Harden CI dispatch input and align Caring Contacts robots metadata - #2439
Conversation
Bind github.event.inputs.refresh_lighthouse_baseline through step env and quote it in the classify-changed-files run script instead of interpolating GitHub context into the shell. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Use PRIVATE_APP_ROBOTS_METADATA so the route emits the same noindex extras as the root layout instead of a narrower child override. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Warning Review limit reachedNext included review available in 23 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 102 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
Comment |
This pull request has been ignored for the connected project Preview Branches by Supabase. |
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_8a61cacc-3d36-419f-9b83-03639eb24c58) |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_a557684a-ddcc-4baf-a980-5285d5fb4544) |
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #14362 (failure). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_306320a3-d1c7-4f45-9c4d-920d10db1973) |
Uh oh!
There was an error while loading. Please reload this page.
Summary
envand quote it in the classify-changed-filesrun:script, so GitHub context is no longer interpolated into a shell.PRIVATE_APP_ROBOTS_METADATAobject so that route emits the same noindex extras as the root layout instead of a narrower child override.These are two independently revertible commits from the Audit cluster follow-up. Distroless Dockerfile hits, Apiiro obfuscation false positives, and non-bug React residuals were left unchanged.
Verification
npm run verify:pr-localPR-local verification summary:completedcheck:runtime,check:installed-lock-parity,format:changed,check:github-actions,check:ci-scope,check:gitleaks-pinned,check:ci-triage,check:pr-policy,check:gate-manifest,check:skills,check:pr-mergeability,check:verification-plan,lint,typecheck,test,check:repo-awareness-snapshot,build,check:rag:fixtures,check:medication-interactions,check:medication-lexicon-report;failed: (none).Fresh unit suite (before receipt reuse):
Test Files 893 passed (893)/Tests 10824 passed | 1 skipped (10825). Final handoff reused that receipt:[gate-receipts] REUSED — "vitest" already exited 0 on this exact content. Production build:✓ Compiled successfully in 36.1sandClient bundle secret surface check passed.Offline RAG:Offline RAG fixture and manifest validation passed (36 golden cases, 26 suites).Iteration also ran
GATE_RECEIPTS=off node scripts/run-vitest.mjs run --reporter=dot tests/ci-cache-safety.test.ts tests/crawler-policy.test.ts—Test Files 2 passed (2)/Tests 59 passed (59).npm run test:focusedcorrectly fail-closed because the test files themselves changed.Demo
GET /caring-contactsonhttp://localhost:4461(project identityclinical-kb:c52ddf65534b) now emits a single pair of robots tags matching root:noindex, nofollow, nocacheand googlebotnoindex, nofollow, nosnippet, noimageindex. Title remainsCaring Contacts - Clinical KB.npm run verify:uiwhen UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changedUI verification not run: Caring Contacts change is route metadata only (robots object swap). No chrome, layout, styling, or interaction behaviour changed.
npm run verify:releasebefore release or handoff confidence claimsVerification not run:
verify:releaseis provider-backed and not authorized for this change.npm run eval:retrieval:quality(must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changed — CI cannot run it (needs live keys), so run it locally and paste the summary. A metadata/governance-weighting change once buried correct docs (recall 1.0→0.76) and only this eval caught it.Verification not run: no retrieval, ranking, selection, chunking, or scoring behaviour changed.
npm run eval:rag -- --limit 15+npm run eval:quality -- --rag-onlywhen answer generation, the synthesis prompt, or answer post-processing changed (grounded-supported must not drop; citation-failure 0)Verification not run: no answer-generation change.
npm run check:production-readinesswhen clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changedVerification not run: no clinical workflow, privacy, environment, Supabase, source governance, or deployment behaviour changed.
npm run check:deployment-readinesswhen deployment startup, hosting, or rollout behavior changedVerification not run: no deployment startup, hosting, or rollout behaviour changed.
Adversarial security review of the CI env bind found no remaining injection, and empty/false/true dispatch semantics stay equivalent to the previous quoted comparison.
Risk and rollout
trueas a Lighthouse refresh; off-dispatch the env value is empty and the quoted comparison is false, matching the previous blank interpolation. Job-levelif:expressions that already readgithub.event.inputs.refresh_lighthouse_baselineare unchanged. Caring Contacts remains noindexed; the child metadata now matches the private-app extras (nocache, Googlebotnoimageindex/nosnippet) instead of emitting a narrower duplicate.{ index: false, follow: false }robots object.psychiatry.toolscalls. The workflow change affects GitHub Actions classification only after merge.Clinical Governance Preflight
Not required. This PR does not touch ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.
Notes
Mixed operational (
.github/workflows/ci.yml) and UI (src/app/caring-contacts/layout.tsx) files are bundled because both are tiny audit follow-ups; they remain separately revertible commits. No public XML sitemap and no search-engine submission.