ci: run Windows advisory on pull requests

[Astro-Han]

Summary

Restore windows-advisory as an advisory pull request workflow for PRs targeting dev. No related issue; this follows maintainer request to catch Windows-only regressions before merge.

This also hardens the CI-only skip path for native watcher tests so Windows advisory jobs short-circuit before probing the native @parcel/watcher binding.

Why

windows-advisory was only running after merges to dev or by manual dispatch, so Windows-specific regressions could surface only after code had already landed. Running it on PRs moves that signal earlier while keeping it outside the required merge gate.

The first PR run exposed a flaky Bun/native watcher crash in the Windows advisory shard. The affected live watcher tests were already intended to skip in CI; the guard helper now checks CI before probing native watcher support.

Related Issue

None.

Human Review Status

Pending

Review Focus

Please check that the restored PR trigger remains advisory-only, that pull-requests: read is scoped to the changes job for paths-filter PR metadata reads, and that the watcher CI guard skips without calling the native binding probe.

Risk Notes

Non-docs PRs now consume Windows runner capacity for this advisory workflow. The docs-only skip remains in place. Permission surface expands from contents: read to contents: read plus pull-requests: read only on the changes job so dorny/paths-filter can read changed files on pull_request events.

The watcher hardening changes only test guard selection for suites that already skip in CI. Local non-CI runs still probe native watcher support before deciding whether to run those live watcher suites.

Visible UI checklist is skipped because no UI or copy changed.

How To Verify

RED: bun --cwd packages/opencode test test/github/ci-workflow.test.ts --timeout 30000
Result: failed on missing parsed.on.pull_request before the workflow change.

GREEN: bun --cwd packages/opencode test test/github/ci-workflow.test.ts test/github/bun-version-workflow.test.ts --timeout 30000
Result: 19 pass, 0 fail, 303 expect() calls.

RED: bun --cwd packages/opencode test test/file/watcher-ci-skip.test.ts --timeout 30000
Result: failed because the helper called the native binding probe when CI was set.

GREEN: bun --cwd packages/opencode test test/file/watcher-ci-skip.test.ts --timeout 30000
Result: 2 pass, 0 fail, 4 expect() calls.

Watcher related: bun --cwd packages/opencode test test/file/watcher-ci-skip.test.ts test/file/watcher.test.ts test/project/vcs.test.ts --timeout 30000
Result: 39 pass, 0 fail, 101 expect() calls.

CI skip path: CI=1 bun --cwd packages/opencode test test/file/watcher-ci-skip.test.ts test/file/watcher.test.ts test/project/vcs.test.ts --timeout 30000
Result: 26 pass, 13 skip, 0 fail, 84 expect() calls.

Workflow contract: bun --cwd packages/opencode test test/github/ci-workflow.test.ts --timeout 30000
Result: 16 pass, 0 fail, 297 expect() calls.

Whitespace: git diff --check
Result: passed with no output.

Ruleset readback: gh api repos/Astro-Han/pawwork/rulesets/15292177 --jq ...
Result: required contexts remain analyze-js-ts, dependency-review, dev-dep-audit, e2e-artifacts, smoke-macos-arm64, typecheck, unit-app, unit-desktop, unit-opencode, unit-ui.

Screenshots or Recordings

Not applicable; no visible UI changes.

Checklist

• Type label — this PR carries exactly one of bug, enhancement, task, documentation. Type labels are author-added; the labeler bot does NOT assign them. Add the label in the GitHub UI, then tick this.
• Routing labels — this PR carries at least one of app, ui, platform, harness, ci. The labeler bot assigns these on PR open based on changed paths. Confirm the bot's choice (or override if wrong), then tick this.
• Priority label — this PR carries exactly one of P0, P1, P2, P3. The priority-triage bot suggests one on PR open. Confirm or override, then tick this.
• Human Review Status above is set to Pending, Approved by @<reviewer>, or Not required: <reason> (default is Pending; "not required" is restricted to bot-authored low-risk PRs).
• I linked the related issue, or stated in Summary why there is no issue.
• I described the review focus and any meaningful risks.
• I replaced the example block in How To Verify with the real verification steps and the key result for each.
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope.
• (conditional) I manually checked visible UI or copy changes when needed, with screenshots or recordings. Leave unticked only if no visible UI or copy changed.
• (conditional) I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes. Leave unticked only if no platform/packaging surface was touched.
• (conditional) I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant. Leave unticked only if none of those surfaces was touched.
• I reviewed the final diff for unrelated changes and suspicious dependency changes.
• I am targeting dev, and my PR title and commit messages use Conventional Commits in English.

