chore: production deploy

.gitattributes

@@ -1,5 +1,36 @@
-# pnpm 12 parses patch files with a Rust patch parser that rejects a carriage
-# return in the `---`/`+++` header lines. Git for Windows checks text files out
-# with CRLF by default, which broke `pnpm install` on the Windows release
-# smoke-test. Keep patch files LF everywhere.
+# pnpm 12 briefly had a bug (pnpm/pnpm#14557) where it parsed patch files with a 
+# Rust patch parser that rejects a carriage return in the `---`/`+++` header lines.
+# Git for Windows checks text files out with CRLF by default, which broke
+# `pnpm install` on the Windows release smoke-test.
+# This guarantees that we keep patch files LF everywhere.
 patches/*.patch text eol=lf
+
+# error-tag-stability.unit.test.ts splits this fixture on newlines to diff it
+# against a live-scanned tag set. Pin it to LF so a CRLF checkout on Windows
+# can't leave a trailing `\r` on every entry and make every tag mismatch.
+apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
+
+# Generated artifacts. `linguist-generated` keeps these out of GitHub's language
+# statistics and collapses them in pull request diffs -- they are build output to
+# be regenerated, not code to review, and together they outweigh the hand-written
+# source. The attribute is GitHub-only: git, CI, and local diffs are unaffected.
+# Collapsed is not hidden. v1-openapi.yaml and the lockfiles do carry changes
+# worth reading -- an upstream API change, a dependency substitution -- and both
+# stay one click away in review.
+# Regeneration is owned by `go generate` in apps/cli-go and by the `generate`
+# turbo task, whose `outputs` in turbo.json are the source of truth for this list.
+# Only the generated files are listed, not their hand-written inputs
+# (pkg/api/*.cfg.yaml, api/overlay.yaml). apps/docs/content/docs/commands/ is
+# generated too but gitignored, so it needs no entry.
+apps/cli-go/api/v1-openapi.yaml linguist-generated=true
+apps/cli-go/pkg/api/*.gen.go linguist-generated=true
+packages/api/src/generated/* linguist-generated=true
+packages/api/scripts/openapi-source.json linguist-generated=true
+apps/cli/src/shared/feedback/database.types.ts linguist-generated=true
+apps/docs/public/cli/config.schema.json linguist-generated=true
+apps/docs/public/cli/project-config.schema.json linguist-generated=true
+
+# Lockfiles. Collapsed rather than hidden -- a dependency change is still one
+# click away in review, which is the same treatment GitHub gives package-lock.json.
+pnpm-lock.yaml linguist-generated=true
+apps/cli-go/go.sum linguist-generated=true

.github/MAINTAINERS.md

@@ -51,26 +51,78 @@ issue directly (from the GitHub UI, or from the Linear-linked issue).
 ## `run-ci`: full develop CI on stacked or draft PRs
 
 Ready (non-draft) PRs targeting `develop` already get the default suite: Test
-(check / unit+integration / e2e), preview CLI packages, and PR-title lint.
+(check / unit+integration / e2e) and PR-title lint.
 
 Stacked PRs (base is another PR branch) and drafts do **not** get that suite
 unless they carry the **`run-ci`** label. [`run-ci.yml`](./workflows/run-ci.yml)
-then calls Test and preview-package publish as reusable workflows, including
-while the PR is still a draft.
+then calls Test as a reusable workflow, including while the PR is still a draft.
 
 - Add `run-ci` to start (or resume) the suite; remove it to cancel in-progress
   `run-ci` runs via that workflow's concurrency group.
-- Other labels do not start or cancel Test / preview. PR-title lint may
-  retrigger because that check is cheap.
+- Other labels do not start or cancel Test. PR-title lint may retrigger because
+  that check is cheap.
 - After a stacked PR is retargeted onto `develop`, push or reopen so the
   native required checks (`Check code quality`, etc.) populate. The opt-in
   suite uses different check names (`Test / Check code quality`).
-- This is independent of `run-live-e2e-ci`, which opts into the separate
-  supabox live e2e dispatch.
+- This is independent of `run-preview-packages` and `run-live-e2e-ci`.
 
 The `run-ci` label must exist as a repository label; create it from
 **Issues → Labels** if it is missing.
 
