fix(08): resolve remaining Phase 8 CI review findings (WR-02/03/04/05 + IN-01 doc) #7

2026-06-11T19:29:52-04:00

luckberg commented

2026-06-11 19:29:52 -04:00

What

Auto-fix pass over the remaining Phase 8 (Gitea CI) code-review findings, run in an isolated worktree off main (post-#5). WR-01 was already resolved by the publish split (#5); this cleans up the rest.

Fix→re-review loop converged in 2 iterations — all five targeted findings verified RESOLVED, no regressions.

Fixes (5, atomic commits)

ID	File	Fix
WR-02	`ci.yml` (harness)	Upload `playwright-report/` alongside `test-results/` on failure — the HTML report was being built and discarded.
WR-03	`publish.yml`	Fail closed on empty `GITHUB_SHA` (`: "${GITHUB_SHA:?…}"` + `set -euo pipefail`) so it can never emit a malformed `:v1.1-` tag.
WR-04	`publish.yml`	Push the immutable `:<milestone>-<sha>` tag before `:latest`, with fail-fast — a failed push no longer leaves `:latest` advanced without a rollback tag.
WR-05	`publish.yml`	Bind `REGISTRY_PAT` via step `env:` and pipe with `printf %s` instead of template-interpolating the secret into the script body.
IN-01	`0000_baseline.sql`	Comment only — documents the >3072-byte UNIQUE indexes relying on MariaDB 11 long-unique HASH behavior. No schema change (migration is already applied).

Deferred

IN-02 (pnpm lint no-op) — intentionally left for Phase 13 (real ESLint gate is that phase's deliverable).

Verification

Both workflow YAMLs re-validated with yq; re-review confirmed no set -u regressions, correct step-level env: scoping, and no DDL change in the SQL.

## What Auto-fix pass over the remaining Phase 8 (Gitea CI) code-review findings, run in an isolated worktree off `main` (post-#5). WR-01 was already resolved by the publish split (#5); this cleans up the rest. Fix→re-review loop **converged in 2 iterations** — all five targeted findings verified RESOLVED, no regressions. ## Fixes (5, atomic commits) | ID | File | Fix | |----|------|-----| | WR-02 | `ci.yml` (harness) | Upload `playwright-report/` alongside `test-results/` on failure — the HTML report was being built and discarded. | | WR-03 | `publish.yml` | Fail closed on empty `GITHUB_SHA` (`: "${GITHUB_SHA:?…}"` + `set -euo pipefail`) so it can never emit a malformed `:v1.1-` tag. | | WR-04 | `publish.yml` | Push the immutable `:<milestone>-<sha>` tag **before** `:latest`, with fail-fast — a failed push no longer leaves `:latest` advanced without a rollback tag. | | WR-05 | `publish.yml` | Bind `REGISTRY_PAT` via step `env:` and pipe with `printf %s` instead of template-interpolating the secret into the script body. | | IN-01 | `0000_baseline.sql` | **Comment only** — documents the >3072-byte UNIQUE indexes relying on MariaDB 11 long-unique HASH behavior. No schema change (migration is already applied).| ## Deferred - **IN-02** (`pnpm lint` no-op) — intentionally left for **Phase 13** (real ESLint gate is that phase's deliverable). ## Verification Both workflow YAMLs re-validated with `yq`; re-review confirmed no `set -u` regressions, correct step-level `env:` scoping, and no DDL change in the SQL.

luckberg added 6 commits 2026-06-11 19:29:53 -04:00

fix(08-fix): WR-02 upload Playwright HTML report on harness failure 44a9c307e2

fix(08-fix): WR-03 fail closed on empty GITHUB_SHA when computing image tags 6bcf867e6c

fix(08-fix): WR-05 bind REGISTRY_PAT via env: and pipe with printf for docker login 58861d99a8

fix(08-fix): WR-04 push immutable sha tag before :latest with strict shell 4001cd5b90

fix(08-fix): IN-01 document MariaDB-only long-unique HASH index dependency bf091102f2

docs(08-fix): code review + auto-fix report (5 fixed, IN-02 deferred to Phase 13)

CI / fast-checks (pull_request) Successful in 49s

Details

CI / api (pull_request) Successful in 1m3s

Details

CI / harness (pull_request) Successful in 3m27s