Summary by CodeRabbit

• Tests

  • Introduced CI environment guards for native watcher tests to improve reliability in continuous integration environments
  • Updated test suite configuration to use consolidated gate logic

• Chores

  • Enhanced GitHub workflow configuration with improved event triggers and job permissions for pull requests
  • Refactored testing infrastructure for better maintainability

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: da4b921d-7582-4949-b29d-ce77a7547ea0

📥 Commits

Reviewing files that changed from the base of the PR and between c019c11 and fb369af.

📒 Files selected for processing (6)

• .github/workflows/windows-advisory.yml
• packages/opencode/test/file/native-watcher-ci-guard.ts
• packages/opencode/test/file/watcher-ci-skip.test.ts
• packages/opencode/test/file/watcher.test.ts
• packages/opencode/test/github/ci-workflow.test.ts
• packages/opencode/test/project/vcs.test.ts

---

📝 Walkthrough

Walkthrough

The PR introduces a reusable CI guard helper for native watcher tests and updates the Windows advisory workflow to run on pull requests with pull-request read permissions. Test suites are migrated to use the centralized guard, and workflow changes are validated in tests.

Changes

Workflow CI gating and native watcher test guard

Layer / File(s)	Summary
CI guard abstraction and validation packages/opencode/test/file/native-watcher-ci-guard.ts, packages/opencode/test/file/watcher-ci-skip.test.ts	New exported function shouldRunNativeWatcherTests returns true when CI is not set and native binding is available. Two test cases validate guard behavior: skipping probing in CI and enabling it outside CI.
Workflow trigger and permissions update .github/workflows/windows-advisory.yml	Windows advisory workflow now triggers on pull_request events to dev alongside push events. The changes job gains explicit pull-requests: read permission alongside contents: read.
Workflow test assertions packages/opencode/test/github/ci-workflow.test.ts	Test assertions validate parsed workflow on configuration (push and pull_request limited to dev branch), null workflow_dispatch, and changes job permissions including pull-requests: read.
Test suite migrations to CI guard packages/opencode/test/file/watcher.test.ts, packages/opencode/test/project/vcs.test.ts	Watcher and VCS test suites replace inline CI and binding checks with calls to shouldRunNativeWatcherTests, centralizing CI gating logic.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• Astro-Han/pawwork#409: Prior PR introduced the dedicated windows-advisory workflow without pull_request trigger; this PR extends it to run on pull_request to dev and adds pull-requests read permissions.

Suggested labels

github_actions

Poem

🐰 A guard for the watcher, so CI stays clean,
Pull requests now welcome to the workflow scene,
Tests skip when in CI, but run where they're free,
One helper to rule them, as simple can be! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'ci: run Windows advisory on pull requests' clearly summarizes the main change—restoring the Windows advisory workflow to run on PR events targeting dev.
Description check	✅ Passed	The PR description covers all required sections: Summary, Why, Related Issue, Human Review Status, Review Focus, Risk Notes, How To Verify (with command results), Screenshots section, and a complete checklist with all required items ticked.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/windows-advisory-pr

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Suggested priority: P3 (only low-risk paths changed (.github/workflows/windows-advisory.yml, packages/opencode/test/github/ci-workflow.test.ts)).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.

[gemini-code-assist]

Code Review

This pull request updates the CI workflow tests in ci-workflow.test.ts to perform more precise assertions on the parsed workflow object, verifying the push, pull request, and workflow dispatch configurations, as well as updating the expected permissions to include read access for pull requests. I have no feedback to provide as the changes are straightforward and correct.