test: skip binary files in the whole-repo marker scan

[trac3r00]

Summary

Speeds up the whole-repo TODO-marker scan test so it stays well under its timeout on the shared pve-ci runner. CI's move to pve-ci itself landed in #957; this branch now merges main and keeps main's ci.yml unchanged.

What changed

• src/utils/todo-markers.test.js skips binary files the way git does (NUL byte in the first 8000 bytes) before decoding, so ~43MB of tracked screenshots are no longer decoded and line-split. Text files, extensionless ones included, are scanned as before. Local runtime: 450ms to 50ms.
• The whole-repo scan gets its own 30s timeout for headroom on the shared runner (it took 8.8s there and failed the 5s default).
• Unit tests for the binary-detection and marker-scanning helpers, including a NUL byte past the sniff window (real file scripts/i18n-backfill.mjs).

Verification

• Locally after merging main: bun run build passed, npx vitest run 723/723 passed.
• CI on this PR runs on pve-ci using main's workflow.

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 2/5

• .github/workflows/ci.yml runs untrusted fork PR code on a self-hosted runner, putting CI infrastructure at risk. Use hosted runners for fork PRs or otherwise prevent untrusted code from reaching self-hosted runners.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/ci.yml">

<violation number="1" location=".github/workflows/ci.yml:21">
P1: Self-hosted runner on `pull_request` trigger exposes CI infrastructure to untrusted code from fork PRs. GitHub's security docs explicitly warn that self-hosted runners should almost never be used for public repositories because any user can open PRs that execute arbitrary code (scripts in `bun install`, `bun run build`, tests) on the runner machine, potentially compromising the host and any secrets or network access it has.

Mitigations if this runner is intentional:
- Restrict self-hosted runner usage to `push` events and PRs from the same repo by adding `if: github.event.pull_request.head.repo.full_name == github.repository` or using `github.event_name != 'pull_request'` on self-hosted jobs.
- Or keep `ubuntu-latest` for the `pull_request` trigger and use the self-hosted runner only for `push` / `workflow_dispatch`.

(Based on your team's feedback about self-hosted runner security.)</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 4/5

• .github/workflows/ci.yml reuses Playwright and Bun cache directories across runs and branches on persistent self-hosted runners, so cached state can carry over between branches. Check that this shared state is safe for the workflow.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/ci.yml">

<violation number="1" location=".github/workflows/ci.yml:21">
P2: On a persistent self-hosted runner the cache directories `~/.cache/ms-playwright` and `~/.bun/install/cache` are shared local state that survives across every run and branch, unlike GitHub-hosted ephemeral runners. The Playwright cache key is only the `@playwright/test` version, so each version bump installs a full new Chromium while old builds stay in `~/.cache/ms-playwright` forever — the disk grows unboundedly over PRs. Add a prune step (e.g. before/after install, remove `~/.cache/ms-playwright` builds other than the current one) or schedule host cleanup.</violation>
</file>

<sub>Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: On a persistent self-hosted runner the cache directories ~/.cache/ms-playwright and ~/.bun/install/cache are shared local state that survives across every run and branch, unlike GitHub-hosted ephemeral runners. The Playwright cache key is only the @playwright/test version, so each version bump installs a full new Chromium while old builds stay in ~/.cache/ms-playwright forever — the disk grows unboundedly over PRs. Add a prune step (e.g. before/after install, remove ~/.cache/ms-playwright builds other than the current one) or schedule host cleanup.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/ci.yml, line 21:

<comment>On a persistent self-hosted runner the cache directories `~/.cache/ms-playwright` and `~/.bun/install/cache` are shared local state that survives across every run and branch, unlike GitHub-hosted ephemeral runners. The Playwright cache key is only the `@playwright/test` version, so each version bump installs a full new Chromium while old builds stay in `~/.cache/ms-playwright` forever — the disk grows unboundedly over PRs. Add a prune step (e.g. before/after install, remove `~/.cache/ms-playwright` builds other than the current one) or schedule host cleanup.</comment>

<file context>
@@ -18,7 +18,7 @@ permissions:
   build:
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, pve-ci]
     timeout-minutes: 10
     steps:
</file context>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve because issues were found.
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

Re-trigger cubic</sub>