Repository navigation
ci: three-minute PR check and two previews per PR - #95
Merged
Merged
Conversation
Pull requests now run lint, types, unit, Edge Function and build checks beside a 31-test desktop browser smoke set. The full browser suite runs nightly. The database gate and live provider journeys run only when their paths change, so most pushes no longer start Supabase or spend provider credit. Docs-only PRs run the docs check alone. The unit suite keeps 15 files that guard security boundaries, Current Debate isolation, project selection, stream parsing, source import and the Crossfire and Sparring rules. The coverage gate is removed. VITE_SUPABASE_ENV pins a build to one project, for a second Vercel project that builds staging previews. Edge Function CORS and the demo-code redirect accept both projects' preview hosts, which previews could not call before. db-gate.test.ts stubs docker, so the unit suite no longer removes the fake provider container another worktree's gate is using. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…th-and-faster-ci # Conflicts: # plans/README.md # src/components/StagingBanner.tsx # src/components/features/settings/EnvironmentSwitcher.tsx # src/lib/supabase/env.ts # src/lib/supabase/switch-env.ts # src/test/ai/crossfire-client.test.ts # src/test/ai/sparring.test.ts # src/test/components/EnvironmentSwitcher.test.tsx # src/test/components/SparringSetup.test.tsx # src/test/crossfire/storage.test.ts # src/test/pages/CrossfirePage.test.tsx # src/test/pages/GeneratePage.test.tsx # src/test/pages/SettingsAdminNavigation.test.tsx # src/test/stores/sparring-store.test.ts
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedEnable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Next included review available in 40 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (3)
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Free Run ID: 📒 Files selected for processing (126)
💤 Files with no reviewable changes (98)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request changes CI workflows and verification commands, removes many Vitest test suites, and adds build-time Supabase environment pinning. It also expands Edge Function origin checks for staging and Vercel preview hosts. ChangesCI and test verification
Pinned preview environments
Estimated code review effort: 4 (Complex) | ~60 minutes Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to Approved preview builds can now handle production authentication responses while running unmerged code. Strict hostname checks and separate environment sessions reduce accidental exposure, but they do not establish that preview code is trusted. Production and staging deployment settings remain unverified. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing. Comment |
Owner
Author
|
@coderabbitai review |
|
Owner
Author
|
@coderabbitai review |
|
Owner
Author
|
@coderabbitai review |
|
They are the only coverage of the voice-unavailable state, and they check that a late microphone permission does not open the next turn and that words do not carry between rounds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…th-and-faster-ci # Conflicts: # docs/operations.md # docs/testing.md # package.json # src/test/docs/check-docs.test.ts # src/test/scripts/backend-status.test.ts
Generate now asks "Start a debate with this motion?" before it sends the request. Neither spec answered it, so every model-matrix case and the canary's "generates a case" test waited out their response timeouts with the dialog open and no request sent. Both now choose "use it once": model-matrix through the existing chooseForMotion helper, the canary inline because it does not load the full-stack helpers. Using it once also keeps the production canary account from accumulating debates. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyWuBiDEMvVnjmguH9CwCZ
Owner
Author
|
@coderabbitai review |
|
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner
Author
|
@coderabbitai review |
|
This was referenced Oct 3, 2026
Programcode
added a commit
that referenced
this pull request
Oct 3, 2026
…nning browser jobs - Deploy dates only say when a function was deployed. The sync now downloads what staging runs and compares it byte for byte with the commit, so an older checkout deployed after a merge no longer passes as current. Proven against a checkout from before #95: dates said nothing was pending, and the content check flagged the 13 functions that run the newer cors.ts. - run.sh holds a sync only while a browser job is running. A queued or gated run isn't using staging, and the job timeout doesn't cover queue time. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request checks now take about 3 minutes instead of about 26, and each PR gets a production preview and a staging preview that both update on every push.
