fix(ci): address post-merge Bugbot findings (cancel scope, self-test CLI, root-commit diff)

[rayhanadev]

Why

Follow-up to #885. Cursor Bugbot posted three findings after that PR merged; this addresses all three.

What changed

react-doctor.yml

• Cancel scope (fix #1, was Medium). cancel-in-progress is now gated to pull_request only — cancel-in-progress: ${{ github.event_name == 'pull_request' }} — matching ci.yml / code-quality.yml / publish-any-commit.yml. Rapid merges to main no longer cancel each other, so every main commit still posts its React Doctor commit status.
• Self-test dogfoods the local CLI (Improve --prompt clipboard output for agent fixes #2, was Medium). Restored the workspace build + version: ./packages/react-doctor, so the job runs the PR's own action and CLI instead of react-doctor@latest from npm. Kept the slim triggers/concurrency from ci: action version-bump guard + faster CI (turbo remote cache, concurrency) #885.

action-version-bump.yml

• Root-commit diff (Fix multiselect 'a' key select-all behavior #3, was Low). On an all-zero before SHA, the bump job now falls back to the git empty tree (git hash-object -t tree /dev/null) when HEAD has no parent, instead of HEAD. Previously a root commit diffed HEAD against itself (empty) and missed its action-surface changes. Edge case (only with AUTO_BUMP_ACTION_TAG on, on a repo's first commit), but now correct.

Before (root commit, all-zero before-SHA):

base = HEAD  ->  git diff HEAD HEAD  ->  (empty)  ->  no changes detected

After:

base = <empty tree>  ->  git diff <empty-tree> HEAD  ->  all files added  ->  changes detected

Test plan

• git diff <empty-tree> HEAD verified locally to list the commit's files as added.
• pnpm exec vp fmt --check passes on both workflows.
• The react-doctor job (CI on this PR) exercises the restored uses: ./ + local build path end to end.

---

Note

Low Risk
Workflow-only changes with no runtime product impact; low blast radius aside from slightly longer React Doctor runs on main.

Overview
Follow-up CI fixes for React Doctor and action version bump workflows.

react-doctor.yml now only cancels in-progress runs on pull requests (cancel-in-progress: ${{ github.event_name == 'pull_request' }}), aligned with ci.yml and peers, so rapid merges to main no longer drop commit statuses. The job again installs the workspace, builds react-doctor, and runs the local action with version: ./packages/react-doctor and blocking: none, plus Turbo env, timeout, and checkout hardening.

action-version-bump.yml fixes base-SHA selection when before is missing or all zeros: if HEAD has no parent, the diff base is the git empty tree instead of HEAD, so a root commit’s action-surface files are detected instead of an empty self-diff.

^{Reviewed by Cursor Bugbot for commit ba66b99. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@888

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@888

npm i https://pkg.pr.new/react-doctor@888

commit: ba66b99

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.