Repository navigation
refactor(admission): reconstruct change-aware local checks #499
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
99e8e72
refactor(admission): reconstruct change-aware local checks
qnbs 57ca37d
fix(admission): close review-loop findings on change-aware checks
qnbs a64dc29
fix(admission): close E1 findings and one self-identified test gap
qnbs 94f503b
docs: reconcile pre-push gate docs with change-aware admission
qnbs 80b1807
docs: fix false lint claim and reconcile AGENTS.md sections
qnbs 5873df4
docs: correct local-typecheck characterization and fix CI.md anchor
qnbs File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| export function shouldRunAdmissionCheck(name: string, files: readonly string[]): boolean; | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| const routingAuthority = 'scripts/ci-prepush-check-registry.mjs'; | ||
| const runnerAuthority = 'scripts/ci-prepush-lowend.mjs'; | ||
| const i18nPolicyFiles = new Set([ | ||
| 'scripts/check-i18n-keys.mjs', | ||
| 'scripts/i18n-locales.mjs', | ||
| 'scripts/build-i18n.mjs', | ||
| 'scripts/i18n-quality-report.mjs', | ||
| ]); | ||
|
|
||
| // QNBS-v3: not exported — shouldRunAdmissionCheck is the public API, nothing else consumes this. | ||
| const admissionCheckRegistry = Object.freeze([ | ||
| { | ||
| name: 'i18n', | ||
| matches: (file) => | ||
| file.startsWith('locales/') || | ||
| file.startsWith('public/locales/') || | ||
| i18nPolicyFiles.has(file), | ||
| implementationFiles: new Set([ | ||
| routingAuthority, | ||
| runnerAuthority, | ||
| 'scripts/ci-prepush-classifier.mjs', | ||
| 'scripts/ci-prepush-range-resolver.mjs', | ||
| ]), | ||
|
qnbs marked this conversation as resolved.
|
||
| }, | ||
| { | ||
| name: 'contentGuard', | ||
| matches: (file) => | ||
| file === 'scripts/content-guard.mjs' || | ||
| file.startsWith('community-templates/') || | ||
| file.startsWith('public/community-templates/'), | ||
| implementationFiles: new Set([ | ||
| routingAuthority, | ||
| runnerAuthority, | ||
| 'scripts/ci-prepush-classifier.mjs', | ||
| 'scripts/ci-prepush-range-resolver.mjs', | ||
| ]), | ||
|
qnbs marked this conversation as resolved.
|
||
| }, | ||
| ]); | ||
|
|
||
| export function shouldRunAdmissionCheck(name, files) { | ||
| const entry = admissionCheckRegistry.find((candidate) => candidate.name === name); | ||
| if (!entry) throw new Error(`unknown local admission check: ${name}`); | ||
| return files.some((file) => entry.matches(file) || entry.implementationFiles.has(file)); | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| export type ChangeKind = | ||
| | 'NO_CHANGES' | ||
| | 'DOCS_ONLY' | ||
| | 'WORKFLOW_ONLY' | ||
| | 'NON_CODE_ONLY' | ||
| | 'RUST_TAURI' | ||
| | 'TOOLING' | ||
| | 'TEST_ONLY' | ||
| | 'TYPESCRIPT_APPLICATION' | ||
| | 'DEPENDENCY_TOOLCHAIN' | ||
| | 'BUILD_CONFIGURATION' | ||
| | 'AMBIGUOUS' | ||
| | 'MIXED'; | ||
|
|
||
| export interface ChangeClassification { | ||
| readonly kind: ChangeKind; | ||
| readonly categories: readonly string[]; | ||
| readonly files: readonly string[]; | ||
| } | ||
|
|
||
| export function classifyFile(file: string): string; | ||
| export function classifyChangedFiles(files: readonly string[]): ChangeClassification; | ||
| export function requiresTypecheck( | ||
| classification: ChangeClassification, | ||
| options?: { readonly full?: boolean }, | ||
| ): boolean; | ||
