[mobileskyfi]

Found while closing out the 0.1.8 bump (#6). Roadmap: #30.

Problem

Integration runs 32 and 34 failed on both arches. Both were CHANGELOG stamp commits (f71336c, 41cd4c0). A docs-only push passes ci with build, arm64 and promote skipped, so integration still fires (workflow_run, conclusion success) and installs ghcr.io/tikoci/app-t3code:sha-<stamp commit>, which was never pushed. The container never starts (final: apps=103 ours=1 containers=[null]), and the test waits out its ~21 min budget. The old comment's "so promote ran" was the wrong assumption.

Every stamp hits this, including the 0.1.8-app.188 stamp.

Change

• A small candidate job (actions: read) reads the triggering ci run's promote job conclusion. chr runs only when it is success, and otherwise leaves a notice. Weekly and workflow_dispatch runs have no workflow_run.id, so they always run, as before.
• AGENTS.md test map: integration runs after a ci push that promoted an image.

Checked

• The query against real runs: ci 183 (41cd4c0, docs-only) → skipped; ci 188 (9313be5, 0.1.8) → success.
• make lint-actions clean; bun test test/app-yaml.test.ts 28 pass (runner pin, Bun pin, integration version tests).
• Not yet seen in a real workflow_run: workflow_run uses main's copy of the file, so the first proof is the next docs-only merge after this one.

This changes a workflow, which ci counts as image-relevant, so merging it builds and promotes a new -app.<N> with no user-visible change (no CHANGELOG line).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated integration checks to run after successful image promotion, helping ensure the checks reflect the release-ready build.
  • Updated the integration test documentation to match the revised check timing.

No direct changes to app features or user-facing behavior.

[coderabbitai]

Walkthrough

The integration workflow now checks whether a completed CI run promoted an image before running CHR. The documentation now describes this promotion-based trigger.

Changes: Integration workflow gate

Layer / File(s)	Summary
Determine CHR eligibility .github/workflows/integration.yml	A new candidate job sets test=true when no workflow-run ID exists or the completed CI run’s promote job succeeded. Otherwise, it sets test=false and emits a notice.
Gate CHR and document its trigger .github/workflows/integration.yml, AGENTS.md	The chr job now depends on candidate and runs only when its output is true. The documentation describes the promotion-based trigger.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• Issue 30 describes integration trying to install an image when image promotion did not occur. This change gates CHR on promotion success.

Possibly related PRs

• tikoci/app-t3code#14: Introduced the promote job and the integration workflow trigger that this change now uses to gate CHR.

Suggested reviewers: amm0bot

Merge Risk: Minimal · up to 6ad05

Integration skips CI runs without successful promotion while retaining scheduled and manual runs. No material merge blocker is established.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: skipping integration runs for CI runs that did not promote an image.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[mobileskyfi]

Agent review (Codex gpt-6.1-sol, high) at 6ad056a: nothing to fix. It confirmed the gating for every trigger (a failed or non-push ci skips candidate and so chr; weekly and dispatch runs proceed), that actions: read is enough for the jobs API with no checkout in candidate, that the endpoint defaults to the latest attempt (consistent with the shared sha-<commit> tag), the paginated query against ci 183 → skipped and ci 188 → success, and that an API error fails candidate under bash -e rather than silently skipping. bun test test/app-yaml.test.ts (28) and make lint-actions pass. A live workflow_run is still unverified until the next docs-only merge.

[coderabbitai]

Additional comments: 1

.github/workflows/integration.yml-54-54: 1

54-54: Minor · Functional Correctness · Quick win

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Check the tagging step, not only the promote job.

If main advances before the head check in .github/workflows/ci.yml, the job skips “Tag the candidate as the release” but can still conclude success. This query then enables both CHR runs for a candidate that was not promoted. Require a successful tagging-step conclusion before setting test=true. The jobs API includes step conclusions. (raw.githubusercontent.com)

Review info

Run configuration

• Source mode: Auto
• Repository: tikoci/app-t3code
• Branch: main
• File: .coderabbit.yaml
• Commit: 9313be5
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 78a0465a-8c2d-44b1-a45b-7de99136ba5a

Commits

Reviewing files that changed from the base of the PR and between 9313be5 and 6ad056a.

Files selected for processing: 2

• .github/workflows/integration.yml
• AGENTS.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Review details

Context from checks skipped due to timeout: 1

• GitHub Check: lint-test

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 2

Source excerpt: Workflow actions are pinned to a commit SHA with the release in a comment (`uses: actions/checkout@ # v7.0.1`).

CodeRabbit inference engine (AGENTS.md)

Files:

• .github/workflows/integration.yml

Source excerpt: Image tags track upstream T3 Code stable releases only (no nightlies, but CI accepts any `T3CODE_VER` input).

CodeRabbit inference engine (AGENTS.md)

Files:

• .github/workflows/integration.yml

zizmor (1.31.1)

.github/workflows/integration.yml

[warning] 44-44: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[info] 35-35: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[info] 59-59: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

[mobileskyfi]

@coderabbitai Thanks. Neither item needs a change:

• promote success without tagging (integration.yml:54): testing that case is intended. This workflow installs the commit's own :sha-<commit> (APP_T3CODE_IMAGE), never the release tags. That image was pushed by build and passed the arm64 replacement test before promote ran. When promote skips tagging because main moved on, the image still exists and is still a candidate worth proving. The gate only has to tell "an image exists" from "docs-only, nothing built", and promote = success vs skipped does that. Pinning to :sha-<commit> is how the workflow already ensures a later promotion can't change what it tests (see the comment on APP_T3CODE_IMAGE).
• zizmor undocumented-permissions / anonymous-definition: not among this repo's lint gates (actionlint + ShellCheck). No workflow here comments its permissions blocks, and the job ids are the names. Leaving these as they are.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

Analysis chain

Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- Locate relevant files ---'
fd -HI -t f '^(integration\.yml|ci\.yml|AGENTS\.md|Makefile)$' .
printf '%s\n' '--- integration workflow ---'
ast-grep outline .github/workflows/integration.yml 2>/dev/null || true
cat -n .github/workflows/integration.yml
printf '%s\n' '--- CI workflow structure and relevant jobs ---'
ast-grep outline .github/workflows/ci.yml 2>/dev/null || true
cat -n .github/workflows/ci.yml | sed -n '1,450p'
printf '%s\n' '--- Relevant lint and review guidance ---'
rg -n -C 4 'lint-actions|actionlint|shellcheck|ShellCheck|zizmor|resolv(e|ing).*thread|review thread' AGENTS.md Makefile .github 2>/dev/null || true

Length of output: 30796

---

@mobileskyfi The workflow confirms your explanation. I withdraw the promotion concern: CHR tests the commit-tagged image even if release tagging is skipped. I also accept the decision to leave the two zizmor findings unchanged.

Live workflow_run behavior remains unverified. Check it after the next docs-only merge.

---

Learnings added

Learnt from: mobileskyfi
URL: https://github.com/tikoci/app-t3code/pull/58

Timestamp: 2026-11-11T03:11:41.543Z
Learning: Within repository "tikoci/app-t3code", only for files matching one of [".github/workflows/integration.yml"]: When reviewing the workflow_run candidate gate in .github/workflows/integration.yml, verify that CHR can test the commit-specific :sha-<commit> image after a successful build and arm64 test even if promote skipped release tagging because main advanced. Do not require release tags to have moved in that case.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}