From 86d253492ffdb33a38d7ffadde3bfb81c8d0bd01 Mon Sep 17 00:00:00 2001 From: Lucas Santana Date: Sat, 14 Mar 2026 13:01:23 -0300 Subject: [PATCH] chore(skills): add lucky ci gate recovery workflow --- .../skills/lucky-ci-gate-recovery/SKILL.md | 68 +++++++++++++++++++ AGENTS.md | 29 ++++---- CHANGELOG.md | 9 +++ 3 files changed, 92 insertions(+), 14 deletions(-) create mode 100644 .cursor/skills/lucky-ci-gate-recovery/SKILL.md diff --git a/.cursor/skills/lucky-ci-gate-recovery/SKILL.md b/.cursor/skills/lucky-ci-gate-recovery/SKILL.md new file mode 100644 index 000000000..0d5cfbd00 --- /dev/null +++ b/.cursor/skills/lucky-ci-gate-recovery/SKILL.md @@ -0,0 +1,68 @@ +--- +name: lucky-ci-gate-recovery +description: Use when Lucky PRs are blocked by required-check failures, especially SonarCloud or Dependabot CI contract mismatches. +--- + +# Lucky CI Gate Recovery + +## When to use + +- Required checks are blocking merge despite low-risk changes +- Sonar checks fail only on Dependabot PRs +- CI status appears contradictory (workflow pass + required status fail) +- You need a deterministic merge-safety checklist before release + +## Required sequence + +1. Capture required checks from active ruleset: + +```bash +REPO_SLUG=$(git remote get-url origin | sed 's#.*github.com[:/]\(.*\)\.git#\1#' | sed 's#.*github.com[:/]\(.*\)#\1#') +gh api repos/"$REPO_SLUG"/rulesets \ + --jq '.[] | select(.enforcement=="active") | .rules[]? | select(.type=="required_status_checks") | .parameters.required_status_checks[].context' +``` + +2. Inspect PR status using required checks only: + +```bash +gh pr checks --required +``` + +3. Classify failure bucket: + +- `token-permission`: secret/project access mismatch +- `quality-gate`: coverage/duplication/new-code thresholds +- `workflow-runtime`: action/runtime failure + +4. Apply minimal fix in this order: + +- CI contract mismatch first +- then branch drift/rebase +- then quality/test deltas + +5. Merge safety: + +```bash +SHA=$(gh pr view --json headRefOid --jq .headRefOid) +gh pr merge --squash --match-head-commit "$SHA" +``` + +## Dependabot Sonar policy (Lucky) + +- Non-Dependabot runs: Sonar token required and enforced +- Dependabot runs without token: scanner path must skip as success +- Required status names must remain stable with ruleset contexts + +## Post-merge smoke contract + +```bash +curl -i https://lucky-api.lucassantana.tech/api/health +curl -i https://lucky-api.lucassantana.tech/api/health/auth-config +curl -i https://lucky-api.lucassantana.tech/api/auth/discord +``` + +Expect: + +- `/api/health` => `200` +- `/api/health/auth-config` => `status: ok` +- `/api/auth/discord` => `302` diff --git a/AGENTS.md b/AGENTS.md index 82d63f331..070826bfd 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,20 +20,21 @@ At the start of every session: ### Project skills (`.cursor/skills/`) -| Task | Skill | -| ------------------------------------------------- | --------------------- | -| Add/change slash command | `discord-commands` | -| Play/queue/skip/volume, player lifecycle | `music-queue-player` | -| Schema, migrations, DB/Redis in shared | `prisma-redis-lucky` | -| Docker, compose, local run | `lucky-docker-dev` | -| Frontend (React, Vite, Tailwind) | `frontend-react-vite` | -| Backend (Express API, routes, services) | `backend-express` | -| E2E tests, Playwright, browser verification | `e2e-playwright` | -| Docs lookup, web search, MCP usage | `mcp-docs-search` | -| Moderation commands + AutoModService | `moderation-automod` | -| Bot event wiring (messageCreate, memberAdd, etc.) | `event-handlers` | -| Embed builder, custom commands, auto-messages | `management-features` | -| Unit tests, Jest ESM mocks, fixing disabled tests | `testing-lucky` | +| Task | Skill | +| ------------------------------------------------- | ------------------------ | +| Add/change slash command | `discord-commands` | +| Play/queue/skip/volume, player lifecycle | `music-queue-player` | +| Schema, migrations, DB/Redis in shared | `prisma-redis-lucky` | +| Docker, compose, local run | `lucky-docker-dev` | +| Frontend (React, Vite, Tailwind) | `frontend-react-vite` | +| Backend (Express API, routes, services) | `backend-express` | +| E2E tests, Playwright, browser verification | `e2e-playwright` | +| Docs lookup, web search, MCP usage | `mcp-docs-search` | +| Moderation commands + AutoModService | `moderation-automod` | +| Bot event wiring (messageCreate, memberAdd, etc.) | `event-handlers` | +| Embed builder, custom commands, auto-messages | `management-features` | +| Unit tests, Jest ESM mocks, fixing disabled tests | `testing-lucky` | +| CI gate triage and required-check recovery | `lucky-ci-gate-recovery` | ### Ecosystem skills (`.agent-skills/` — from skills.sh) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c8a0835b..f4ae5cfa3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- Added project CI triage skill + `.cursor/skills/lucky-ci-gate-recovery/SKILL.md` and linked it in + `AGENTS.md` for required-check/ruleset recovery workflows. + ### Fixed - Bot music stability hotfix: `/autoplay` now acknowledges interactions before @@ -22,6 +28,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 non-Dependabot runs fail fast if the token is missing. - Upgraded SonarCloud GitHub Action to `SonarSource/sonarqube-scan-action@v7` to keep workflow compatibility current. +- Cleared the open Dependabot workflow queue by landing split updates: + `actions/checkout@v6`, `preactjs/compressed-size-action@v3`, + `actions/labeler@v6`, and Sonar scan action `v7` via replacement PR. - Deploy OAuth redirect smoke now treats sustained `429` rate-limit responses as warning-only (after auth-config contract passes), preventing false-negative homelab deploy failures caused by Discord OAuth endpoint throttling.