chore(deps): bump actions/checkout from 4 to 7 - #93
Merged
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Uh oh!
There was an error while loading. Please reload this page.
BigSimmo pushed a commit
that referenced
this pull request
Jul 28, 2026
Both duplicate-root failures reproduce in a full local verify:ui against an isolated production build and pass in isolation, which makes the condition load/order-dependent rather than build-mode dependent. Also corrects an earlier note claiming CI runs next dev. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Akwz3Sdms8uJ5AkDt3CduY
BigSimmo pushed a commit
that referenced
this pull request
Jul 28, 2026
…uction UI run ui-overlap.spec.ts:199 passed toHaveCount(1) and then resolved the same header#search locator to 2 elements one statement later, one hidden. A duplicate appearing after a passing count assertion is a stream or hydration artifact by construction, which rules out a static double mount and rules out this branch's CSS and component changes as a cause. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Akwz3Sdms8uJ5AkDt3CduY
4 tasks
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
All three are cases where the gate could pass while proving nothing, which is what these gates exist to prevent. 1. `check-lighthouse-budget` returned exit 0 on an empty report directory. When every Lighthouse invocation fails (Chrome cannot launch, say) the runner still called the grader, and an enforced run reported success having measured nothing. A `--require-reports` flag now makes an empty directory fatal, and the runner always passes it because it owns the directory and has just attempted every route. Standalone `check:lighthouse-budget` keeps the check:bundle-budget behaviour — no build output is not a verdict — so both callers stay correct. Verified: exit 0 without the flag, exit 1 with it. 2. `ui-visual-baseline` selected the region with a bare `.first()`. Under ledger #93 the stream can leave a hidden duplicate page root BEFORE the visible one, so `.first()` could pin both the assertion and the screenshot to the hidden clone — the exact artifact this suite avoids by clipping rather than capturing fullPage. Now selects `:visible`, matching ui-accessibility.spec.ts. 3. `run-lighthouse-budget` recreated the report directory without clearing it, so a rerun under `--keep` could grade a previous run's JSON as current evidence, or bake it into a refreshed baseline. It now clears the directory it owns first. Also: server readiness accepted any HTTP 200 body from /api/local-project-id. If another service took the port between the availability probe and Next binding it, Lighthouse would measure the wrong application. Readiness now verifies appName, projectId and safeLocalOrigin the way scripts/playwright-base-url.ts does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ
BigSimmo added a commit
that referenced
this pull request
Jul 30, 2026
…ed (#1405) * fix(mode-nav): size slots to their content so labels stop being clipped Ledger #113. `ModeNav` promises a slot shows its real word or folds into More, and it broke that promise at every phone width. The two lower bands used `grid-auto-columns: 1fr`, so the WIDEST slot set what every slot got, and the label's `truncate` hid the shortfall — nothing overflowed, nothing failed, the word was simply gone. Measured in Chromium before changing anything: 320px showed 15 of Compare's 56px, 390px showed 39, and 430px was WORSE at three of four labels clipped, because crossing a band adds a slot to the same space. The bar got less legible as the screen got wider. Only the widest band was clean — the one that already sized slots to their content. So that branch is now the only branch. `display: flex` at every band means no track can be narrower than its own label, which removes the failure mode rather than retuning it, and deletes a layout mode rather than adding one. It is also what the author already chose for wide screens: "slots size to their content and sit left, so the bar reads as a continuation of the header". Thresholds are re-derived from measured intrinsic widths (Search 92.4, Compare 144.3, Recommend 125.6, Pathways 108.5, More ~77, plus the bar's 8px padding) rather than the previous budget, which was ~80px short — about the size of the count badge nobody counted. 