Wire free production readiness stack#358
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (3)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| const outDir = join(process.cwd(), 'docs/operations/generated'); | ||
| mkdirSync(outDir, { recursive: true }); | ||
|
|
||
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; |
There was a problem hiding this comment.
When PROD_AUDIT_DATABASE_URL is unset but DATABASE_URL exists, npm run prod:audit:db connects to the generic application database instead of skipping. That breaks the documented read-only audit contract and can run the production audit against a writable primary connection while reporting it as read-only.
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; | |
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL; |
Context Used: .greptile/instructions.md (source)
| for (const file of readdirSync(draftsDir)) { | ||
| if (file.endsWith('.md')) unlinkSync(join(draftsDir, file)); | ||
| } |
There was a problem hiding this comment.
docs/operations/revealed-bugs/production-readiness/ is a tracked directory in this PR, but npm run auditor:all deletes every Markdown file there before regenerating only current P0/P1 findings. Any edited draft or manually added follow-up in that tracked path is silently removed when the auditor runs.
Context Used: .greptile/instructions.md (source)
| "routes:check:coverage": "node scripts/route-hygiene/check-route-coverage.mjs", | ||
| "routes:check": "npm run routes:inventory && npm run routes:check:duplicates && npm run routes:check:links && npm run routes:check:boundaries && npm run routes:check:coverage && npm run routes:check:dead", | ||
| "analyze:semgrep": "semgrep scan --config .semgrep --json --output docs/operations/generated/semgrep.json", | ||
| "analyze:deps": "depcruise src --config dependency-cruiser.config.cjs --output-type json > docs/operations/generated/dependency-cruiser.json", |
There was a problem hiding this comment.
docs/operations/generated/ is gitignored, so it will not exist after a fresh checkout. Shell redirection cannot create that parent directory, so npm run analyze:deps fails before dependency-cruiser runs unless another command happened to create the directory first.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ccb1e66adc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| static-radar: | ||
| name: Static radar advisory | ||
| runs-on: ubuntu-latest | ||
| continue-on-error: true |
There was a problem hiding this comment.
In this workflow, static-radar is intended to collect Semgrep, dependency-cruiser, and jscpd advisory reports, but putting continue-on-error only on the job does not make later steps run after an earlier step fails; the default step condition remains success-only. In a fresh CI run, any nonzero exit from Semgrep prevents the dependency and duplicate-code reports from being generated or uploaded, so each radar step needs its own continue-on-error or the later report steps need if: always().
Useful? React with 👍 / 👎.
| "routes:check:coverage": "node scripts/route-hygiene/check-route-coverage.mjs", | ||
| "routes:check": "npm run routes:inventory && npm run routes:check:duplicates && npm run routes:check:links && npm run routes:check:boundaries && npm run routes:check:coverage && npm run routes:check:dead", | ||
| "analyze:semgrep": "semgrep scan --config .semgrep --json --output docs/operations/generated/semgrep.json", | ||
| "analyze:deps": "depcruise src --config dependency-cruiser.config.cjs --output-type json > docs/operations/generated/dependency-cruiser.json", |
There was a problem hiding this comment.
When npm run analyze:deps is run on a fresh checkout or in an independent CI job, docs/operations/generated/ is ignored and absent, so the shell redirection fails with “Directory nonexistent” before depcruise starts. Add a mkdir -p docs/operations/generated wrapper or write the report from a script so this documented standalone lane actually produces its artifact.
Useful? React with 👍 / 👎.
| for (const file of readdirSync(draftsDir)) { | ||
| if (file.endsWith('.md')) unlinkSync(join(draftsDir, file)); |
There was a problem hiding this comment.
Running npm run auditor:all unconditionally removes every Markdown file in docs/operations/revealed-bugs/production-readiness, but this commit also adds tracked redacted Gitleaks/OSV drafts in that directory. If the matching generated inputs are unavailable or change, the auditor deletes committed documentation and leaves the worktree dirty, so the cleanup should be limited to ignored/generated files or only overwrite drafts it is about to regenerate.
Useful? React with 👍 / 👎.
| const outDir = join(process.cwd(), 'docs/operations/generated'); | ||
| mkdirSync(outDir, { recursive: true }); | ||
|
|
||
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; |
There was a problem hiding this comment.
prod:audit:db still falls back to the generic app DATABASE_URL when PROD_AUDIT_DATABASE_URL is unset. In a normal production or CI environment where DATABASE_URL exists, the documented skip path is bypassed and the audit connects with the app database credential instead of a dedicated read-only audit credential.
