Repository navigation
ci: combined main-unblock base (#3524 #3525 #3528 #3529 #3548 #3550 #3546 #3535) - #3552
Conversation
Remove SAMPLE_EPCIS_EVENTS and the hardcoded FDA sample CSV. Tenants with no rows now get an empty eventList / header-only CSV, count 0, dataSource 'empty' and a 'No data yet' message. Tests are data-free. Drop the now-stale detect-secrets baseline entries for the sample hashes. Signed-off-by: Christopher Sellers <1@christophersellers.com>
…llision #3475 and #3479 merged back to back and both defined ErrorState. The surviving component lacked requestId/retrying used by #3479 callers, a test mock had a duplicate useQAHealth key, and suppliers/page.tsx used NO_DATA_YET without importing it. Vercel production builds for 03903ee and e7ee4a7 failed type check; prod is still on c7874cb. - ErrorState: optional requestId line, retrying disables Retry and shows Retrying..., support link, className kept on root - drop duplicate useQAHealth mock key - import NO_DATA_YET in suppliers page
…st-empty # Conflicts: # services/ingestion/tests/test_epcis_export_1342.py
…and header-only FDA CSV assertions
… workflows, allowlist false-positive secret, declare visual/capabilities knip entries)
…ection test_ingest_error_logging_2868.py imported _FakePersistence, _FakeSession, _client and _make_shipping_event from test_webhook_router_v2_1342.py, which the real-data-only cleanup removed, so collection failed on main. Drop the ingest-batch route cases that needed a fabricated event, test _failure_diagnostics directly with no payload, and keep the chain-verify case using MagicMock and a local app builder. Remove the stale detect-secrets baseline entry. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
…ply-chain checker
… for #2868 Mint TENANT_ID and KEY_ID with uuid4 at runtime. Re-add a POST /api/v1/webhooks/ingest failure test that uses caplog to check the traceback, tenant_id, event_count, source, error_type and correlation_id, and that the uuid4 canary lot code, product text and location never reach the log. A MagicMock persistence store raises to reach the handler's except block. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
…th test with ErrorState copy
…statuses:' permissions
…dmin DB env Signed-off-by: Christopher Sellers <1@christophersellers.com>
…codex/main-unblock-combined
…nto codex/main-unblock-combined
…x/main-unblock-combined
…es' into codex/main-unblock-combined
…sts' into codex/main-unblock-combined
…x/main-unblock-combined
…st' into codex/main-unblock-combined # Conflicts: # frontend/package.json
… drop SAMPLE_EPCIS_EVENTS expectations Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: c22121d8-2b91-40df-94d2-0580e6f68d20) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…to codex/main-unblock-combined # Conflicts: # scripts/ci/check_supply_chain.py
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: 🟡 Moderate · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check |  |
The description provides a detailed change summary and related PR context, but it does not follow the required template sections for Type of Change, Test Plan, Checklist, and Related Issues. | Rewrite the description using the repository template. Add the required section headings, select applicable Type of Change and Test Plan items, complete the Checklist, and list related issues or PRs in the Related Issues section. |
| Docstring Coverage | |
Docstring coverage is 9.80% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 51 functions across 15 files. (4 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Title check The title clearly identifies the combined CI changes intended to unblock the main branch. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 9.80% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 51 functions across 15 files. (4 skipped: 4 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
✨ Finishing Touches: 💡 2
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
…ow_run events Those events run in the default-branch context, so failed PR verdicts were attributed to main. Keep the failure commit status on the PR head SHA; only fail the job for pull_request events.
…odex/main-unblock-combined
…mp factory-local pypdf floor
…to codex/main-unblock-combined # Conflicts: # .secrets.baseline
github-actions
Bot
added
dependencies
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 919d9579-beff-45ce-a207-547d6ae95ea6) |
…ame, EDI envelope literals, duplicate test name)
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: dfb37cb8-4652-4048-a39b-1344dc95a4ea) |
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
There was a problem hiding this comment.
REVIEW: PASS grok 8ed7c06
Re-review of combined main-fix PR #3552 at 8ed7c06 (delta from my FAIL at 1d3e137). The PR head is unchanged at review time.
Prior findings, all resolved
- 2868 tests depended on run order. Fixed by a dedicated per-test logger fixture (services/ingestion/tests/test_ingest_error_logging_2868.py:123-154: uuid-named stdlib logger, propagate=False, wr.logger monkeypatched, handler removed on teardown). The full serial ingestion suite at the head now passes (exit 0, no failures; xfails are known).
- #3535 head 30cc483 is now an ancestor, via 182a4e4 and merge 28693c2.