16rem -> 21rem for three slots, 26rem -> 31rem for four, 34rem -> 40rem for five. A fixed `rem` threshold still cannot prove fit for an arbitrary item list, and `ModeNav` is shared. `tests/ui-mode-nav-density.spec.ts` holds that gap: at both band boundaries and one pixel either side, every rendered label must be fully visible and the bar must not overflow. A mode with longer labels now fails CI instead of shipping clipped words. Registered in BOTH Playwright allowlists — `testMatch` and `productionSpecPattern` — because a spec missing from either silently never runs. The spec scopes to the nav inside the collapse host rather than the bare test id. That is not incidental: streaming can resolve the id to two elements (ledger #93), and the density decision is a container query that only means anything once the portal has placed the bar in the container it lives in. Verified against the pre-fix CSS with the new spec in place — 6 of 7 red, reporting e.g. `336px: "Compare" needs 56px, has 21px`. verify:cheap exit 0 — Test Files 432 passed (432), Tests 4450 passed | 4 skipped. Chromium, all Therapy/ModeNav journeys — 18 passed (56.7s). Text zoom now behaves as the `rem` mechanism claims: a 390px phone at a 32px root is 12.19rem and falls back to the collapsed control instead of clipping. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P * fix(mode-nav): give the thresholds cross-environment font headroom CI caught what my local measurement could not: at 496px the boundary case failed by exactly one pixel — `"Compare" needs 59px, has 58px`. Locally the same label measured 56px. The variable face rasterises wider on the runner, so thresholds calibrated to one machine's font metrics are calibrated to nothing. Raised to 22 / 33 / 42rem, roughly 8% over the measured intrinsic widths rather than the pixel or two a single box suggests, so the bands clear the whole spread of environments instead of the one I happened to measure in. This is the same failure the boundary tests exist to catch, so they did their job on the first CI run rather than letting a one-pixel clip ship — the tests at 351/352/353 and 527/528/529 are deliberately the least forgiving place to assert, and that is the point of putting them there. Chromium, tests/ui-mode-nav-density.spec.ts — 7 passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P --------- Co-authored-by: Claude <noreply@anthropic.com>
BigSimmo pushed a commit
that referenced
this pull request
Jul 30, 2026
Appearance and client performance were the two verification surfaces with no gate. `playwright.visual.config.ts` and `test:e2e:visual` existed but pointed at a spec that only attaches screenshots for a human to eyeball, and Lighthouse only ran against the deployed origin, after a merge had already auto-deployed. Style contracts (required, deterministic). `tests/ui-style-contract.spec.ts` asserts rendered computed style for the unlayered class rules in globals.css — the rules that exist to beat a Tailwind utility and go inert if moved into a layer. That is ledger #94: the search band's accent rail shipped inert while its test asserted `toHaveClass("search-band")`, the cause rather than the effect. jsdom cannot catch it (no cascade layers) and check:design-system-contract cannot either (it reads source text). Where a rule has an attribute-scoped variant, the contract also proves the variant wins the cascade. `tests/style-contract-registry.test.ts` closes the inventory: all 38 unlayered visual classes must carry a contract or a reasoned exemption, so the next one cannot be added unnoticed. The single existing rail assertion was a one-off with nothing forcing a successor. Pixel baselines (advisory). `tests/ui-visual-baseline.spec.ts` compares clipped locator screenshots against committed per-platform baselines. Never fullPage (#93 — Next.js leaves a hidden duplicate page root under CI load), demo mode only for stable content, motion off. No baselines are committed yet; the first CI run's artifact supplies them, and the job is continue-on-error until they have held across a few runs. Performance budget (advisory). `verify:lighthouse` builds and serves an isolated production app in demo mode, measures the budgeted routes, and grades relative to a committed baseline with per-metric tolerances — absolute web-vitals thresholds are meaningless against localhost. Reuses the fail-closed primitives in summarise-web-vitals.mjs, so incomplete evidence always fails regardless of `enforce`. Shares one pinned Lighthouse version with the live-domain workflow, guarded by a test. Component state matrix (#107). `tests/source-preview-popover.dom.test.tsx` covers a zero-coverage document-access surface: placement flip, hidden-until- measured, focus entry, and listener release on close and unmount. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ
BigSimmo added a commit
that referenced