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; | |
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL; |
Context Used: .greptile/instructions.md (source)
| for (const file of readdirSync(draftsDir)) { | ||
| if (file.endsWith('.md')) unlinkSync(join(draftsDir, file)); | ||
| } |
There was a problem hiding this comment.
auditor:all deletes every Markdown file under docs/operations/revealed-bugs/production-readiness/, but that path is not ignored like docs/operations/generated/. A tracked or manually edited draft in that directory can be removed before the script regenerates only the current blocking findings, so some drafts are silently lost instead of updated.
Context Used: .greptile/instructions.md (source)
| "analyze:deps": "depcruise src --config dependency-cruiser.config.cjs --output-type json > docs/operations/generated/dependency-cruiser.json", | ||
| "analyze:knip": "knip --reporter json > docs/operations/generated/knip.json", |
There was a problem hiding this comment.
analyze:deps and analyze:knip still redirect into docs/operations/generated/, which is ignored and absent on a fresh checkout. The shell opens the redirect target before starting depcruise or knip, so these commands fail immediately unless another command happened to create the directory first.
Context Used: .greptile/instructions.md (source)
| "secrets:scan": "node scripts/security/run-gitleaks-current-tree.mjs", | ||
| "secrets:scan:history": "gitleaks git . --redact --report-format json --report-path docs/operations/generated/gitleaks-history.json", | ||
| "deps:audit:npm": "npm audit --audit-level=high", | ||
| "deps:audit:osv": "osv-scanner --lockfile package-lock.json --format json > docs/operations/generated/osv.json", |
There was a problem hiding this comment.
deps:audit:osv redirects stdout to docs/operations/generated/osv.json without creating the ignored parent directory first. On a clean checkout the shell fails before osv-scanner runs, so the OSV report is never produced for the auditor to consume.
Context Used: .greptile/instructions.md (source)
Remediate gitleaks findings, add redacted cleanup secret-scan, move team-switcher constants into lib, retire .helm live-queue references, and document resolved follow-ups. Co-authored-by: Cursor <cursoragent@cursor.com>
| const outDir = join(process.cwd(), 'docs/operations/generated'); | ||
| mkdirSync(outDir, { recursive: true }); | ||
|
|
||
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; |
There was a problem hiding this comment.
prod:audit:db still falls back to the generic app DATABASE_URL when PROD_AUDIT_DATABASE_URL is unset. In a production or CI environment where DATABASE_URL is present, the documented skip path is bypassed and this audit connects with the app database credential while the report marks the run as read_only: true.
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL || process.env.DATABASE_URL; | |
| const connectionString = process.env.PROD_AUDIT_DATABASE_URL; |
Context Used: .greptile/instructions.md (source)
| mkdirSync(draftsDir, { recursive: true }); | ||
| for (const file of readdirSync(draftsDir)) { | ||
| if (file.endsWith('.md')) unlinkSync(join(draftsDir, file)); |
There was a problem hiding this comment.
auditor:all deletes every Markdown file under docs/operations/revealed-bugs/production-readiness/ before regenerating only current blocking drafts. That directory is not ignored like docs/operations/generated/, so a tracked or manually edited draft in this path is silently removed when the auditor runs.
Context Used: .greptile/instructions.md (source)
| "analyze:deps": "depcruise src --config dependency-cruiser.config.cjs --output-type json > docs/operations/generated/dependency-cruiser.json", | ||
| "analyze:knip": "knip --reporter json > docs/operations/generated/knip.json", | ||
| "analyze:duplicates": "jscpd src --reporters json,markdown --output docs/operations/generated/jscpd", | ||
| "secrets:scan": "node scripts/security/run-gitleaks-current-tree.mjs", | ||
| "cleanup:secret-scan": "node scripts/cleanup/run-secret-pattern-scan.mjs", | ||
| "secrets:scan:history": "gitleaks git . --redact --report-format json --report-path docs/operations/generated/gitleaks-history.json", | ||
| "deps:audit:npm": "npm audit --audit-level=high", | ||
| "deps:audit:osv": "osv-scanner --lockfile package-lock.json --format json > docs/operations/generated/osv.json", |
There was a problem hiding this comment.
analyze:deps, analyze:knip, and deps:audit:osv still redirect output into docs/operations/generated/ without creating the ignored parent directory first. On a fresh checkout, the shell opens the redirect target before starting depcruise, knip, or osv-scanner, so these commands fail immediately unless another command happened to create the directory.