| export function manualAdmissionNeedsFullValidation(rangeResolved: boolean): boolean; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| const DOC_FILE = /\.(?:md|mdx)$/i; | ||
| const TS_FILE = /\.(?:c|m)?tsx?$/i; | ||
| const WORKFLOW_ROOTS = ['.github/workflows/', '.github/actions/']; | ||
| // QNBS-v3: matches the i18n/contentGuard registry's own routing so both stay in sync. | ||
| const NON_CODE_ROOTS = [ | ||
| 'locales/', | ||
| 'public/locales/', | ||
| 'community-templates/', | ||
| 'public/community-templates/', | ||
| ]; | ||
| const RUST_ROOTS = ['src-tauri/', 'crates/']; | ||
| const TOOLING_ROOTS = ['scripts/']; | ||
| const TOOLING_FILES = new Set(['.gitleaks.toml']); | ||
| // QNBS-v3: these scripts/*.json files are imported into TS config with resolveJsonModule, not tooling. | ||
| const TYPED_CONFIG_INPUTS = new Set(['scripts/coverage-thresholds.json']); | ||
| const DEPENDENCY_FILES = new Set([ | ||
| 'package.json', | ||
| 'pnpm-lock.yaml', | ||
| 'pnpm-workspace.yaml', | ||
| '.npmrc', | ||
| '.nvmrc', | ||
| 'rust-toolchain', | ||
| 'rust-toolchain.toml', | ||
| ]); | ||
| const BUILD_CONFIG_FILES = new Set([ | ||
| 'biome.json', | ||
| 'index.html', | ||
| 'playwright.config.ts', | ||
| 'postcss.config.js', | ||
| 'postcss.config.mjs', | ||
| 'tailwind.config.js', | ||
| 'tailwind.config.ts', | ||
| 'turbo.json', | ||
| 'vite.config.ts', | ||
| 'vitest.config.ts', | ||
| ]); | ||
|
|
||
| function startsWithRoot(file, roots) { | ||
| return roots.some((root) => file.startsWith(root)); | ||
| } | ||
|
|
||
| function normalizePath(file) { | ||
| return file.replaceAll('\\', '/').replace(/^\.\//, ''); | ||
| } | ||
|
|
||
| function isInstructionFile(file) { | ||
| return ( | ||
| file === 'AGENTS.md' || | ||
| file === 'CLAUDE.md' || | ||
| file === '.cursorrules' || | ||
| file === '.github/copilot-instructions.md' || | ||
| file.startsWith('.cursor/rules/') | ||
| ); | ||
| } | ||
|
|
||
| export function classifyFile(file) { | ||
| const normalized = normalizePath(file); | ||
| const base = normalized.split('/').at(-1) ?? normalized; | ||
|
|
||
| if (startsWithRoot(normalized, WORKFLOW_ROOTS)) return 'WORKFLOW'; | ||
| if (DOC_FILE.test(normalized) || isInstructionFile(normalized)) return 'DOCS'; | ||
| if ( | ||
| RUST_ROOTS.some((root) => normalized.startsWith(root)) || | ||
| /(?:^|\/)(?:Cargo\.toml|Cargo\.lock)$/.test(normalized) || | ||
| normalized.endsWith('.rs') | ||
| ) { | ||
| return 'RUST_TAURI'; | ||
| } | ||
| if (startsWithRoot(normalized, NON_CODE_ROOTS)) return 'NON_CODE_ONLY'; | ||
| // QNBS-v3: tests/fixtures/**/*.json gets inferred TS types (e.g. logger.test.ts) — typecheck it. | ||
| if (normalized.startsWith('tests/')) | ||
| return TS_FILE.test(normalized) || | ||
| (normalized.startsWith('tests/fixtures/') && normalized.endsWith('.json')) | ||
| ? 'TYPESCRIPT_APPLICATION' | ||
| : 'TEST_ONLY'; | ||
| if (TS_FILE.test(normalized)) return 'TYPESCRIPT_APPLICATION'; | ||
| if (TYPED_CONFIG_INPUTS.has(normalized)) return 'TYPESCRIPT_APPLICATION'; | ||
| if (TOOLING_FILES.has(normalized) || startsWithRoot(normalized, TOOLING_ROOTS)) return 'TOOLING'; | ||
| if ( | ||
| DEPENDENCY_FILES.has(base) || | ||
| normalized.startsWith('patches/') || | ||
| (normalized.startsWith('packages/') && base === 'package.json') | ||
| ) { | ||
| return 'DEPENDENCY_TOOLCHAIN'; | ||
| } | ||
| if (BUILD_CONFIG_FILES.has(base)) return 'BUILD_CONFIGURATION'; | ||
| return 'UNKNOWN'; | ||
| } | ||
|
qnbs marked this conversation as resolved.
