Skip to content

fix(ci): stop cancelling main's CI so the base branch is actually verified - #2124

Merged
BigSimmo merged 4 commits into
mainfrom
claude/ci-main-verification-blindspot
Aug 18, 2026
Merged

fix(ci): stop cancelling main's CI so the base branch is actually verified#2124
BigSimmo merged 4 commits into
mainfrom
claude/ci-main-verification-blindspot

Conversation

@BigSimmo

Copy link
Copy Markdown
Owner

Summary

  • concurrency.cancel-in-progress was a blanket true, so every push to main cancelled the previous main run. Measured over the last 30 pushes to main: 23 cancelled (77%), 6 success, 1 failure — the default branch was unverified four times out of five.
  • Supersession is sound for a PR branch, where a newer head genuinely replaces the work in flight. A merged commit has no newer head: cancelling its run skips no redundant work and simply discards the only verification main ever receives. Base-branch pushes are now exempt via cancel-in-progress: ${{ github.event_name != 'push' }}. on.push.branches is [main, "release/**"], so event_name == 'push' is precisely "a base-branch push"; pull requests and merge-queue runs are unchanged.
  • This was not a theoretical gap. Three defects from a single afternoon (2026-08-18) each reached a feature branch as first detection rather than being caught on the branch that introduced them:
  • tests/ci-cache-safety.test.ts pins the exemption and the push-trigger scoping that gives it meaning — widening on.push.branches to feature branches would silently unscope the exemption, so both are asserted in one case.
  • AGENTS.md carried "do not disable cancel-in-progress" as unqualified guidance, which now contradicts the fix. Scoped to pull requests, with the measurement recorded and an explicit note not to simplify the exemption back to a blanket true.

Verification

  • npm run test:ci-workflowsTest Files 15 passed (15) / Tests 326 passed (326)
  • npx vitest run tests/ci-cache-safety.test.tsTests 50 passed (50), re-run green after merging main
  • npm run check:github-actionsGitHub Actions pin check passed.
  • npm run check:ci-scopeCI change scope self-test passed. (Mockup spec parity: 8 advisory specs all match mockupPatterns.)
  • npx prettier --check .All matched files use Prettier code style!

The new contract test was confirmed to fail before it passed: its first version anchored on on:, and the repo's sourceSegment helper rejected it as ambiguous ("start marker occurs more than once … proves nothing about the rest of the file"). Re-anchored on the unique push: marker.

Not run: browser, build, and provider-backed gates. This diff contains no application code — one workflow expression, one test, one documentation passage.

Risk and rollout

  • Risk: low and bounded. The only behavioural change is that a main run is no longer killed by the next merge. Worst case is concurrent main runs, one per merge, each already path-scoped by the changes job — strictly cheaper than a defect landing unnoticed. PR and merge-queue concurrency is untouched, so the cancellation savings this repo relies on for feature branches are preserved.
  • Rollback: revert the commit; the expression returns to true and behaviour is exactly as before.
  • Provider or production effects: None. No application, migration, or deployment code is touched.

Notes

  • Expect main to go red for a while after this lands, and treat that as the fix working. The drift this was hiding is real: desktop /therapy-compass currently measures ~956 ms against a 793 ms baseline captured on 17 Aug, and no therapy-compass code has changed since — the growth came from shared chunks across the ~20 PRs merged in between. Deciding between refreshing the baseline and recovering the 163 ms is a separate, deliberate call that this PR intentionally does not make.
  • Measured on one machine with the pinned Chromium, main itself fails check:lighthouse-budget today (mobile-therapy-compass TBT +53.6%), with no feature-branch code present. That failure exists now; it has simply never been visible on main.
  • The exemption is expressed as github.event_name != 'push' rather than a github.ref comparison so it stays correct for release/** without enumerating branch patterns twice.

Generated by Claude Code

…ified
`concurrency.cancel-in-progress` was a blanket `true`, so every push to main
cancelled the previous main run. Measured over the last 30 pushes to main:
23 cancelled (77%), 6 success, 1 failure — main was unverified four times out
of five.
That is not a cost control, it is a hole in the safety net. Supersession is
sound for a PR branch, where a newer head really does replace the work in
flight. A merged commit has no newer head; cancelling its run skips no
redundant work and simply discards the only verification main ever gets.
Three defects from a single afternoon trace to it, each reaching a feature
branch as first detection instead of the branch that introduced it:
- The Lighthouse baseline drifted ~163ms on desktop /therapy-compass with no
alert, so the next PR to complete a Lighthouse run inherited the drift as
its own "regression" and was blocked by it.
- Two @mockup assertions in ui-tools-search-mode-mockup.spec.ts broke on main
and stayed broken until an unrelated PR surfaced them (repaired by #2115).
- ci-triage could not baseline a single failure, reporting "Compared with main
CI run #12038/#12062/#12087 (cancelled)" three times in one afternoon.
Base-branch pushes are now exempt. `on.push.branches` is [main, release/**],
so `event_name == 'push'` is precisely "a base-branch push"; pull requests and
merge-queue runs keep cancel-in-progress unchanged. The cost is bounded to one
concurrent run per merge, each already path-scoped by the `changes` job.
A blanket `true` reads as harmless and is not, so `tests/ci-cache-safety.test.ts`
pins both the exemption and the push-trigger scoping that gives it its meaning:
widening the push trigger to feature branches would silently unscope it.
AGENTS.md carried "do not disable cancel-in-progress" as unqualified guidance,
which now contradicts the fix; scoped to pull requests, with the measurement and
the reason the exemption must not be simplified away.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@supabase

supabaseBot commented Aug 18, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@coderabbitai

coderabbitaiBot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:47 minutes

Limit details: You’ve used all 1 included review currently available under your plan. You completed 102 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b4934c8e-fb4d-4097-b679-205086ce6e06

📥 Commits

Reviewing files that changed from the base of the PR and between 092633e and 37ecd86.

📒 Files selected for processing (4)
  • .github/workflows/ci.yml
  • AGENTS.md
  • docs/branch-review-records/b1814fea1580f18252cda21f16744ba5373c7933d894c80cba5e425c53430b23.record.md
  • tests/ci-cache-safety.test.ts
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch claude/ci-main-verification-blindspot

Comment @coderabbitai help to get the list of available commands.

@BigSimmo
BigSimmo enabled auto-merge (squash) August 18, 2026 14:14
@BigSimmo
BigSimmo merged commit 53438ae into mainAug 18, 2026
23 checks passed
@BigSimmo
BigSimmo deleted the claude/ci-main-verification-blindspot branch August 18, 2026 14:22
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@BigSimmo@claude