this pull request
Jul 30, 2026
…t did (#1427) * test(phone-scroll): prove the drag delivered before asserting the chrome hid CI run 30518866604 failed `ui-phone-scroll.spec.ts:423` on expect(getByTestId('universal-header-collapse')) .toHaveAttribute('data-scroll-hidden', 'true') // received "" after the full 10s auto-retry, and the classifier recorded it as "needs investigation". The assertion was right; the scroll never happened. `dragScrollBy` moved the scroller with `scrollTop +=`, which clamps silently at the end of the range, and returned nothing. When a page lays out shorter than the test assumed — content still settling under full-suite CI load — a 720px request delivers a fraction of that, the chrome correctly stays visible because document-detail chrome only hides past `scrollTop > 120`, and the failure surfaces ten seconds later looking like a product regression. The helper also resolved the scroll owner once up front, so a mid-drag layout change left it pushing an element that had stopped scrolling. - `dragScrollBy` now re-resolves the owner each step and returns the distance actually travelled. - `dragScrollUntilHidden` waits for the remaining downward runway (a condition wait, not a settle sleep), drags, and fails naming the shortfall if the drag could not cross the threshold. Used at the four sites that assert a hide immediately after a fixed-distance drag. - `addPhoneScrollRunway` waits for its 1600px filler to reach layout instead of sleeping 50ms. All 14 call sites already depend on that runway existing. Every assertion is byte-identical: a genuinely stuck header still fails exactly as before, once the drag is proven to have happened. No `.first()` was added (#93's stop rule) and no tolerance was relaxed. * ci: shard Production UI across three runners Measured on 2026-07-30 from the Actions API, two full UI-scope PR runs (30520443076, 30519912667): `Production UI` took 15m26-16m31 of a 16.8-18.6 minute run — 83-89% of wall clock — while every other job finished by minute 4 and then waited. Playwright itself reported `339 passed (13.5m)`; the balance is the isolated production build. That single job is also where the churn cost lands: 42% of PR runs in the sampled window were cancelled (25 of 60 completed), almost all superseded mid-Production-UI. Sharding is across runners, not workers. `workers: 1`, `fullyParallel: false` and `retries: 0` are unchanged inside each shard, so determinism is identical and per-runner load falls — which matters because #93's duplicate page root is load-dependent. `run-playwright.mjs` already forwards argv to `playwright test`, so `--shard` needed no runner change. The shard count is measured, not chosen. `fullyParallel: false` makes a spec file indivisible, so shard sizes are lumpy and more shards is not monotonically faster. Over the 340 required chromium tests: N=3 -> 121/106/113 largest 121 N=4 -> 121/106/96/17 largest 121 (same critical path, one more runner) N=6 -> 65/56/106/5/91/17 largest 106 N=5 -> 121/106/0/96/17 and N=8 -> two empty shards N=4 buys nothing over N=3, and any N with an empty shard would go red because `test:e2e:pr` deliberately omits `--pass-with-no-tests`. Expected critical path ~15.5 -> ~7 min, assuming per-test cost is roughly uniform. `fail-fast: false` so a failing shard cannot cancel its siblings and re-create the cancelled-vs-failed ambiguity #95 removed. Artifact names are shard-scoped because upload-artifact runs with `overwrite: false`. Branch protection requires only the `pr-required` aggregate, and `needs` on a matrix job yields the roll-up of all shards, so the aggregate is unchanged. Also adds `restore-keys` to both Playwright browser caches: without a prefix fallback a lockfile bump forced a cold browser download in every UI job at once, now three times over. * ci: bound the codex auto-resolve jobs and serialise the visual config Two inconsistencies found while mapping the pipeline, neither load-bearing but both silent: - `codex-autofix-review-comments.yml` was the only workflow in the repo with no `timeout-minutes` on either job, so both inherited GitHub's 360-minute default for work that reads PR metadata and posts one comment. - `playwright.visual.config.ts` set neither `workers` nor `fullyParallel`, so it inherited Playwright's default `workers = 50% of CPUs`. The production config pins both to serial deliberately; the visual lane was quietly opting out of the anti-flake posture the rest of the suite is configured for. * chore(gates): pin the documented gate count to the real chain Both numbers were wrong. `CLAUDE.md` said 24 