- packages/factory-local/requirements.txt:11 now says pypdf>=6.21.2,<7, consistent with requirements.in and both locks.
- Non-merge commits: 30cc483, 182a4e4, e65bea9, 866471d, 8ed7c06. Merge: 28693c2. The net diff covers 10 files, all within the claimed scope.
- 182a4e4 is not only line numbers: it drops the .secrets.baseline entries for services/ingestion/tests/test_epcis_gln_check_digit.py and test_qa4_webhook_inbound.py. That's justified:
detect-secrets scanon both files at this head returns no results. - CodeRabbit fixes:
- .github/workflows/copy-lint.yml:24-25: persist-credentials: false.
- frontend/src/components/ui/error-state.tsx:38: the redundant conditional aria-label is removed, so the accessible name is the visible text.
- test_edi_envelope_integrity.py:143-144: exact envelope asserts.
- tests/scripts/test_check_supply_chain.py:100: the duplicate test name is renamed.
- All sane. The EDI placeholder IDs are out of scope here (Lead is assigning them separately).
Tests (local, serial, py3.12)
- services/ingestion/tests at the head: all pass, including test_ingest_error_logging_2868.py and test_fsma_readiness_compat_2893.py.
- Codex's TestOperatorGate claim is not reproduced. On main 03903ee, with test_ingest_error_logging_2868.py excluded, the 2893 tests pass both in the full run and alone, and they pass at the head too. No run-order problem was observed either way.
- Main's run (2868 excluded) fails in test_edi_envelope_integrity, test_email_ingest_service, test_epcis_export_1342 and test_sel409_session_auth. These are the pre-existing main blockers this PR fixes; all of them pass at the head.
- ruff check and ruff format --check on the 8 changed .py files: clean.
CI (gh pr checks at review time): 82 pass, 6 fail, 4 pending, 13 skipping.
- Failing: Engine Review Pass x3 (waits on a posted PASS review), PR Blocker Checklist x2, and visual-report (non-required).
- Nothing failing is a code or test job.
Posted with C.Lee's approval ("Yes, post it", Oct 23, 2026, 3:44 PM PT).
Combined base PR to break the main CI deadlock (each fix could only go green after the others landed). Built off origin/main with merge commits only (no rebase).
Combines and supersedes:
On top:
tests/visual/**/*.tsandsrc/lib/capabilities.ts, which is unimported for now and allowlisted so the Unused File Guard stops flagging it; JSON has no comments, so this is the note). scripts/ci/check_supply_chain.py kept fix(frontend): restore main build after ErrorState collision (SEL-410/SEL-414) #3524's USES_RE; all tests from both sides pass (101). workflow_inventory.txt merged cleanly.Remaining suite fixes will be folded in as their owners push them (ingestion 2868/1342, receipt_944/email CSV/sel409, RLS, Tenant Isolation, Secrets Audit). All data-free.
Grok reviews this PR; DevOps merges it when CI is green.
Note
Medium Risk
Touches branch-protection guard behavior, dependency CVE floor, and API route manifest counts, but most product changes are error UI and test harnesses rather than new auth or data paths.
Overview
Combined main-unblock PR that lands several interdependent CI and product fixes in one merge.
CI / supply chain: Pins
copy-lintto digest-pinned checkout/setup-node and disables persisted credentials. Head SHA Check Guard still posts commit statuses on PR heads but only fails the workflow job onpull_requestevents (warnings oncheck_suite/workflow_runso default-branch runs are not marked failed). Tightenscheck_supply_chainaction-pin parsing sopermissions.statusesis not mistaken foruses, with matching tests; updates workflow inventory and Vercel preview workflow secret-scan allowlist comments.Frontend: Extends
ErrorStatewith optionalrequestId,retrying(disabled button + “Retrying…”), and a Contact support link; related page/tests and dashboard attention table no longer tie loading to QA status. Supplier dashboard lot-code tile scopes “No data yet” via sharedNO_DATA_YET. Knip allowlists visual Playwright entrypoints andcapabilities.ts.Security / deps: Bumps
pypdfto 6.21.2 (CVE notes) across root and factory-local locks. Route security manifest counts +2 tenant-scoped supplier facility routes (254 enabled ops).Tests (data-free / honest-empty): Rewrites #2868 ingest failure logging tests around structlog JSON and direct
_failure_diagnosticschecks; EPCIS export tests expect real empty payloads (no sample events); EDI 944/945 envelope tests use synthetic X12 instead of removed fixtures; SEL-409 session test sets test env/SQLite; assorted ingestion test stub/signature fixes.Reviewed by Cursor Bugbot for commit 8ed7c06. Bugbot is set up for automated code reviews on this repo. Configure here.