Skip to content

test(frontend): use forked Vitest workers for stable suite execution - #1647

Draft
seonghobae wants to merge 5 commits into
autoresearch/frontend-sec-bumpfrom
autoresearch/frontend-test-runtime-20260910
Draft

test(frontend): use forked Vitest workers for stable suite execution#1647
seonghobae wants to merge 5 commits into
autoresearch/frontend-sec-bumpfrom
autoresearch/frontend-test-runtime-20260910

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Current authority — 2026-09-10

  • canonical frontend dependency-security parent: #1623@17a7618eda2b212b691f08fa936e042b34258fc9
  • measured direct-develop predecessor: abe5d8cd361c9ab01834fb913baa47817484b629
  • ordinary owner-adoption commit: ffdbba0ee3b570ba76aa30c82aa7915f9d1dba88
  • exact head: 1cc7573909f390473257a0f976b33295a620f263
  • lifecycle: Draft / frontend test-runtime lane / inherited security owner adopted / fresh post-retarget evidence required / do not merge
  • fresh compare over fix(deps): patch frontend audit security floors #1623: ahead 5 / behind 0, exactly two effective files: frontend/vitest.config.ts (+1) and results.tsv (+4).

Measurement and retained experiment

Protected develop@042b0c70 showed a frontend Vitest runtime problem: the default pool exceeded the 300-second full-suite execution budget in repeated measurement. A product-code experiment that removed the DataLayout quality-surface setTimeout(0) was measured and discarded because the named DataPage path regressed to 32.27 seconds.

The retained configuration experiment sets Vitest test.pool = "forks". Its recorded local receipt is 51 files / 437 tests passing in 54.32 seconds, with lint and typecheck passing. No product component, API contract, fixture, dependency, timeout, or assertion is changed by this lane.

results.tsv preserves the baseline/discard/keep sequence rather than presenting only the favorable result. It is measurement evidence, not a product runtime input.

Owner repair

The original direct-develop head inherited a frontend Security Scan failure from the stale dependency tree. That failure is not owned by a test-worker-pool configuration lane. Canonical #1623 owns the patched Next.js/sharp/js-yaml/Vitest versions, generated lockfile/importer contract, and security-floor regressions.

Ordinary two-parent ffdbba0e... preserves the measured predecessor as first-parent provenance, adopts current #1623 as second parent and starts from the exact #1623 tree. 7330b17b... and 1cc75739... then restore only the measured fork-pool configuration and experiment receipt. The branch advanced without force; no dependency/security source is copied into this PR.

Evidence provenance

The current head commit was created at 2026-09-10T13:46:41Z while #1647 still targeted develop. Application CI 34484782076 was admitted at 13:46:47Z; #1647 was retargeted to #1623 afterward, around 13:47:51Z. GitHub now projects that same historical run's pull_requests[0].base as the current feature base. That projection is mutable metadata, not event-time provenance.

Therefore every workflow run admitted before the retarget is stale for the current base/head identity even when its head SHA is identical. Those runs must not be promoted as current stacked-PR evidence. The canary has been handed to canonical .github#2073, which owns event-time (repository, PR, base ref/SHA, head SHA) receipt binding.

The earlier direct-develop runs on abe5d8cd... are also predecessor evidence only. Its Security Scan/CodeQL failures are inherited-owner evidence rather than a reason to change Naruon product or dependency source here, while its Application CI success does not transfer.

Keep Draft until #1623 is protected-integrated or canonical stacked verification produces a post-retarget receipt for this exact base/head identity, the final two-file delta has zero valid unresolved findings, and qualifying post-last-push independent review exists. Do not inflate timeouts, exclude tests, weaken assertions, copy dependency-owner source, create dummy requeues, self-approve, force-push, destructively rebase, transfer stale evidence, or weaken gates.

@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact protected base 042b0c70531b229af3acbd0421a2f23098d848b3 → head abe5d8cd361c9ab01834fb913baa47817484b629. Validate that pool: "forks" addresses the measured Vitest execution/runtime problem without weakening timeouts, assertion scope, isolation, or product behavior, and check whether results.tsv is appropriate durable evidence rather than generated noise.