static/consistency gates against an actual 25 — `check:assets` landed before that line was written, so it was wrong at authoring — and the `gates` skill said "check 2 of 26" against an actual 28. A stale count is not cosmetic here. The skill's whole point at that line is that `verify:cheap` stops at the first failure and everything after it never ran; an agent that believes the chain is 26 long cannot say how much a mid-chain failure skipped. `check:gate-manifest` already derives the real count from `verify:cheap:internal`, so it now asserts the documented numbers against it. The assertions fail closed: if the anchor phrasing disappears, the guard reports a lost anchor rather than passing on a document it no longer checks. Mutation-proven: reverting the skill to "26" fails with ".claude/skills/gates/SKILL.md says 26 where the chain has 28". * docs(issues): capture the CI review's deferred findings Five items from the CI/testing review that should not be changed blind: - #125 `ui_changed` matches all of `src/app`, so an API-only diff pays the 15-minute UI gate. Narrowing it can hide a real regression, so it needs a decision plus a compensating check rather than a quieter filter. - #126 the Playwright build writes to a per-run distDir, so Next's build cache is cold every run (~2 min, now ~29% of the sharded critical path). Fixing it means suppressing the runner's documented always-cleanup, which must not ship without executing the runner. - #127 the advisory UI lane spends ~3 min per UI PR on 5 mockup tests; there are currently zero `@quarantine` tests for it to cover. - #128 CI Triage is complete and self-tested but inert pending a repo variable. - #129 four `changes` outputs are computed and consumed by nothing, and `coverage_changed` fires on any non-doc file. * docs(ledger): record the ci-testing-review pass at this HEAD * ci: re-measure the shard split on the merged tree and refresh stale gate counts The merge changed both numbers this branch had recorded. Shard balance, re-measured against 342 required chromium tests (was 340): N=3 -> 121/111/110 largest 121 N=4 -> 121/106/98/17 largest 121 N=3 remains correct — one 121-test spec group bounds both, so N=4 spends an extra runner for the same critical path. The re-measure command is now in the workflow comment so the next person does not have to rediscover it. Gate counts: merging main added `check:gitleaks-pinned` and `check:pr-mergeability` to `verify:cheap:internal`, so the documented counts went stale the moment the merge landed — 25 -> 27 static, 28 -> 30 total. The guard added earlier in this branch caught it immediately rather than letting the docs drift again, which is the whole reason it exists. Also records the `ui-critical-fast` interaction: the UI critical path is now that 15-test fail-fast job plus the slowest shard, not the full 13.5-minute suite, so neither of this branch's pre-merge timings can be read on its own. * docs(issues): rebuild the ledger after a union-merge duplication The `merge=union` driver on `docs/outstanding-issues.md` preserves concurrent appends, but when both sides restructure the same region it concatenates them wholesale. Merging the latest main did exactly that: every open row appeared twice and both `issues:next-id` markers survived — 66 duplicate-id errors from `check:outstanding-issues`, which is precisely the failure that gate exists to catch (#112). Resolved by rebuilding on main's canonical file rather than by hand-editing the duplicated table: reset to `origin/main`, then re-apply this branch's five captured rows at #131-#135 (main had advanced its allocation to #130 while this branch was open, so the earlier #128-#132 numbering collided again) and re-apply the #127 narrowing note. Marker bumped to 136. Union merge cannot allocate unique ids; only the structural gate can catch when it has produced an invalid file. It did. * ci: record the measured shard result, correcting the predicted one First real run of the sharded shape (CI 30530618838, all green, whole run 13m39 against a 16.8-18.6 min unsharded baseline): ui-critical-fast 15 tests 3m14 Production UI (1) 121 tests 9m36 Production UI (2) 111 tests 6m54 Production UI (3) 110 tests 6m20 The prediction was wrong by ~40%. ~6.8 min was expected for the largest shard from 121/342 tests x 13.5 min; 9m36 happened. Per-test cost is not uniform — 111 tests took 6m54 while 121 took 9m36 — so a count-balanced split understates the slowest shard whenever the slow specs land in one group. `--shard` can only balance by count; balancing by duration would mean splitting the slow spec files themselves. The