|
||
|
|
||
| // QNBS-v3: classify change impact before starting expensive local checks. | ||
| export function classifyChangedFiles(files) { | ||
| const normalizedFiles = [...new Set(files.map(normalizePath).filter(Boolean))].sort(); | ||
| const categories = [...new Set(normalizedFiles.map(classifyFile))]; | ||
|
|
||
| if (normalizedFiles.length === 0) | ||
| return { kind: 'NO_CHANGES', categories, files: normalizedFiles }; | ||
| if (categories.every((category) => category === 'DOCS')) | ||
| return { kind: 'DOCS_ONLY', categories, files: normalizedFiles }; | ||
| if (categories.every((category) => category === 'WORKFLOW')) | ||
| return { kind: 'WORKFLOW_ONLY', categories, files: normalizedFiles }; | ||
| if (categories.length === 1) { | ||
| if (categories[0] === 'UNKNOWN') | ||
| return { kind: 'AMBIGUOUS', categories, files: normalizedFiles }; | ||
| return { kind: categories[0], categories, files: normalizedFiles }; | ||
| } | ||
| if ( | ||
| categories.every((category) => | ||
| ['DOCS', 'WORKFLOW', 'TOOLING', 'TEST_ONLY', 'NON_CODE_ONLY'].includes(category), | ||
| ) | ||
| ) | ||
| return { kind: 'NON_CODE_ONLY', categories, files: normalizedFiles }; | ||
| if (categories.includes('UNKNOWN')) | ||
| return { kind: 'AMBIGUOUS', categories, files: normalizedFiles }; | ||
| return { kind: 'MIXED', categories, files: normalizedFiles }; | ||
| } | ||
|
|
||
| export function requiresTypecheck(classification, { full = false } = {}) { | ||
| if (full) return true; | ||
| return ![ | ||
| 'NO_CHANGES', | ||
| 'DOCS_ONLY', | ||
| 'WORKFLOW_ONLY', | ||
| 'NON_CODE_ONLY', | ||
| 'RUST_TAURI', | ||
| 'TOOLING', | ||
| 'TEST_ONLY', | ||
| ].includes(classification.kind); | ||
| } | ||
|
|
||
| export function manualAdmissionNeedsFullValidation(rangeResolved) { | ||
| return !rangeResolved; | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,59 +1,95 @@ | ||
| import process from 'node:process'; | ||
| import { shouldRunAdmissionCheck } from './ci-prepush-check-registry.mjs'; | ||
| import { | ||
| classifyChangedFiles, | ||
| manualAdmissionNeedsFullValidation, | ||
| requiresTypecheck, | ||
| } from './ci-prepush-classifier.mjs'; | ||
| import { isMainModule, resolveManualEvidence } from './ci-prepush-range-resolver.mjs'; | ||
| import { ensureDependencyState, runLocalBinary, runNodeScript } from './hooks/shared.mjs'; | ||
| import { readPrePushEvidenceFile, resolvePushEvidence } from './signing/signing-core.mjs'; | ||
|
|
||
| const evidenceIndex = process.argv.indexOf('--prepush-evidence-file'); | ||
| if (evidenceIndex >= 0) { | ||
| function report(name, status, detail = '') { | ||
| console.log(`[local-admission] ${name.padEnd(26)} ${status}${detail ? ` — ${detail}` : ''}`); | ||
| return status; | ||
| } | ||
|
|
||
| function runCheck(name, run) { | ||
| const status = run(); | ||
| report(name, status === 0 ? 'PASS' : 'FAIL'); | ||
| if (status !== 0) process.exit(status ?? 1); | ||
| } | ||
|
|
||
| function main() { | ||
| const evidenceIndex = process.argv.indexOf('--prepush-evidence-file'); | ||
| const evidenceFile = evidenceIndex >= 0 ? process.argv[evidenceIndex + 1] : undefined; | ||
| const fullRequested = process.argv.includes('--full'); | ||
|
|
||
| let manualEvidence; | ||
| try { | ||
| const evidence = resolvePushEvidence( | ||
| readPrePushEvidenceFile(process.argv[evidenceIndex + 1]), | ||
| process.cwd(), | ||
| ); | ||
| if (evidence.evidenceState !== 'RESOLVED') | ||
| throw new Error(evidence.reason ?? 'invalid evidence'); | ||
| manualEvidence = resolveManualEvidence(evidenceFile); | ||
| } catch (error) { | ||
| console.error(`[local-lowend] outgoing evidence rejected: ${error.message}`); | ||
| process.exit(1); | ||
| } | ||
| } | ||
|
|
||
| const checks = [ | ||
| ['toolchain', () => runNodeScript('scripts/check-pnpm-toolchain.mjs', ['--hook'])], | ||
| [ | ||
| 'typecheck (single checker)', | ||
| // QNBS-v3: Make the low-end resource contract explicit; tsgo's default checker count is not a safe local default. | ||
| () => | ||
| runLocalBinary('tsgo', ['--project', 'tsconfig.tsgo.json', '--noEmit', '--checkers', '1']), | ||