@seonghobae
seonghobae changed the base branch from develop to autoresearch/frontend-sec-bump September 10, 2026 13:47

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Superseding the predecessor review request after owner restack: review exact base 17a7618eda2b212b691f08fa936e042b34258fc9 → head 1cc7573909f390473257a0f976b33295a620f263. Effective delta is exactly frontend/vitest.config.ts (+1 pool: "forks") and results.tsv (+4 evidence rows). Validate runtime/isolation semantics against #1623's current Vitest dependency contract; predecessor abe5d8cd... review/check evidence does not transfer.

@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="abe5d8cd361c9ab01834fb913baa47817484b629"

git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"

echo "=== exact changed files ==="
git diff --name-status "$base" "$head"
echo "=== exact diff (no external diff drivers) ==="
git -c diff.external= diff --no-ext-diff --unified=80 "$base" "$head"

echo "=== repository instructions ==="
fd -HI -t f '(^|/)(AGENTS|CLAUDE|CONTRIBUTING|README)\.md$|(^|/)coderabbit\.ya?ml$' . \
  -E .git -E node_modules -E dist -E build \
  | sort

echo "=== candidate files ==="
fd -HI -t f '^(vitest\.config\.ts|results\.tsv|package\.json|pnpm-workspace\.yaml)$' . \
  -E .git -E node_modules -E dist -E build \
  | sort

echo "=== frontend Vitest configuration outline ==="
ast-grep outline frontend/vitest.config.ts --items all --view expanded 2>/dev/null || true

echo "=== frontend Vitest configuration ==="
cat -n frontend/vitest.config.ts

echo "=== results evidence ==="
cat -n results.tsv

echo "=== frontend package scripts and Vitest dependency declarations ==="
jq '{scripts, devDependencies: (.devDependencies | with_entries(select(.key | test("vitest|`@vitest`")))), dependencies: (.dependencies | with_entries(select(.key | test("vitest|`@vitest`"))))}' frontend/package.json

echo "=== range commits ==="
git log --format='%H%n%s%n%b%n---' "${base}..${head}"

Length of output: 5687


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="abe5d8cd361c9ab01834fb913baa47817484b629"
discard="1c3c30c1"
keep="a7c2d341"

echo "=== root guidance ==="
cat -n AGENTS.md
echo "=== frontend guidance ==="
cat -n frontend/AGENTS.md
echo "=== contribution guidance relevant to generated artifacts/tests ==="
rg -n -i -C3 'generated|artifact|result|benchmark|experiment|vitest|test' CONTRIBUTING.md README.md frontend/README.md .gitignore .gitattributes 2>/dev/null || true

echo "=== commit availability, parents, and decorations ==="
for commit in "$base" "$discard" "$keep" "$head"; do
  echo "--- $commit ---"
  git show -s --format='fuller%n%D%nP%n%s' "$commit" 2>&1 || true
  git branch -a --contains "$commit" 2>/dev/null || true
done

echo "=== experiment diffs ==="
for commit in "$discard" "$keep"; do
  echo "--- $commit ---"
  git -c diff.external= diff --no-ext-diff show --format=fuller --stat --find-renames "$commit"
  git -c diff.external= diff --no-ext-diff show --format= --unified=40 "$commit"
done

echo "=== history relationship ==="
git merge-base --is-ancestor "$base" "$head" && echo "base is an ancestor of head"
git merge-base --is-ancestor "$keep" "$head" && echo "kept experiment is an ancestor of head"
git merge-base --is-ancestor "$discard" "$head" && echo "discarded experiment is an ancestor of head" || echo "discarded experiment is not an ancestor of head"

echo "=== all Vitest configuration locations and isolation-related settings ==="
rg -n -i -C3 'pool\s*:|poolOptions|isolate|fileParallelism|testTimeout|hookTimeout|teardownTimeout|passWithNoTests' \
  -g '!*node_modules*' -g '!*.lock' .

echo "=== tracked TSV and experiment-result patterns ==="
git ls-files '*.tsv' '*result*' '*benchmark*' | sort

Length of output: 69480


🤖 web_search executed:

Vitest v4.1.11 config pool forks isolate default documentation

Length of output: 11279


🏁 Script executed:

#!/bin/bash
set -u -o pipefail

base="042b0c70531b229af3acbd0421a2f23098d848b3"
head="abe5d8cd361c9ab01834fb913baa47817484b629"
discard="1c3c30c1"
keep="a7c2d341"

echo "=== exact parent and reachability metadata ==="
for commit in "$base" "$discard" "$keep" "$head"; do
  echo "--- ${commit} ---"
  if git rev-parse --verify --quiet "${commit}^{commit}" >/dev/null; then
    git show -s --format='commit=%H%nparents=%P%ndecorations=%D%nsubject=%s%nauthor_date=%aI%ncommit_date=%cI' "$commit"
    git branch -a --contains "$commit" || true
  else
    echo "unavailable in local object database"
  fi
done

echo "=== parent-to-commit diffs for available experiments ==="
for commit in "$keep" "$head"; do
  echo "--- ${commit} ---"
  git -c diff.external= show --no-ext-diff --format='commit=%H%nparents=%P%nsubject=%s' --stat "$commit"
  git -c diff.external= show --no-ext-diff --format= --unified=40 "$commit"
done

echo "=== final-range configuration-related diff check ==="
git -c diff.external= diff --no-ext-diff --name-only "$base" "$head" -- \
  'frontend/**/*.test.*' 'frontend/**/*.spec.*' 'frontend/**/setup.*' 'frontend/package.json' 'frontend/pnpm-workspace.yaml' \
  'frontend/vitest.config.*' 'frontend/src/**/*' ':!frontend/vitest.config.ts'

echo "=== lockfile Vitest references ==="
rg -n -C2 'vitest@4\.1\.11|vitest:|`@vitest/`' pnpm-lock.yaml frontend/pnpm-lock.yaml 2>/dev/null || true

echo "=== tracked evidence documentation references ==="
rg -n -i -C2 'results\.tsv|experiment.*evidence|benchmark.*evidence|durable evidence' \
  AGENTS.md CONTRIBUTING.md README.md frontend/README.md docs 2>/dev/null || true

echo "=== Git attributes and ignore rules for TSV files ==="
git check-attr -a -- results.tsv
git check-ignore -v results.tsv || true

Length of output: 13968


🤖 web_search executed:

site:github.com/vitest-dev/vitest "v4.1.11" "pool" "forks" default

Length of output: 9557


@seonghobae Review complete for exact range 042b0c70531b229af3acbd0421a2f23098d848b3abe5d8cd361c9ab01834fb913baa47817484b629.

Findings

P1 — pool: "forks" is already the Vitest default and cannot explain the measured improvement.
frontend/vitest.config.ts Line 13 adds pool: "forks". The frontend pins Vitest 4.1.11. Vitest changed the default pool to forks in May 2024, before this version. Therefore, the protected base already ran with forks unless an external CLI override supplied another pool.

The explicit configuration is a no-op. It cannot resolve a default-pool execution problem or cause the reported 54.32s result. results.tsv Line 4 also makes this incorrect causal claim. Reproduce the baseline and experiment with the exact command, Node version, CPU limit, environment, and effective Vitest configuration. Then either identify the actual changed execution parameter or remove this change and its unsupported attribution.

P2 — results.tsv is not durable, independently verifiable evidence in its current form.
results.tsv Line 3 references discarded commit 1c3c30c1. That object is unavailable in the repository clone and is not an ancestor of the PR head. The file also stores abbreviated SHAs and omits the exact commands, platform/runtime details, and test-selection inputs needed to reproduce the measurements.

The file is not generated test output. It is a manually maintained evidence record. However, its current contents are incomplete and partly unverifiable. If this evidence must remain in the repository, use full immutable SHAs that are reachable or externally retained, exact commands, Node and package-manager versions, runner resources, and separate metrics for the full suite and named tests.

