ci(live-drift): route failures to a pinned issue and run after migration pushes (#316 phase 0) - #1939
Conversation
…ion pushes (#316 phase 0) Phase 0.1: on failure the workflow now creates or updates an open issue labeled live-drift titled "Live drift check failing" carrying the run URL and the tail of the check:drift output, and closes it with a comment on the next green run — a red scheduled row becomes a visible, assignable object. Phase 0.2: the workflow also triggers on main pushes touching supabase/migrations/**, supabase/schema.sql, or supabase/drift-manifest.json, so drift is detected within minutes of the change that could cause it instead of up to a week later. Job permissions gain issues: write only for the alert steps; the github-script action uses the repository's pinned v9.0.0 SHA. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpjrUp4fYmiDGfc6NBqACX
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpjrUp4fYmiDGfc6NBqACX
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in:38 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:61b53680ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
BigSimmo
commented
Aug 14, 2026
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch claude/live-drift-routing-lnhvja at starting commit ca3cd83; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:claude/live-drift-routing-lnhvja, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Uh oh!
There was an error while loading. Please reload this page.
…be evidence (#316, #231) Fills the 2026-08-14 owner-authorized incident evidence into the live-drift forensics record: Phase 1.1 migration-history fingerprint (20260705180000 executed with 14 statements; the two trigram indexes existed at the 2026-08-04 guard and were dropped by 2026-08-09), Phase 1.3 partial inventory, Phase 4 partial restore (CREATE INDEX CONCURRENTLY, both indisvalid/indisready), and Phase 5 before/after probes (supabase_rpc_latency_ms 31610 -> 1535 text / 8519 hybrid). Carries the PR #1939 review ledger record and queues merge-safe issue updates for #316 and #231. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpjrUp4fYmiDGfc6NBqACX
The routing script merged in #1938/#1939 carries issues: write and had no test, so its create/update/close behaviour would first have been exercised against the real repository. Extracts the embedded github-script body and executes it against stubbed issue APIs, using the same extraction pattern as tests/codex-autofix-workflow.test.ts. Asserts: - a failure with no open issue creates exactly one labelled issue carrying the run URL and the captured findings - a repeat failure updates that same issue and comments, never opening a second - a run that died before the comparison is not presented as a clean schema - a green run comments the resolution and closes with state_reason completed - a green run with no open issue writes nothing at all - an unknown job result is treated as failure, not as a reason to close Also pins the trigger/privilege contract: schedule + dispatch + the migrations-push trigger, never pull_request, cancel-in-progress false, the secret preflight, the pinned github-script SHA, and issues: write appearing exactly once and only inside drift-routing. Verified by mutation: inverting the update-in-place branch, the close-on-green state, and escalating issues: write to workflow level each turn this test red. Registered in test:ci-workflows so a future workflow-scope change runs it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BKNFogaYfCQBvFVqFQnfRt
Four merge-safe inbox requests; docs/outstanding-issues.md is untouched and is reconciled separately after this PR lands. - update #316: Phase 0 closed, including the forced-dispatch proof (run 31813064485 -> auto-created issue #1963). Also supersedes the stale 2026-08-09 drift figures with measured ones: 10 RPC mismatches unchanged, 20 missing indexes, 2 unexpected, and the two trigram indexes confirmed restored. - done #331: its comparison-bug hypothesis is refuted; the staleness was real and wrapping-only, inherited from main by every branch. - update #333: the regeneration half is done here; its real question - the check runs in verify:pr-local but in no CI job - stays open. - update #292: records the #1938/#1939 Phase 0 duplicate against the existing duplicate-work row rather than opening a near-identical new one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BKNFogaYfCQBvFVqFQnfRt
…) (#2044) * docs(db): add coordination handover for multi-chat remediation oversight Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L7umYGe6hbCfq3NmpZ4Gz4 * docs(db): re-baseline the remediation coordination board to main (#316) Carries the coordination handover onto the coordination-chat branch and corrects it against the repository record as of main f5b0932: the tracking anchor is #316 (not #312), Phase 0 is complete (#1938/#1939/#1951/#1978), Phase 1 is partial with 1.2 the only executable next step, Phase 3 is blocked on ten UNCLASSIFIED RPCs, and Phase 4/5 have incident-scope partial evidence. The originating "never executed" verdict is marked superseded by the Phase 1.1 fingerprint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(ledger): record review of the coordination board PR (#2044) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
Summary
docs/database-remediation-plan.md(ledger#316), prompted by a live incident today: production semantic-query retrieval measuredsupabase_rpc_latency_ms=31610(37.7 s total) because the 21 repo-defined indexes are still missing on the live database, while the weekly live-drift check has been silently red since 2026-07-26.live-drifttitled "Live drift check failing", carrying the run URL and the tail of thenpm run check:driftoutput, and closes it with a comment on the next green run. A red scheduled run becomes a visible, assignable object instead of a silent row.mainpushes touchingsupabase/migrations/**,supabase/schema.sql, orsupabase/drift-manifest.json, so drift is checked within minutes of the change that could cause it rather than up to a week later.issues: writeonly (top-level permissions staycontents: read); theactions/github-scriptsteps use the repository's pinned v9.0.0 commit SHA (3a2844b7), mirroring the existingingestion-autopilot.ymlalert pattern.RAG impact: no retrieval behaviour change — CI workflow routing and trigger scope only; no application code, migration content, or retrieval surface is touched.
Verification
npm run check:github-actions→GitHub Actions pin check passed.npm run verify:pr-local→completed: check:runtime, check:installed-lock-parity, format:changed, check:github-actions, check:ci-scope, check:gitleaks-pinned, check:ci-triage, check:pr-policy, check:gate-manifest, check:skills, check:pr-mergeability, check:verification-plan, test:ci-workflows/failed: (none)/not reached: (none).npm run formatrun; tree already clean for this file.eval:retrieval:quality,eval:rag,check:production-readinessnot run: no retrieval, generation, or environment behaviour change — CI-only diff; live drift execution itself remains scheduled/manual/post-merge with existing secrets.Risk and rollout
pushtrigger runs the existing read-only drift comparison against live Supabase after migration-surface pushes tomain— same access and secrets the weekly schedule already uses; no mutation.Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Generated by Claude Code