| ], | ||
| ['i18n key parity', () => runNodeScript('scripts/check-i18n-keys.mjs')], | ||
| ['i18n bundle rebuild', () => runNodeScript('scripts/build-i18n.mjs')], | ||
| ['i18n content guard', () => runNodeScript('scripts/content-guard.mjs')], | ||
| [ | ||
| 'i18n translation quality', | ||
| () => | ||
| const full = fullRequested || manualAdmissionNeedsFullValidation(manualEvidence.rangeResolved); | ||
| const classification = manualEvidence.rangeResolved | ||
| ? classifyChangedFiles(manualEvidence.files) | ||
| : { kind: 'AMBIGUOUS', categories: ['UNKNOWN'], files: [] }; | ||
| const typecheckRequired = requiresTypecheck(classification, { full }); | ||
|
|
||
| console.log(`[local-admission] change class: ${classification.kind}`); | ||
| console.log(`[local-admission] files considered: ${classification.files.length}`); | ||
| if (!manualEvidence.rangeResolved) | ||
| console.log( | ||
| '[local-admission] change evidence incomplete or unresolved; using conservative full admission', | ||
| ); | ||
|
|
||
| if (!ensureDependencyState()) { | ||
| report('Dependency state', 'FAIL'); | ||
| process.exit(1); | ||
| } | ||
| report('Dependency state', 'PASS'); | ||
|
|
||
| runCheck('Toolchain', () => runNodeScript('scripts/check-pnpm-toolchain.mjs', ['--hook'])); | ||
| runCheck('Docs/release truth', () => runNodeScript('scripts/check-doc-metrics.mjs')); | ||
| runCheck('CSP policy', () => runNodeScript('scripts/check-csp-policy.mjs')); | ||
| runCheck('Desktop import boundary', () => | ||
| runNodeScript('scripts/check-tauri-import-boundary.mjs'), | ||
| ); | ||
| runCheck('Native readiness', () => runNodeScript('scripts/check-native-readiness.mjs')); | ||
|
|
||
| if (shouldRunAdmissionCheck('i18n', classification.files) || full) { | ||
|
qnbs marked this conversation as resolved.
|
||
| runCheck('i18n key parity', () => runNodeScript('scripts/check-i18n-keys.mjs')); | ||
| runCheck('i18n bundle rebuild', () => runNodeScript('scripts/build-i18n.mjs')); | ||
| runCheck('i18n translation quality', () => | ||
| runNodeScript('scripts/i18n-quality-report.mjs', [ | ||
| '--strict', | ||
| '--min-coverage', | ||
| '75', | ||
| '--max-length-outliers', | ||
| '8', | ||
| ]), | ||
| ], | ||
| ['release/doc truth', () => runNodeScript('scripts/check-doc-metrics.mjs')], | ||
| ['CSP policy', () => runNodeScript('scripts/check-csp-policy.mjs')], | ||
| ['desktop import boundary', () => runNodeScript('scripts/check-tauri-import-boundary.mjs')], | ||
| ['native readiness', () => runNodeScript('scripts/check-native-readiness.mjs')], | ||
| ]; | ||
| ); | ||
| } | ||
|
|
||
| if (!ensureDependencyState()) process.exit(1); | ||
| if (shouldRunAdmissionCheck('contentGuard', classification.files) || full) | ||
| runCheck('Content guard', () => runNodeScript('scripts/content-guard.mjs')); | ||
|
|
||
| for (const [name, run] of checks) { | ||
| console.log(`[local-lowend] ${name}`); | ||
| const status = run(); | ||
| if (status !== 0) { | ||
| console.error(`[local-lowend] failed: ${name}`); | ||
| process.exit(status); | ||
| if (typecheckRequired) { | ||
|
qnbs marked this conversation as resolved.
|
||
| runCheck('TypeScript (single checker)', () => | ||
| // QNBS-v3: one checker bounds memory use on constrained developer machines. | ||
| runLocalBinary('tsgo', ['--project', 'tsconfig.tsgo.json', '--noEmit', '--checkers', '1']), | ||
| ); | ||
| } else { | ||
| report('TypeScript', 'DEFERRED_TO_REQUIRED_CI', 'no TypeScript-impacting changes detected'); | ||
| } | ||
|
|
||
| console.log('\nLOCAL ADMISSION RESULT'); | ||
| console.log('Local checks completed sequentially.'); | ||
| console.log('Cloud validation required YES'); | ||
| console.log(`Classification ${classification.kind}`); | ||
| } | ||
|
|
||
| console.log('[local-lowend] pre-push checks passed sequentially.'); | ||
| // QNBS-v3: guard execution so this module can be imported for testing without running the CLI. | ||
| if (isMainModule(process.argv[1], import.meta.url)) main(); | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.