ci: consolidate review gates and test cleanup boundaries

[luvs01]

Summary

Consolidate #5311, #5297 and #4597 with the test-sandbox cleanup correction into one CI review. Preserve all seven source contributions and their authors, including JUN's event-aware aggregate follow-up.

• Match a stacked PR parent by its actual head repository and reject missing/mismatched repository identities. Treat private fields and generator methods as code when deciding whether a change needs regression coverage.

• Include all GitHub workflow and script changes in both the push allowlist and changed-area filter.

• Add the manual release-gates lane for ordinary jobs, with Windows diagnostic suites and unsharded macOS control explicitly unrequested in that lane. Default/all and macos-control retain their respective behavior.

• Preserve the aggregate contract: requested jobs must succeed, unrequested jobs must be skipped, and missing/unknown or failed/cancelled requested results must fail the check.

• Drain config/native cleanup producers and await ACL child reaping before removing the test sandbox. The synchronous exit fallback leaves undrained roots for ownership-checked recovery, rather than blocking the event loop needed to settle those children. Home isolation, guard arming, run-lock admission, deletion strength and time limits remain unchanged.

This does not implement draft-only or Stack-tip-only CI. Workflow permissions, action pins, secrets exposure and release/publish eligibility are unchanged. The latest dev policy scopes native jobs and the macOS smoke legs; this integration preserves that policy rather than restoring the old unconditional coverage. The existing #5509 observer/hook bundle is not duplicated here.

Verification

• Current head: f5d2011ab94c5efd4e9055a8fa1cd195f2729098, based on dev b1b60e880c61fbea12eed326ac43529cc393fb15, and a fast-forward of 8dc4050. The new native gate, dynamic smoke matrices and release-line-only push policy are preserved. The review-lane helper now supplies native selection and checks its combinations with each dispatch lane. Hygiene/target-branch code and the three shared cleanup files remain byte-identical to 8dc4050; the upstream macOS batch runner and serial regression are unchanged. The initial cleanup carry matches source fa96c7bca6780bb4d871ff5b5b0bb1187f3b9d16 by stable patch ID.

• Current eight-file CI/layout/cleanup/release run: 188 passed, 34 existing platform/dependency skips, 0 failed, 2,482 assertions, 5.70 seconds. Node gate checks: 50 passed. Typecheck, structure, privacy, ratchet and whitespace passed. An initial structure check found local CRLF line endings from conflict resolution; restoring the repository-required LF endings fixed that validation issue without changing the staged source tree.

• Required bun run prepush on this exact head completed typecheck and correctly skipped dashboard lint, then reached the unchanged 900-second main-suite limit and exited 124 after 920 seconds. It did not reach the serial lanes or chained privacy/doctor steps. Test failures and incomplete output remain recorded; baseline equivalence is not established. One temporary test root was deferred because Windows retained an open handle. This is not a completed or passing full suite.

• At the preceding 8dc4050 head, the follow-up aligned the shared cleanup helper, preload and regression file with fix(web-search): consolidate replay isolation and bounded bridge repair #5562, while retaining each branch's actual workflow documentation. CI tests then passed 186 / 188 cases with 2 existing Windows platform skips, 1,963 assertions; typecheck, structure, privacy and ratchet passed. A virtual merge with search head 6ea3a95c212c94103177fd17ffa37b28f05ce843 is conflict-free at tree 33cac6e8a3262ed5fe706110d5ce891334c4851e, with original CI files and search production source preserved. The virtual union was inspected, not executed as a full suite.

• Earlier combined CI/cleanup/release checks: 184 passed / 2 Windows platform skips / 0 failures. Typecheck, structure, privacy, ratchet and whitespace checks passed. The cleanup ordering regression was separately driven red by moving deletion before the drain, then passed with the correct order; 39 source cleanup/guard tests passed. This fixes the global sandbox afterAll/exit boundary, not every individual fixture's afterEach cleanup.

