fix(ci): repair the fallow workflow by crs48 · Pull Request #33 · crs48/xNet

crs48 · 2026-06-11T20:02:24Z

The Fallow check has failed on every run since it was introduced. This PR fixes it instead of removing it — the tool is genuinely useful (it gates dead code / complexity / duplication on changed files, and it had real findings on PR #31 that were ignored because the check was known-broken).

The two failure modes

1. SARIF upload rejection (every run). fallow emits one SARIF run per sub-analysis; since July 2025 the CodeQL upload action rejects multi-run files under one category. Fixed with a normalize step that merges the runs into one (same driver, rules deduped by id). The step only emits the merged file when the input parses as JSON — previously a crashed audit left an empty fallow-audit.sarif that passed the hashFiles() guard and failed the upload with Unexpected end of JSON input. Also bumps upload-sarif v3 → v4 (v3 deprecated Dec 2026).

2. Worktree creation failure (PR #32's run). could not create a temporary worktree for base ref 'origin/main' — a fallow 2.88 base-snapshot fragility fixed upstream by the 2.89–2.93 audit lifecycle hardening (WorktreeCleanupGuard, cache reclaim). Upgraded fallow ^2.88.1 → ^2.93.0.

Dead-code regressions surfaced by the upgrade

The 2.93 analyzer flags two findings that would fail the weekly scheduled regression job:

examples/system-schema-federation/src/App.tsx — intentionally standalone copyable sample (per its README), now covered by examples/** in .fallowrc.json ignorePatterns
spawnAndWait in tests/e2e/helpers/harness.ts — only used in-file; export removed

Verification

fallow audit --changed-since origin/main --fail-on-issues: pass, 0 findings
fallow dead-code --fail-on-regression against the existing baseline: 0 issues, delta +0
SARIF normalize tested on real output: 2 runs → 1 run, 42 deduped rules, valid JSON
This PR's own Fallow check exercises the full pipeline end-to-end

🤖 Generated with Claude Code

The Fallow check has failed on every run since it was added, for two independent reasons: 1. Every run: fallow emits one SARIF run per sub-analysis, and the CodeQL upload action rejects multi-run files under a single category (GitHub change, July 2025). A new normalize step merges the runs (same driver, rules deduped by id) into a single-run file, and only produces it when the input parses - the empty file a crashed audit leaves behind used to pass the hashFiles() guard and fail the upload with a JSON syntax error. Upload action bumped v3 -> v4 (v3 deprecated December 2026). 2. PR #32's run: 'could not create a temporary worktree for base ref' - a fallow 2.88 base-snapshot fragility fixed upstream by the audit lifecycle hardening in 2.89-2.93. Upgraded fallow to ^2.93.0. The upgraded analyzer also surfaced two real dead-code findings that would fail the weekly regression job: examples/** is now ignored (the README marks it an intentionally standalone copyable sample), and spawnAndWait in the e2e harness is no longer exported (only used in-file). Audit and baseline regression both pass locally on 2.93.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

coderabbitai · 2026-06-11T20:02:55Z

Warning

Review limit reached

@crs48, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 48 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 994a0980-274c-43ba-a7b9-65fa5fa9b263

📥 Commits

Reviewing files that changed from the base of the PR and between 098099a and 3cad8f2.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

.fallowrc.json
.github/workflows/fallow.yml
graphify-out/GRAPH_REPORT.md
graphify-out/graph.html
graphify-out/graph.json
package.json
tests/e2e/helpers/harness.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/fallow-ci

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-11T20:06:27Z

Preview removed for PR #33.

Temporary debugging for the persisting worktree-creation failure: probe the exact git operation with stderr visible, and drop --quiet so fallow's hint line reaches the job log. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

Root cause of the worktree failure, confirmed by the probe step: the repo's husky post-checkout hook (added 2026-06-11 in 23becc1) fires inside the fresh worktree that fallow's base-snapshot pass creates with 'git worktree add', dies there with exit 127, and fails the worktree creation. HUSKY=0 skips hook installation during pnpm install and short-circuits any installed shim. Probe step removed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

With the worktree failure fixed (HUSKY=0), the audit now runs clean and the upload reached code scanning post-processing, which rejected it: 'locationFromSarifResult: expected at least one location'. fallow emits run-level notices as results without locations; code scanning requires one per result. Filter them in the normalize step - they still appear in the step summary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

github-advanced-security · 2026-06-11T20:21:07Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

github-actions Bot added a commit that referenced this pull request Jun 11, 2026

deploy(preview): publish PR #33 preview

bc00bae

greptile-apps Bot reviewed Jun 11, 2026

View reviewed changes

crs48 merged commit f0e87c4 into main Jun 11, 2026
9 checks passed

crs48 deleted the fix/fallow-ci branch June 11, 2026 20:25

github-actions Bot added a commit that referenced this pull request Jun 11, 2026

deploy(preview): remove PR #33 preview

3372b8f

Navigation Menu

Uh oh!

fix(ci): repair the fallow workflow - #33

fix(ci): repair the fallow workflow#33
crs48 merged 4 commits into
mainfrom
fix/fallow-ci

crs48 commented Jun 11, 2026

Uh oh!

greptile-apps Bot left a comment

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot left a comment

Uh oh!

github-advanced-security AI commented Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

crs48 commented Jun 11, 2026

The two failure modes

Dead-code regressions surfaced by the upgrade

Verification

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Jun 11, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

github-actions Bot commented Jun 11, 2026 •

edited

Loading