artifact and reports a merged-coverage shortfall that reads as a regression in the change itself. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
2 participants
Summary
Archgate ships both
--strictand--output sarif, but this repo was dogfooding neither. This turns both on and fixes a path bug that surfaced once findings were actually routed to GitHub.Strict mode
.archgate/config.jsonnow sets"strict": true. All three commands that read the key —check,review-context, andadr sync— pick it up, in CI and in the local hooks alike, with no flag repeated at any call site.The corpus passes clean today (51 rules, zero advisories), so this locks in the current bar rather than papering over failures. Verified in both directions with a deliberately unparseable ADR:
strict: truepassfalsetrueWithout it, a broken ADR is excluded from every check while the build stays green — that silent gap is what this closes.
SARIF to the Security tab
A new
archgate-sarifjob uploadscheck --output sarifviagithub/codeql-action/upload-sarif, so findings persist across runs instead of living only in thevalidatejob log.The job reports, it does not gate.
validateruns the same check and fails the merge, so the check step here iscontinue-on-error— otherwise a violation would abort the job before its findings ever reached the Security tab. Three details worth review:$RUNNER_TEMP, not the repo root. A shell redirect creates its target before the command runs, so> results.sarifin the working tree makescheckflag its own output under GEN-005.category: archgatekeeps these results from overwriting the repo's other SARIF producers (CodeQL, zizmor, Scorecard).permissions:, so the upload step iscontinue-on-errorfor forks, matching the existingzizmorjob.Fix: unparsed-ADR findings could not anchor
GitHub resolves both SARIF
artifactLocation.uriand::warning file=against the repository root. Skipped ADRs were reported by bare filename, so an unparsed-ADR finding pointed at a nonexistent root-level file — the alert could not link to the offending ADR.briefingWarningsbeside it already emitted the project-relative form, and the documented console sample inreference/cli/check.mdxalready showed.archgate/adrs/BROKEN.md, so the code was what had drifted. Skipped ADRs now carry that same project-relative, POSIX-separated form, including on the unreadable-directory branch so a runner's absolute filesystem layout stays out of published findings.This changes the
unparsedAdrsvalues in--output json. No doc updates were needed — all three locales already described the corrected shape.Verification
bun run validateon the rebased branch — 2405 tests, 0 failures, binary compilescheckpasses under strict with zero advisory findings, so no ADR sits over the briefing budgetconsole,github,sarif) fire-tested against a broken ADR and confirmed to emit.archgate/adrs/…