Scope validation

The exact range changes only:

  • frontend/vitest.config.ts
  • results.tsv

It does not change test timeouts, assertions, test selection, setup files, dependencies, product code, or isolation settings. Vitest documents that the forks pool uses forked child processes and preserves test-file isolation unless isolate is set to false. This PR does not disable isolation.

flowchart LR
  A["Vitest 4.1.11 base"] --> B["Default pool: forks"]
  B --> C["Explicit pool: forks"]
  C --> D["No effective pool change"]
  D --> E["Runtime attribution is unsupported"]
  E --> F["Reproduce with effective configuration and environment evidence"]
Loading

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@codex review

Review current exact base 17a7618eda2b212b691f08fa936e042b34258fc9 → head 1cc7573909f390473257a0f976b33295a620f263. Effective delta is only Vitest pool: "forks" plus the experiment receipt. Check whether the worker-pool choice preserves isolation, timeout/assertion semantics, and current #1623 dependency behavior. Treat all pre-retarget workflow evidence as stale for this base identity.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='17a7618eda2b212b691f08fa936e042b34258fc9'
head='1cc7573909f390473257a0f976b33295a620f263'

printf '%s\n' '== Commit availability and exact comparison =='
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --find-renames --find-copies --no-ext-diff "$base" "$head" -- frontend/vitest.config.ts results.tsv

printf '%s\n' '== Head Vitest configuration outline and content =='
ast-grep outline frontend/vitest.config.ts --items all || true
cat -n frontend/vitest.config.ts

printf '%s\n' '== Evidence file =='
cat -n results.tsv

printf '%s\n' '== Frontend dependency manifests =='
fd -a -t f '^(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|npm-shrinkwrap\.json)$' . \
  | sed -n '1,160p'

printf '%s\n' '== Vitest declarations and resolved lockfile entries =='
rg -n -i -C 3 '"vitest"|"`@vitest/`' \
  -g 'package.json' \
  -g 'package-lock.json' \
  -g 'pnpm-lock.yaml' \
  -g 'yarn.lock' \
  -g 'npm-shrinkwrap.json' \
  -g '!node_modules/**' \
  .

printf '%s\n' '== Test scripts and Vitest invocation configuration =='
rg -n -C 3 '"(test|test:[^"]+)"\s*:' -g 'package.json' -g '!node_modules/**' .
rg -n -C 3 '\bvitest\b|pool\s*:' -g '!node_modules/**' -g '!results.tsv' .

Length of output: 75148


🤖 web_search executed:

Vitest 4.1 documentation test.pool "forks" isolation configuration

Length of output: 11626


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/naruon'
head='1cc7573909f390473257a0f976b33295a620f263'

printf '%s\n' '== Pull request state and target =='
gh pr view 1647 --repo "$repo" --json number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,mergeStateStatus,statusCheckRollup,url

printf '%s\n' '== Exact-head combined commit status =='
gh api "repos/${repo}/commits/${head}/status"

printf '%s\n' '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | {name,status,conclusion,started_at,completed_at,details_url,app:.app.slug}'

printf '%s\n' '== Exact comparison ancestry =='
git merge-base --is-ancestor 17a7618eda2b212b691f08fa936e042b34258fc9 1cc7573909f390473257a0f976b33295a620f263 \
  && echo 'base-is-ancestor-of-head: yes'
git rev-list --left-right --count 17a7618eda2b212b691f08fa936e042b34258fc9...1cc7573909f390473257a0f976b33295a620f263

Length of output: 26509


@seonghobae

I found one blocking issue.

  • frontend/vitest.config.ts Line 13 explicitly sets pool: "forks".
  • The inherited dependency contract pins Vitest to 4.1.11.
  • Vitest v4 documents forks as the default pool. It preserves per-test-file isolation through forked child processes. Therefore, this setting does not change the current pool behavior or explain a runtime improvement on this dependency version. See the Vitest v4 performance documentation.
  • The stated measurement needs the Vitest version, invocation, platform, and worker settings. Without these fields, results.tsv cannot show that the retained run differs from the current v4.1.11 default.

results.tsv is concise measurement history. It is not generated noise. However, it is not sufficient as evidence that this exact-head configuration changes runtime behavior.

The exact comparison is correct: five commits ahead, zero behind, with only the two stated files changed. The diff does not weaken timeouts, assertions, exclusions, test isolation, product behavior, or the dependency contract.

Exact-head frontend CI was still in progress when I checked. Fresh executable evidence remains required.

You are interacting with an AI system.

@seonghobae seonghobae added bug Something isn't working priority: high High-priority or P1 work labels Sep 12, 2026 — with ChatGPT Codex Connector
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working priority: high High-priority or P1 work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant