Skip to content

docs(cursor): two-tier check-all gate (local commit vs push/PR) #1156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FabioLeitao wants to merge 4 commits into
base: main
Choose a base branch
from
+224 −73
Open

docs(cursor): two-tier check-all gate (local commit vs push/PR) #1156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5d98dbd
fix(api): RBAC default-deny with full route map (#1133)
FabioLeitao Jul 3, 2026
8dab6d3
test(api): RBAC route invariant and constant-time API key (#1133 #1134)
FabioLeitao Jul 3, 2026
e197005
fix(security): UTF-8 bytes for rbac API key compare_digest (#1150)
FabioLeitao Jul 3, 2026
22b8b20
docs(cursor): two-tier check-all gate (local commit vs push/PR)
FabioLeitao Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions .cursor/rules/check-all-gate.mdc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,14 @@ alwaysApply: true

# Automation scripts (token-aware)

**Two tiers (do not conflate):** **Local `git commit`** — pre-commit hooks (`uv run pre-commit install` once per clone) plus fast slice checks as needed (`lint-only`, `quick-test`, etc.). **`git push` / PR / merge publish to GitHub** — full **`./scripts/check-all.sh`** or **`.\scripts\check-all.ps1`** (exit 0, same session); prefer **`commit-or-pr.ps1`** and **`pr-merge-when-green.ps1`**. **Do not** use ad-hoc pytest, `lint-only`, or **`-RunTests`** alone as pre-push proof.

**Prefer existing scripts over ad-hoc commands** when it saves tokens or time.

| When | Script | Example |
| ------ | -------- | -------- |
| Full gate (lint + tests) | `.\scripts\check-all.ps1` (Windows) or `./scripts/check-all.sh` (Linux / macOS) | Before commit/PR |
| Quick iterations (tests only) | `.\scripts\check-all.ps1 -SkipPreCommit` or `./scripts/check-all.sh --skip-pre-commit` | After code change |
| Full gate before push/PR to GitHub | `.\scripts\check-all.ps1` (Windows) or `./scripts/check-all.sh` (Linux / macOS) | Before **`git push`**, **`gh pr create`**, or merge publish — not required before every local commit |
| Quick iterations (tests only) | `.\scripts\check-all.ps1 -SkipPreCommit` or `./scripts/check-all.sh --skip-pre-commit` | After code change — re-run full **`check-all`** before push |
| Lint/format only (no pytest) | `.\scripts\lint-only.ps1` or `./scripts/lint-only.sh` | After docs/templates/style change — runs **`pre-commit run --all-files`** (Ruff, plans-stats, plans-hub, markdown, pt-BR, commercial guard, external plan links) |
| Subset of tests | `.\scripts\quick-test.ps1 -Path tests/test_foo.py` or `-Keyword "content_type"` · `./scripts/quick-test.sh --path …` / `--keyword …` | When iterating on one area |
| **`.github/workflows/` YAML edits** | `.\scripts\quick-test.ps1 -Path tests/test_github_workflows.py` · `./scripts/quick-test.sh --path tests/test_github_workflows.py` | Same module runs inside full **`check-all`** / **`ci.yml`** (`uv run pytest`); guards Slack webhook step pattern, Action SHA pins, `ci.yml` lint = **`pre-commit run --all-files`**. See **`docs/TESTING.md`**, **`docs/ops/OPERATOR_NOTIFICATION_CHANNELS.md`** §4.1.1, **ADR 0005**. |
Expand All @@ -22,15 +24,16 @@ alwaysApply: true
| Doc-bundle recovery (post-`cat` / copy mess) | `.\scripts\recovery-doc-bundle-sanity.ps1` (optional `-BundlePath`, `-Headerless`); **loose files in `final_round_bucket`:** `uv run python scripts/build_final_round_bucket_concat.py` (`--map-names`, `--sweep`, `--quiet-gaps`) | Heuristic forensics only — **not** a substitute for `check-all`. Narrative: **`docs/ops/DOC_BUNDLE_RECOVERY_PLAYBOOK.md`**. |
| Day boundary (**carryover-sweep** / **eod-sync**) | `.\scripts\operator-day-ritual.ps1 -Mode Morning` / `-Mode Eod` | Session tokens in **`.cursor/rules/session-mode-keywords.mdc`**; git/gh path hints, not a substitute for `check-all`. |
| PII fresh-clone self-audit (Windows) | `.\scripts\pii-fresh-clone-audit.ps1` (optional `-IncludeTalentGuards`, `-KeepClone`) | Not `check-all`; validates **public** clone + full-history guard; **temp-only** (primary-dev-workstation-safe). See **`docs/ops/PII_FRESH_CLONE_AUDIT.md`**, **`PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**. Session **`pii-fresh-audit`**. |
| **Commit / PR** | `.\scripts\commit-or-pr.ps1` | When user asks to commit, push, or create a PR: use Preview first to see files and propose title/body, then `-Action Commit` or `-Action PR -RunTests`. Prefer `.\scripts\preview-commit.ps1` for preview-only; for PR with multi-line body use a one-off .ps1 that sets `$Title`/`$Body` and calls commit-or-pr.ps1, or `.\scripts\create-pr.ps1 -Title "..." -BodyFilePath path`. |
| **Commit / PR** | `.\scripts\commit-or-pr.ps1` | Local commit: Preview → `-Action Commit`. **Push/PR:** run full **`check-all`** first, then `-Action PR` (do not treat **`-RunTests`** as **`check-all`**). |

**Full workflow (check → pre-commit → commit → describe → safe synced PR)** — use in this order to save tokens and keep one source of truth:
**Full workflow (iterate → commit → check-all → push/PR)** — use in this order to save tokens:

1. **Check + pre-commit:** `.\scripts\check-all.ps1` or `./scripts/check-all.sh` (Ruff, format, markdown, pytest in one run).
1. **While editing:** `lint-only`, `quick-test`, or pre-commit hooks on commit — slice-appropriate; not pre-push proof.
1. **Before `git push` / PR:** `.\scripts\check-all.ps1` or `./scripts/check-all.sh` (exit 0).
1. **Preview:** `.\scripts\preview-commit.ps1` to see files and diff; propose a short title and bullet body.
1. **Commit + describe + PR:** `.\scripts\commit-or-pr.ps1 -Action PR -Title "..." -Body "..." -RunTests` (or `.\scripts\create-pr.ps1 -Title "..." -BodyFilePath path` / one-off .ps1 for long body). This commits, runs tests again, fetch+rebase if behind, push, open PR.
1. **Commit + describe + PR:** `.\scripts\commit-or-pr.ps1 -Action PR -Title "..." -Body "..."` after step 2 passed in the same session.

**Merge-ready slice (operator expectation):** When work is clearly ready to land (tests/docs committed, no open blocker), **run `check-all`**, then merge to `main` and **`git push origin main`** (or open/update PR) **without** asking permission to run the standard gate — the gate is the default safety step, not a decision point.
**Merge-ready slice (operator expectation):** When work is ready to land on GitHub, **run full `check-all`**, then push/open PR or merge — **without** asking permission to run the standard pre-push gate. Local commits between iterations do **not** require full `check-all`.

Avoid raw `pytest`/`ruff` invocations when a script covers the need; scripts keep behaviour consistent and reduce back-and-forth. For **commit, description, push, and PR**, prefer the commit-or-pr workflow (and helpers) over ad-hoc `git add`/`git commit`/`git push` so behaviour is consistent and tokens are saved. See `.cursor/skills/token-aware-automation/SKILL.md` for when to use which.

Expand Down
Loading