fix(ci): stop a comment in tach.toml from truncating a module's deps

[gantoine]

Problem

parseTachModules finds the end of a depends_on list with a non-greedy \[([\s\S]*?)\], so it stops at the first ] in the block. A comment inside the list can carry one. products.review_hog has exactly that:

[[modules]]
path = "products.review_hog"
depends_on = [
    "ee",
    "posthog",
    "products.engineering_analytics",
    "products.signals",
    "products.skills",
    # Facade-only (enforced by stamphog's [[interfaces]] block): the inbox trigger queues
    # hosted Stamphog reviews and registers the toggle resolver hook.
    "products.stamphog",
    "products.tasks",
]

The scan ends inside [[interfaces]], so the parser returns ["engineering_analytics", "signals", "skills"] and drops stamphog and tasks.

It is silent, which is the part that matters. The fail-closed check right below is meant to throw on anything the regexes cannot represent, but it strips # comments before looking, so a list truncated by a comment looks perfectly well-formed.

Two consumers read that graph and both lost the same edges:

• turbo-discover skipped review_hog's test suite when stamphog or tasks changed.
• The Trunk merge queue left py:product:review_hog out of the lane set for those changes, so a stamphog facade rename and a review_hog call site could merge in parallel without ever being tested together. That is the exact conflict the lanes exist to prevent.

Replaying the last 500 merged PRs through the target script, 10 should have claimed py:product:review_hog and did not, all of them touching products/tasks.

Changes

Strip TOML comments before the block scan, tracking double-quoted strings so a # inside one is left alone. With comments gone the non-greedy scan is correct again, and the fail-closed check can go back to seeing the raw list (it no longer needs to strip comments itself, which is what blinded it).

review_hog is the only module affected today. I verified that by diffing the parser's output against a line-based reference parse of the real tach.toml:

before: 1 of 69 modules differs (review_hog: missing stamphog, tasks)
after : 0 of 69 modules differ

After the fix, tachDependents(['stamphog']) returns ['review-hog'] and tachDependents(['tasks']) gains review-hog alongside the nine products it already named.

Note

This only ever adds edges, so both consumers move in the safe direction: more test suites run, more lanes claimed. No product loses coverage.

How did you test this code?

node --test on all three suites that read this parser: turbo-discover-cascade.test.js (11 pass, 1 new), turbo-discover-staleness.test.js (10 pass), trunk-impacted-targets.test.js (36 pass).

The new case covers the regression no existing test caught: a depends_on list whose comment contains ], asserting all three entries survive. Against the current parser it returns only the first entry, so it fails without the fix. The two existing fail-closed tests still pass, which is what keeps the leftover change honest.

I also ran the real tach.toml through both versions and diffed all 69 product modules against an independent line-based parse (numbers above), and replayed the last 500 merged PRs through trunk-impacted-targets.js with each version to get the 10-PR figure.

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

Not applicable. The reasoning lives in the parser's own comments.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Found by Claude (Claude Code) while I had it checking whether the merge-queue lane rules could lean harder on the tach graph (#76481). Before answering that, it validated the graph the rules already trust, comparing parseTachModules output against an independent parse of tach.toml, and this was the one module where they disagreed.

Worth a reviewer's eye: I kept the fix to comment stripping rather than swapping in a real TOML parser. .github/scripts has no dependencies and runs on bare node in CI, and the existing throw-on-anything-unusual contract already covers the shapes a hand-rolled reader cannot represent. A parser would be the right call if these blocks ever grow inline tables.

/writing-tests and /writing-code-comments invoked before the test and comment edits.

[trunk-io]

😎 This pull request was merged.

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
.github/scripts/turbo-discover.js:258
**Count preceding escape characters**

When a valid TOML string closes after an escaped backslash, checking only the immediately preceding character leaves `inString` enabled, so later comments are not stripped and their brackets can truncate dependency lists or trigger unnecessary all-product test runs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(ci): stop a comment in tach.toml fro..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR hardens the .github/scripts tach graph parsing used by CI targeting (Turbo discovery + Trunk merge-queue lanes) so that TOML comments inside depends_on lists can’t silently truncate dependency edges.

Changes:

• Strip TOML # comments (while respecting # inside double-quoted strings) before scanning [[modules]] blocks, preventing early termination on ] inside comments.
• Simplify the “fail-closed” leftover validation now that comments are removed up-front.
• Add a regression test ensuring a depends_on comment containing ] does not drop subsequent dependencies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/scripts/turbo-discover.js	Adds comment stripping before module parsing and adjusts fail-closed validation to prevent silent edge loss.
.github/scripts/turbo-discover-cascade.test.js	Adds a focused regression test covering ] inside comments within a depends_on list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[trunk-io]

This pull request was merged into master as part of stacked PR 76483.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-08-03 16:39 UTC	Run
prod-us	✅ Deployed	2026-08-03 16:54 UTC	Run
prod-eu	✅ Deployed	2026-08-03 16:57 UTC	Run