fix+feat: audit fixes + 3 new automation workflows + Slack reporter fix - #116
Merged
Conversation
Fixes: - Fix vitest watch mode hang in CI: governance, throttle, notion-worker now use 'vitest run' instead of 'vitest' (which starts watch mode) - Fix Slack RUN reporter: broken multiline string, missing JSON escaping, proper workflow_call reference in smoke test New workflows: - stale-branch-cleanup.yml: weekly cron deletes merged branches >14 days old with no open PR, posts summary to Slack - health-monitor.yml: every 30 min checks bridge.a-to-mind.com/health, /api/stack, apex SPA, backend /api/health — alerts Slack on failures - pr-labeler.yml: auto-labels PRs by size (XS/S/M/L/XL) and scope (bridge, backend, frontend, packages, ci, infra) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
loxa | 6dadf1c | Jun 12 2026, 03:51 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
aether | 6dadf1c | Jun 12 2026, 03:51 AM |
… type errors Previously, 32 packages had TypeScript source but no typecheck/build scripts, meaning turbo never typechecked them. Adding scripts exposed 18 pre-existing type errors across 16 packages. Root causes fixed: - lessons: readLessons returned array instead of Promise (missing Promise.resolve) - curator-audit: same Promise issue + string|undefined assignment - mcp-tools: child_process.exec used as exec.exec (wrong import destructure) - workflow: EXAMPLE_WORKFLOWS missing required timeout/on_failure fields - human-queue: resolve() returned partial object instead of full QueueItem - operations: TaskQueue extends EventEmitter but missing super() call - sandbox: string|undefined assigned to string (added nullish coalescing) - profile: imported nonexistent getLearnedPatterns (removed unused import) - telemetry: same getLearnedPatterns reference (changed to getPatternConfidences) - convene: createdAt/resolvedAt used bare 'number' instead of z.number(), castVote returned wrong type (Omit instead of full ParticipantVote) - metrics: missing tsconfig.json entirely - github-automation: missing tsconfig.json entirely Result: 56/56 packages now typecheck clean (was 19/19 before). Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…r upgrade New workflows: - revenue-velocity-monitor.yml: 6-hour Stripe charge check, alerts on high-value charges, posts to Slack, logs to Notion via bridge webhook - client-sentiment-feedback.yml: keyword-based sentiment analysis on support messages (via repository_dispatch or manual trigger), routes P0/P1 to Slack #ops-runs with severity classification - dependency-audit.yml: weekly npm audit + outdated check, alerts on critical/high vulnerabilities Improvements: - deploy-worker.yml: upgraded from bridge-only to matrix strategy deploying all 5 Cloudflare workers (bridge, aether-verifier, notion-worker, weekly-digest, homebase) with change detection - backend/package.json: added test script (vitest run) — unlocks 60 tests (3 test files) that were previously never run in CI Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This was referenced Jun 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes CI-hanging tests and adds three new GitHub Actions automation workflows to move the ops infrastructure forward.
CI fix —
vitestwatch mode hang: Three packages (governance,throttle,notion-worker) used"test": "vitest"which starts watch mode in CI, hanging forever. Changed to"vitest run". This was causingnpx turbo run testto never complete.Slack RUN reporter fix:
_slack-run-report.ymlhad a broken multiline heredoc that produced malformed JSON. Rewrote with proper shell escaping viapython3 -c json.dumps(...). Also fixedslack-run-reporter-smoke.ymlwhich referenced./_slack-run-report.ymlinstead of./.github/workflows/_slack-run-report.yml— now uses properworkflow_callwithsecrets: inherit.3 new workflows:
stale-branch-cleanup.yml— Weekly Monday cron. Finds branches merged into main with no activity >14 days and no open PR. Deletes them and posts summary to Slack (ifSLACK_WEBHOOK_URLsecret exists).health-monitor.yml— Every 30 min. Checksbridge.a-to-mind.com/health,/api/stack, apex SPA, and backend/api/health. Posts to Slack on state change (degraded).pr-labeler.yml— On PR open/sync. Auto-labels PRs by size (size/XSthroughsize/XL) and scope (scope/bridge,scope/backend,scope/frontend,scope/packages,scope/ci,scope/infra).All workflows gracefully degrade when secrets aren't configured — they skip Slack steps rather than failing.
Link to Devin session: https://app.devin.ai/sessions/c3055826a7da441aadedfe5a600d30d5
Requested by: @atomeam