Context Used: .greptile/instructions.md (source)
Resolve dependency-cruiser violations (25→0), tune Semgrep/JSCPD noise, untrack Capacitor iOS bundle, migrate dense raw-button surfaces to design-system primitives where feasible, and wire prod DB audit skip path. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Too many files changed for review. ( |
Add route normalizer, inventory/report scripts, Playwright crawler, Semgrep companion rules, and ownership matrix. Route hygiene passes with 0 P0/P1 blockers; branch protection and lint baseline updated. Co-authored-by: Cursor <cursoragent@cursor.com>
Expand route inventory/normalizer checks, Playwright route crawler, Semgrep route rules, and revealed-bug drafts; fix stale Baseball mobile nav example links and remove tracked secret-pattern scan artifact. Co-authored-by: Cursor <cursoragent@cursor.com>
Add nosemgrep annotations for device-token registry actions that do not serve cached pages and therefore intentionally skip revalidatePath. Co-authored-by: Cursor <cursoragent@cursor.com>
Revert accidental routes:report dependency from package.json and move device-token mutations into lib so review-gate semgrep stays clean. Co-authored-by: Cursor <cursoragent@cursor.com>
Document nosemgrep for the snapshot-restore RPC fallback path in submitRoundDirectFallback so Review Gate passes without weakening the destructive-write rule elsewhere. Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for network idle and main landmark before body checks so client-side redirects and auth gates do not false-positive in the route crawler. Co-authored-by: Cursor <cursoragent@cursor.com>
Expose auth and revalidate to static rules after requireCoachAuth, suppress public demo-request and box-score replace patterns with targeted nosemgrep. Co-authored-by: Cursor <cursoragent@cursor.com>
Add BUG_DISCOVERY_STACK map, verify:bugs:* npm scripts, Playwright visual and Schemathesis advisory lanes, ZAP/Meticulous workflows, and setup docs. Co-authored-by: Cursor <cursoragent@cursor.com>
Detect token via step output instead of secrets in job-level if conditions. Co-authored-by: Cursor <cursoragent@cursor.com>
Skip until token is set; document upload-container step for post-setup wiring. Co-authored-by: Cursor <cursoragent@cursor.com>
Wire e2e:visual scripts, generate public-route snapshot baselines, expand BUG_DISCOVERY_STACK.md with Greptile TREX/Qodo and Sentry replay docs, and document OpenAPI stub path for Schemathesis. Co-authored-by: Cursor <cursoragent@cursor.com>
Pass target URL through env vars instead of interpolating github context in run steps. Co-authored-by: Cursor <cursoragent@cursor.com>
Golf and baseball landing routes require Supabase client init; without NEXT_PUBLIC_SUPABASE_* the dev server renders error pages and Playwright screenshots fail against existing marketing/login baselines. Co-authored-by: Cursor <cursoragent@cursor.com>
Route crawler starts the dev server and hits landing routes that require Supabase client init; without NEXT_PUBLIC_SUPABASE_* the crawl fails the same way visual regression did before ed2e716. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Closing as superseded: this June-30 omnibus touches dozens of app files (baseball auth/onboarding/actions, golf pages) that PR #650 rebuilt on 2026-07-02 — merging it now would regress the shipped surfaces. The good infra pieces (route-hygiene scripts, advisory workflows, contract docs) should be re-cut cleanly on current main. Branch preserved. |
1 participant
Summary
Verification
Known radar findings
Greptile Summary
This PR wires a free production-readiness stack across CI, scripts, tests, and docs. The main changes are:
Confidence Score: 4/5
This should wait until the remaining script failures are fixed.
scripts/prod-audit/run-readonly-db-audit.mjs, scripts/auditor/run-helm-auditor.mjs, package.json
Security Review
The database audit script can still use the generic app database URL when the dedicated audit URL is missing, so the audit can run with the wrong credential.
Important Files Changed
Reviews (3): Last reviewed commit: "fix(ops): close 24h GitHub issues for CI..." | Re-trigger Greptile
Context used (5)