win is real but smaller than claimed, and the workflow comment and process-hardening now carry the measured numbers plus the reason the arithmetic misleads, so the next person re-measures instead of re-deriving. Also merges origin/main. The ledger conflict was GitHub-visible only: that file carries merge=union locally, which GitHub does not honour (#129). Resolved by keeping the one genuinely new record and dropping three that main already had elsewhere in the file — append-only forbids dropping a record that exists once, not keeping a second copy. Superseding record appended for this HEAD, since the prior one asserted a root cause that #127's trace evidence refutes. * docs(issues): renumber this branch's rows above main's concurrent allocation CI caught what I did not: `static-pr` failed on `check:outstanding-issues` with #131-#134 duplicated and two `issues:next-id` markers. Cause: main's PR #1424 allocated #131-#134 for its own findings at the same time this branch held #131-#135, and `merge=union` did what union does — kept both sides under the same ids. That is #112's documented limit: union preserves concurrent appends but cannot allocate unique ids, so the structural gate is the only thing that catches it. My error was pushing without re-running that gate. The previous push resolved a `docs/branch-review-ledger.md` conflict, and I validated only that file before pushing to win the race against main — but the same merge also touched `docs/outstanding-issues.md`. `verify:cheap` would have caught it locally. Main's rows keep #131-#134 (already merged and referenced elsewhere); this branch's five renumber to #136-#140, one marker at 141, and the cold-cache cross-reference in process-hardening follows its row. Two of main's new rows also make a planned addition here redundant: #134 is the absent ledger merge driver and #133 is the outstanding-issues merge churn — both hit during this branch's work, both already captured upstream, so nothing new is filed for them. * docs(issues): rebuild against main's current id allocation The union merge duplicated the whole open and archive tables again (two header rows, every id twice) because main restructured the file while this branch held rows in it. Same resolution as before and for the same reason: rebuild on main's canonical file rather than hand-editing a doubled table, then re-apply this branch's five rows. Main is now at next-id=135, so they land as #135-#139 with the marker at 140. None of the five is duplicated upstream — checked by summary before re-applying. This is the third renumber of the same five rows in one PR. That is not a mistake being repeated, it is #133 ("outstanding-issues conflicts on nearly every main advance") happening: any branch that holds rows in this file re-collides every time main lands one. Worth weighing whether captures should land in their own PR ahead of the work rather than riding along with it. * docs: record PR 1427 review --------- Co-authored-by: Claude <noreply@anthropic.com>
BigSimmo added a commit
that referenced
this pull request
Jul 31, 2026
cursorBot
pushed a commit
that referenced
this pull request
Aug 8, 2026
Production UI shard 2 failed on PR #1729 because `getByTestId('dsm-home-main')` resolved to two elements under Next streaming (ledger #93 strict-mode flake). Scope page-root testids in `tests/ui-route-coverage.spec.ts` through `visibleByTestId`, and add an offline contract so bare page-root getByTestId cannot return there. Also revert adoption surfaces to `baseline.status: not-committed`. Declaring them committed activated `validateCandidateSourceBinding`'s allowlist freeze against `candidateSourceHead`, so any later non-allowlisted edit (including this e2e hardening, and any future product change after merge) fails design-system-adoption. PNGs, empty AWAITING_BASELINE, and provenance remain; Playwright still compares because the goldens exist on disk. Flipping to committed belongs with a contract that does not freeze the whole tree after capture. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursorBot
pushed a commit
that referenced
this pull request
Aug 9, 2026
Complete the prescribing smoke back-link assertion (aria-label form on phone too), floor the icon-only phone back control with min-w-tap, and scope form-detail-header through visibleByTestId for #93 duplicates. Add offline contracts so a half-patched smoke or bare testid cannot regress the same red required CI. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)df4cb1cUpdate changelog for v6.0.3 (#2446)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)