Why
quality5,browser-tests21,database-tests19.5, andLive provider E2E17, which also spent OpenRouter and Exa credit on every push.vercel.apphost, so Supabase fell back to the Site URL. Edge Function CORS also rejected preview origins, so demo-code sign-in and every AI call failed on previews.What changes
CI:
Qualityruns lint, types, unit, collaboration, Edge Function and build checks. On PRs a parallelbrowser-smokejob runs 31 Playwright tests tagged@smokeon desktop Chromium.browser-nightly.ymlruns the full desktop and mobile suite nightly and on demand.database.ymlholds the database gate. It runs only when backend, store, AI or gate paths change, plus weekly.Live provider E2Eruns on PRs only when AI or research code changes, plus nightly.docs.yml: docs-only PRs rundocs:checkalone.npm ciuses the npm cache.Unit tests:
verify-debatelabskill relies onbackend:statusand the db-gate scriptPreviews:
VITE_SUPABASE_ENV=production|stagingpins a build to one project, through the samepinnedpath that feat(dev): staging-pinned tailnet previews #92 added for tailnet previews. Any other value fails the build.isAllowedOrigin()in_shared/cors.tsaccepts thedebate-navigatoranddebatelab-stagingpreview hosts under this team's Vercel scope. Edge Function CORS and the demo-code sign-in redirect both use it.npm run verifyuses the smoke set (about 2 minutes);npm run verify:fulladds the full suite.Outside the repo
Done alongside this PR, not by the merge (backups in
~/backups/supabase-auth/on the VPS):debatelab-stagingVercel project (same repo,VITE_SUPABASE_ENV=stagingfor Production and Preview, production URLhttps://debatelab-staging.vercel.app).debate-navigatorleavesVITE_SUPABASE_ENVunset, so it stays on production.https://debate-navigator-*-adam-gaborjanis-projects.vercel.app/**to production's Auth redirect allowlist.debatelab-stagingpreview and production hosts to staging's allowlist, and set staging's Site URL tohttps://debatelab-staging.vercel.app(it washttp://localhost:8080)._shared/cors.tsto staging, then production. Both projects currently run exactlymain's source for all 13 (downloaded and compared on 2026-10-03), so the deploy ships only this PR's CORS and redirect change.Verification
GitHub Actions, at
4b2ada4(before the last two commits):quality139 s andbrowser-smoke136 s, side by side (run 37062718290). This is the new PR check, about 2.3 minutes against 26 before.maintoo and is fixed by test(e2e): wait for the welcome tour to settle before clicking it #94.9a2a520carries #94's commit7c73df7unchanged. The two spec files are byte-identical to #94's, which passed model-matrix in run 37045216055. It also fixes the same dialog in the production canary.GitHub did not start any job at
9a2a520or later: "recent account payments have failed or your spending limit needs to be increased". So the final head has local results only, and a local pass is not a CI pass.Local, at
5f26ebc(final head):npm run verify: lint, typecheck, docs, unit, collaboration, Edge Function and build pass. Smoke: 30 passed, 1 flaky (crossfire.spec.ts"Question the AI completes a grounded Crossfire debrief" timed out waiting for the first field on a cold dev-server route and passed on retry)../.superset/db-gate.sh: pgTAP 451 tests in 19 files pass; full-stack and collaboration browser specs 71 passed, 1 skipped (workspace-collaboration.spec.ts"survive a teammate reload" on mobile, a skip written into the spec). 18 minutes.gpt-6.1-sol, high) of the full diff: no actionable findings.Driven by hand (2026-10-02):
VITE_SUPABASE_ENV=stagingbuild in Chromium shows the staging strip with no switch button, ignores a saved production toggle, and sends Google sign-in to the staging project.demo-code-loginfunction was run over HTTP against a fake Supabase:chorely-*,.vercel.app.evil.comandhttp:lookalikes do not.redirectToreachesgenerate_link, and a foreign one is dropped.Plan:
plans/2026-10-01-ci-and-preview-verification.md.🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Changes