• Node hygiene/target-branch tests: 50 passed. Focused Bun workflow checks on Bun 1.4.2: 147 passed / 27 existing Windows platform skips / 0 failures. File-size ratchet: 9 passed.

• TypeScript, structure, privacy and whitespace checks passed. The exact aggregate Bash parsed successfully with Git Bash. A standalone run of that unchanged YAML script passed 69/69 real-jq cases, including rejection of failed, cancelled, skipped, missing and unknown requested results. The first Windows-jq attempt exposed CRLF output; the documented --binary option corrected only that platform I/O difference. The same five-second per-case bound was retained, and no fake jq, source change or skip override was used.

• The earlier required bun run prepush attempt and the earlier ef5c00222092ddcd40585190f566d6d2dedc507f attempt each reached the unchanged 900-second main-lane limit and exited 124. Neither completed or passed. That earlier run used repository-local Bun 1.4.0, completed typecheck and the lint selector decision, and did not reach serial lanes or chained privacy/doctor steps. Its partial output contained 10,042 pass lines, 144 fail lines and 130 skip lines; those are incomplete observations, not suite totals. Failures include backlog abort, restart, startup-read memoization and manual-choice persistence. Baseline equivalence has not been established, and this cleanup change does not claim to fix them. Focused results above remain separate evidence.

• No source timeout, skip, limit or baseline was relaxed. Existing browser dependencies were reused without installation; the prepush run's documented lint/doctor selectors received its exact 13 changed non-dashboard paths. Owned runner processes were gone after termination. Two initially inaccessible test-fixture directories were later inspected as empty and removed normally after restoring read access to those exact roots; no forced or recursive deletion was needed.

• chore(ci): consolidate development hooks and hosted reliability fixes #5509 previously conflicted with the compared dev and aggregate heads in four macOS batching/observer files. This update is not a tested union with chore(ci): consolidate development hooks and hosted reliability fixes #5509. Integration must preserve current fresh-process batching and its failure/membership tests while porting the owned-process observer.

• Cross-platform CI run 35741645369 completed successfully on the preceding ef5c002 head, including four Linux test shards, both macOS shards, desktop Rust checks, the widget bundle and the aggregate ci check. Optional Windows diagnostic shards and unsharded macOS control were skipped; this is not a full Windows-suite pass. Updated-head hosted checks are pending.

• Local prepush completion, optional diagnostic lanes and explicit maintainer security review remain outstanding. Hosted success does not erase the unresolved local Windows failures. This PR stays draft and does not attest to merge or release readiness.

Checklist

• Scope stays focused and avoids unrelated cleanup.

• Docs or release notes were updated when needed.

• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: JUN bitkyc08@gmail.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 61 / 80

이 PR은 CI 검문(리뷰 게이트)을 한곳에 모은 작업이다. 예전에 따로 있던 #5311, #5297, #4597 내용을 dev 위에 합쳤다. 하는 일은 크게 네 가지다. (1) 주석만 바뀐 것처럼 보이던 #private / *generator 코드가 회귀 테스트 검사를 빠져나가지 못하게 pr-hygiene를 고친다. (2) 스택 PR의 부모를 찾을 때 GitHub가 head 저장소를 못 주면 더 이상 “맞는 부모”로 치지 않고 막는다. (3) 비싼 CI가 돌 경로에 .github/scripts/**와 .github/workflows/**를 넣어, 워크플로·스크립트만 바꿔도 검문이 돌아가게 한다. (4) 수동 실행용 release-gates 차선을 추가해, 일반 릴리스 검문은 돌리되 Windows 진단 스위트와 unsharded macOS control은 이 차선에서는 요청하지 않는다. 합계(aggregate) 검문은 “요청한 잡은 성공, 요청하지 않은 잡은 skipped, 빠지거나 이상한 결과는 실패” 규칙을 그대로 유지한다. 베이스는 dev이고, 소스 PR 세 개는 이미 CLOSED다. 호스티드 CI 체크는 현재 초록으로 보인다. 작성자도 draft이며 머지·릴리스 준비 완료를 주장하지 않았다.

