chore(harness): monthly /prod-readiness reminder issue - #536
Conversation
Adds `prod-readiness-reminder.yml` — a monthly (cron `0 6 15 * *`) + manual `workflow_dispatch` job that upserts one de-duped `prod-readiness`-labeled issue prompting an attended `/prod-readiness` run. Mirrors `dep-sweep-reminder.yml`. `/prod-readiness` is deliberately NOT auto-run: it is an expensive (~22.8M-token), attended pre-release audit whose report needs human triage and must never loop-re-run. Continuous health is already automated by the CI/nightly gates + the `/rollup` verdict; this reminder is the trigger for the heavyweight LLM audit on top (monthly floor + before each Play release). Mid-month cron so it does not pile onto dep-sweep's day-1 reminder. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CXumbBxgLDJJn659MBnjx5
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Complete
Scope: PR #536 in thomasluizon/orbit-ui-mobile — chore(harness): monthly /prod-readiness reminder issue
Recommendation: APPROVE
| Severity | Count |
|---|---|
| Critical (incl. |
0 |
| High | 0 |
| Medium | 0 |
| Low / Info | 1 |
Code Review: PR #536
Summary: The PR adds one new file, .github/workflows/prod-readiness-reminder.yml (47 lines, additions only) — a monthly cron (0 6 15 * *) + workflow_dispatch job that upserts a de-duped prod-readiness-labeled issue prompting an attended /prod-readiness run. It is a structural, near-verbatim mirror of the already-shipped .github/workflows/dep-sweep-reminder.yml (same actions/github-script@v9 step, same de-dup-by-title logic via listForRepo + .some(), same core.info early return, same least-privilege permissions: issues: write), differing only in label (prod-readiness vs dep-sweep), cron day (15th vs 1st, deliberately offset), and issue copy. The diff touches no apps/, packages/shared, or orbit-api code, so it has no surface for the five gated review subagents (parity, i18n, contract, security, design) — all correctly N/A, matching the PR body's own "Parity contract N/A" claim.
Findings
Critical / High / Medium
None.
Low / Info
[Info] Trigger phrase omitted from the /prod-readiness skill description
· dimension: Correctness (#1) — consistency with the mirrored dep-sweep pattern
· location: .claude/skills/prod-readiness/SKILL.md:3
· issue: The sibling dep-sweep SKILL.md description explicitly states "Use when the monthly 'Dependency sweep' reminder issue fires," letting an agent map a reminder issue to the skill by title pattern. prod-readiness's SKILL.md description has no equivalent clause for the new "Prod-readiness audit — {month}" issue this PR introduces.
· risk: Low — the reminder issue body itself already says "Run /prod-readiness" in bold text, so this isn't a real routing failure, just an asymmetry with the mirrored pattern.
· fix: Optionally append a clause mirroring dep-sweep's to the prod-readiness description. Not blocking.
· reference: pattern parity with .claude/skills/dep-sweep/SKILL.md:3
(Per the rubric's signal gate, Info-level findings are non-blocking and listed for completeness only.)
Subagents
| Agent | Verdict |
|---|---|
| parity-checker | N/A — no apps/web/**/apps/mobile/** changed |
| i18n-syncer | N/A — no user-facing strings / locale files changed |
| contract-aligner | N/A — no packages/shared/src/types/* / DTOs changed |
| security-reviewer | N/A — no orbit-api code changed |
| design-reviewer | N/A — no UI files changed |
Validation
Skipped per the CI adaptation instructions (this PR already runs Build / Unit Tests / SonarCloud as separate required checks); no lint/type/test target applies to a workflow-only YAML change in this repo (no actionlint/yamllint gate exists).
Deferred
Dimensions 8–14 (DESIGN.md/AI-slop, Parity, i18n, Contract drift, Security-API, Backend hard rules, FEATURES.md) are structurally N/A — the single changed file never touches any of their gated surfaces. Nothing was skipped: the one changed file (.github/workflows/prod-readiness-reminder.yml) got a full read and verdict, cross-checked line-by-line against its structural twin dep-sweep-reminder.yml.
What's good
- Faithful, low-risk mirror of an already-proven, running pattern rather than inventing new upsert/de-dup logic.
- Least-privilege
permissions: issues: write; consistentactions/github-script@v9pin (matchesexpo-sdk-watch.yml,dep-sweep-reminder.yml). - Cron deliberately offset from
dep-sweep-reminder's day-1 schedule to avoid pile-up, as the PR states. - Clean on every lint-enforced Orbit rule that could apply to a workflow file: no comments, no
console.log, no dead code.
Recommendation
APPROVE. The sole finding is Info-level and optional polish — no changes required before merge.
|
1 participant
What
Adds
.github/workflows/prod-readiness-reminder.yml— a monthly (cron: 0 6 15 * *) +workflow_dispatchjob that upserts one de-dupedprod-readiness-labeled issue prompting an attended/prod-readinessrun. Mirrors the existingdep-sweep-reminder.ymlverbatim in shape.Why a reminder, not an auto-run
/prod-readinessis an expensive (~22.8M-token), attended pre-release audit that ends in a human GO/NO-GO verdict and whose report needs triage — it must never loop-re-run. Auto-running it on a schedule would burn that budget re-auditing unchanged code and duplicate what the cheap gates already catch. Continuous health is already automated by the CI + nightly gates (test, mutation, visual, perf, commit-sweep, benchmark, landing Lighthouse) and the new/rollupverdict. This reminder is the trigger for the heavyweight audit on top.Cadence
/prod-readinessmanually).the 15th) so it doesn't pile ontodep-sweep-reminder's day-1 reminder.Parity
Web/CI infra — no
apps/mobile/counterpart. Parity contract N/A.🤖 Generated with Claude Code
https://claude.ai/code/session_01CXumbBxgLDJJn659MBnjx5