ci(gate): staged push/PR gate + stable CHR smoke + agent-friendly reporting (blueprint PR-1) - #55
Conversation
…orting (blueprint PR-1) Reworks ci.yaml into a staged gate (checks ‖ unit+coverage → chr-smoke → cross-platform-unit; build) per the approved CI/release blueprint, modeled on quickchr's ci.yml. - New single-boot smoke test/integration/chr-smoke.test.ts (+ test:integration:smoke): boots ONE stable CHR and proves REST retrieve, native-api retrieve, and a read-only `:put` execute round-trip — no router mutation, gate-safe. - Coverage + failing tests surface to the job summary with retained artifacts; coverage floor is a non-blocking annotation (trend, not gate). - CHR image cache (~/.local/share/quickchr/cache) cuts stable boot time. - Drops the redundant PR-only fixture-integration job (the devices fixture runs under the unit job's `bun test`). - cross-platform-unit (macOS gates; Windows informational via continue-on-error until centrs is verified Windows-clean). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 52 minutes and 2 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe CI workflow is split from a monolithic ChangesCI Pipeline Restructure and CHR Smoke Test
Sequence Diagram(s)sequenceDiagram
participant dev as Developer / GHA Trigger
participant checks as checks job
participant unit as unit job
participant build as build job
participant chrsmoke as chr-smoke job
dev->>checks: push / workflow_dispatch
checks-->>unit: (parallel)
checks-->>build: needs: checks
unit->>unit: bun run test:ci → /tmp/coverage-report.txt
unit->>unit: append summary + upload artifact
unit->>unit: emit ::warning if below COVERAGE_MIN_FUNCS/LINES
checks-->>chrsmoke: needs: checks
chrsmoke->>chrsmoke: CENTRS_RUN_FAST_INTEGRATION=1 bun test chr-smoke.test.ts
chrsmoke->>chrsmoke: REST/native-api retrieve + execute assertions
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Refactors the CI push/PR gate into a staged workflow and adds a single-boot RouterOS CHR smoke test to validate core protocol paths (REST + native API) with agent-friendly reporting.
Changes:
- Adds
test/integration/chr-smoke.test.tsand atest:integration:smokescript to run a stable-channel single-boot CHR smoke suite. - Reworks
.github/workflows/ci.yamlinto separate staged jobs (checks → unit+coverage → CHR smoke → cross-platform unit), plus coverage parsing/artifacts and job-summary reporting. - Extends
GLOSSARY.txtwith CI shell/coverage parsing vocabulary used in workflow scripts.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| test/integration/chr-smoke.test.ts | New single-boot CHR smoke integration test exercising REST retrieve, native-api retrieve, and read-only execute. |
| package.json | Adds test:integration:smoke script to run the CHR smoke test with the integration flag enabled. |
| GLOSSARY.txt | Adds CI/workflow shell vocabulary tokens used in workflow scripts. |
| .github/workflows/ci.yaml | Implements staged CI jobs, CHR smoke tier, cache/artifacts, and job-summary reporting for failures/coverage. |
| unit: | ||
| name: Unit tests & coverage | ||
| runs-on: ubuntu-latest |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yaml:
- Line 71: The GitHub Actions in this workflow file use mutable version tags
like `@v6` instead of immutable commit SHAs, which weakens supply-chain security.
Replace all mutable `uses:` entries (at lines 54, 71, 111, 142, 159, 175, 216,
and 238) that reference actions with the `@v`* pattern by replacing the version
tag with the full immutable commit SHA for that specific version. For each
action like actions/checkout@v6, look up the commit SHA corresponding to that
version and replace `@v6` with the full commit hash (format:
@<40-character-hex-hash>). Apply this pinning pattern consistently to all
changed uses entries in the file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f02b5764-055f-4acf-b51e-0e55383c9fd0
📒 Files selected for processing (4)
.github/workflows/ci.yamlGLOSSARY.txtpackage.jsontest/integration/chr-smoke.test.ts
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all workflow action references in this file are SHA-pinned.
rg -nP '^\s*uses:\s*[^@[:space:]]+@(?![0-9a-f]{40}\b)[^[:space:]]+' .github/workflows/ci.yamlRepository: tikoci/centrs
Length of output: 370
Pin all GitHub Actions to immutable commit SHAs.
Lines 54, 71, 111, 142, 159, 175, 216, and 238 use mutable tags (@v*), which weakens workflow supply-chain integrity.
Suggested fix pattern
- uses: actions/checkout@v6
+ uses: actions/checkout@<40-char-commit-sha> # v6
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@<40-char-commit-sha> # v4
- uses: actions/cache@v4
+ uses: actions/cache@<40-char-commit-sha> # v4Apply the same pinning pattern to every changed uses: entry in this file.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 70-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 71-71: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yaml at line 71, The GitHub Actions in this workflow
file use mutable version tags like `@v6` instead of immutable commit SHAs, which
weakens supply-chain security. Replace all mutable `uses:` entries (at lines 54,
71, 111, 142, 159, 175, 216, and 238) that reference actions with the `@v`*
pattern by replacing the version tag with the full immutable commit SHA for that
specific version. For each action like actions/checkout@v6, look up the commit
SHA corresponding to that version and replace `@v6` with the full commit hash
(format: @<40-character-hex-hash>). Apply this pinning pattern consistently to
all changed uses entries in the file.
Source: Linters/SAST tools
The CHR smoke's execute step went through runCli, whose non-TTY stdin handling emitted a stderr line and failed the `expect(stderr).toHaveLength(0)` gate on the runner. Switch to the programmatic executeEnvelope (as execute.test.ts does for the same `:put [/system/identity/get name]` command) so the gate proves the validate→run path without the CLI's interactive-stdin layer. Retrieve steps keep using runCli for CLI-entrypoint coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Bot review dispositions (declining both, with reason):
CodeRabbit was rate-limited (org prepaid credits) — |
Blueprint PR 1 of 6 — CI/release rework (plan:
velvet-yawning-melody). Reconciles the workflows with the existing tier/versioning doctrine, modeled on quickchr'sci.yml.What this PR does
Reworks
ci.yamlinto a staged gate so the cheapest signal fails first:test/integration/chr-smoke.test.ts(+test:integration:smoke): boots one stable CHR and proves REST retrieve, native-api retrieve, and a read-only:putexecute round-trip — no router mutation, safe to re-run. Keeps the gate at ~1 VM, not 16.github-actions-rich-datadoctrine): coverage table + failing-test list → job summary;coverage-reportartifact (14d); coverage floor is a non-blocking annotation (trend, not gate), overridable via dispatchmin-funcs/min-lines.set -eo pipefaileverywhere soteecan't mask a bun failure.~/.local/share/quickchr/cache) to cut stable boot time.fixture-integrationjob — thedevicesfixture already runs under theunitjob'sbun test(CHR suites self-skip withoutCENTRS_RUN_FAST_INTEGRATION).continue-on-error) until centrs is verified Windows-clean — a deliberate, flagged deviation from the blueprint's "macos+windows gate".Verification
lint+lint:ci+test(720 pass / 27 skip) +buildgreen.Follows in the blueprint
PR-2 QA definitive matrix + event-aware concurrency (removes the CI/QA push-PR duplication), PR-3 CodeQL split, PR-4 release/publish, PR-5 verify-extended +
.coderabbit.yaml, PR-6 docs/closure.🤖 Generated with Claude Code
Summary by CodeRabbit
Tests
Chores