라인 - .github/scripts/pr-hygiene.cjs isCommentOnlyChange: #로 시작하는 줄을 더 이상 “주석”으로 보지 않는다. #private 구멍을 막는 목적은 맞지만, 예전에는 주석으로 통과하던 # … 형태(셸·일부 설정 스타일)도 이제 코드로 보고 회귀 테스트를 요구한다. 닫는 쪽(fail-closed)이라 방향은 맞다.
라인 - bun run prepush: 작성자 기준으로 900초 한도에 걸려 exit 124로 끊겼다. 부분 로그만 있고 전체 로컬 prepush 통과는 증명되지 않았다. 포커스 테스트·호스티드 CI 성공과 별개로, “로컬 필수 게이트” 증거는 아직 비어 있다.
라인 - 현재 dev tip(41ec40f, #5550)보다 이 head가 1커밋 뒤처져 compare가 diverged다. 머지 전에 다시 맞출 필요가 있다.
라인 - #5509와 macOS 배칭/observer 쪽 4파일 충돌이 남는다. #5509는 지금 CONFLICTING이다. 이 PR과 함께 합치면 안 되고, 작성자가 적은 대로 fresh-process 배칭·실패/멤버십 테스트를 지키며 observer만 옮기는 통합이 따로 필요하다.
경로 - 체크리스트의 “Security-sensitive … reviewed”가 비어 있다. 권한·action pin·시크릿 노출은 안 바꿨다고 본문에 적혀 있지만, 워크플로 path 허용 범위를 **로 넓힌 변경이라 메인테이너가 한 번 더 보면 좋다.

메인테이너의 판단이 필요한 지점

draft를 ready로 올리기 전에 prepush(또는 동등한 전체 로컬 게이트)를 다시 돌려 통과 증거를 받을지, 호스티드 CI 초록만으로 draft→ready를 허용할지. 또 #5509와 이 PR을 어떤 순서로 dev에 넣을지(한쪽 먼저 vs 통합 브랜치). release-gates를 일상 릴리스 검문 기본 차선으로 쓸지, 당분간 수동 옵션으로만 둘지.

너의 추천

지금 상태로는 draft 유지가 맞다. 소스 중복 PR은 이미 닫혀 있으니 닫을 일은 없다. 머지 후보로 올리려면 (1) 현재 dev에 rebase/merge로 tip을 맞추고, (2) prepush(또는 합의한 대체 전체 게이트) 통과 로그를 남기고, (3) #5509와 충돌 계획을 이슈/본문에 한 줄로 고정한 뒤 ready로 전환하라. release-gates 동작·합계 계약 테스트(tests/helpers/ci-review-lanes.ts)는 방향이 좋아 보이니, 그 부분은 유지한 채 위 세 가지만 채우면 된다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Thank you, @luvs01 (and JUN for the aggregate follow-up). This PR is re-carried in #5597 as ordered unit commits on current dev, with Co-authored-by credit on each:

• comment-only detection and stacked-parent head-repository matching (fix(ci): harden comment-only detection and stacked-base matching #5311)
• .github/workflows/** and .github/scripts/** in the expensive-CI allowlist (fix(ci): cover .github scripts and workflows in the expensive-CI allowlist #5297)
• the manual release-gates lane and aggregate expectation (ci: add a manual lane for ordinary release gates #4597 and its follow-up)
• preload sandbox teardown draining producers and ACL reaps (byte-identical to the copies in fix(web-search): consolidate replay isolation and bounded bridge repair #5562)

The cases registered from tests/helpers/ci-review-lanes.ts now live in the registered tests/ci-workflows/ci-review-lanes.test.ts. Review found one gap in the classifier rewrite: a bare line after a /* opener inside a template literal counted as a comment. #5597 fixes it and adds regression cases. Closing as superseded by #5597.