+## `run-preview-packages`: on-demand pkg.pr.new preview
+
+CLI preview packages are large, so they are **not** published on every PR.
+Add the **`run-preview-packages`** label to publish via
+[`publish-preview-cli-packages.yml`](./workflows/publish-preview-cli-packages.yml)
+(any base branch, including drafts). While the label stays on, each subsequent
+push re-publishes; remove it to cancel in-progress runs.
+
+The workflow posts (or updates) a PR comment with an `npx` install command for
+the preview. This is independent of `run-ci` and `run-live-e2e-ci`.
+
+The `run-preview-packages` label must exist as a repository label; create it
+from **Issues → Labels** if it is missing.
+
+## Live e2e coverage and stable releases
+
+[`Live E2E`](./workflows/live-e2e.yml) exercises managed staging after every push
+to `develop`, daily at 06:23 UTC, and on manual dispatch. New `develop` pushes
+cancel superseded push runs; nightly and manual runs execute independently.
+Nightly runs do not depend on a new beta version: they also detect staging
+changes between CLI releases.
+
+Stable publishing requires a passing live suite for the exact release commit.
+The release workflow reuses a verified successful staging run on `develop` for
+that commit when available; otherwise it runs the suite before publishing.
+Normal promotion fast-forwards that commit from `develop` to `main`. The gate
+deliberately queries `develop` runs of `live-e2e.yml`; renaming the workflow
+requires updating that selector. Actions API lookup errors and live-test
+failures block publication. This also applies to
+manual stable releases. Beta publication keeps its existing build and smoke-test
+gates.
+
+Live-test failures and recoveries are sent to the channel configured by
+`SLACK_RELEASE_WEBHOOK`, with commit and workflow links. Routine successful runs
+stay quiet. GitHub Actions logs contain the test failures; notification delivery
+does not determine whether the suite passed.
+
+PR live coverage remains opt-in through `run-live-e2e-ci`. That label dispatches
+the PR commit to the separate Supabox harness, which also has its own nightly
+schedule against pinned submodules. A Supabox result does not replace the
+managed-staging gate for stable publication.
+
+The gate and notifier identify the reusable suite by the `Live e2e` job name (or
+the exact ` / Live e2e` suffix). The gate also checks the `Run live e2e` step
+name. Keep these names aligned with their consumers. Push, scheduled, manual, and stable-gate runs
+use separate concurrency groups because they own independent temporary project
+sets; this is intentional and does not imply a global concurrency quota.
+Notification history inspects at most 25 recent runs of the same workflow and
+branch. It suppresses repeated outcomes and results superseded by a newer run
+or attempt. Recovery requires a known prior failure. History lookup errors
+produce warnings; a confirmed current failure can still be reported if its
+prior outcome is unknown. Release failures use the existing release notification
+to avoid a second failure alert from the live notifier.
+
 ## Deferred: automatic Linear → GitHub label sync
 
 We considered auto-applying `open-for-contribution` when a Linear issue moves out of

.github/actions/setup/action.yml

@@ -75,6 +75,11 @@ runs:
       shell: bash
       env:
         DEPENDENCY_FIREWALL_TOKEN: ${{ inputs.dependency-firewall-token }}
+        # Skip husky's hook install: the commit-msg hook is a local dev
+        # convenience, not a gate for bot-authored commits (e.g.
+        # propose-release-notes.ts), and CI already enforces scopes on the
+        # PR title separately.
+        HUSKY: "0"
       run: |
         if [ -z "$DEPENDENCY_FIREWALL_TOKEN" ]; then
           echo "Dependency Firewall token unavailable; using default npm registry."

.github/dependabot.yml

@@ -11,10 +11,30 @@ updates:
       actions-major:
         patterns:
           - "*"
+        exclude-patterns:
+          - "openai/codex-action"
     ignore:
       - dependency-name: "supabase/setup-cli"
         update-types:
           - "version-update:semver-major"
+      - dependency-name: "openai/codex-action"
+        # NOTE: this ecosystem's `versions` strings are parsed as Ruby
+        # Gem::Requirement (RubyGems comparator syntax), NOT npm-style semver
+        # ranges — "1.12.x" is not a wildcard here, it parses as a literal
+        # (and never-matching) version string, which is why the prior attempt
+        # at this silently failed to block v1.12 (PR #6541, 2026-09-09). Use
+        # real comparators instead.
+        versions:
+          - ">= 1.12, < 1.13"
+        # Deliberately pinned to v1.11 in ai-review.yml — v1.12 has two
+        # confirmed, still-open upstream regressions: a wrapper-level hang
+        # (openai/codex-action#151) and a runner-killing failure
+        # (openai/codex-action#160). A grouped Dependabot bump already
+        # silently reintroduced v1.12 once (PR #6484, 2026-09-07). Scoped to
+        # the 1.12 line (not a blanket ignore) so Dependabot still proposes
+        # v1.13+ once a fix ships; evaluate any such proposal in its own
+        # deliberate PR, checking the upstream changelog/issue tracker first
+        # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
   - package-ecosystem: "gomod"
@@ -24,6 +44,8 @@ updates:
     schedule:
       interval: "cron"
       cronjob: "0 0 * * *"
+    commit-message:
+      prefix: "chore(cli-go): "
     groups:
       go-minor:
         update-types:
@@ -43,9 +65,8 @@ updates:
       interval: "cron"
       cronjob: "0 0 * * *"
     commit-message:
-      prefix: "fix"
-      prefix-development: "chore"
-      include: "scope"
+      prefix: "fix(misc): "
+      prefix-development: "chore(misc): "
     groups:
       npm-major:
         patterns:
@@ -58,7 +79,7 @@ updates:
       interval: "cron"
       cronjob: "0 0 * * *"
     commit-message:
-      prefix: "fix(docker): "
+      prefix: "fix(misc): "
     groups:
       docker-minor:
         update-types:

.github/scripts/ai-review/post-review.test.ts

@@ -25,9 +25,7 @@ import {
   truncateReviewBody,
 } from "./post-review.ts";
 
-// A single hunk touching file.ts lines 10-14 on the new side: line 10 is
-// context, line 11 replaces a removed line, 12 is a pure addition, 13-14 are
-// trailing context. Hand-computed RIGHT-side anchors: {10, 11, 12, 13, 14}.
+// One hunk on file.ts; RIGHT-side anchors: {10, 11, 12, 13, 14}.
 const SINGLE_HUNK_DIFF = `diff --git a/file.ts b/file.ts
 index 111..222 100644
 --- a/file.ts
@@ -41,8 +39,7 @@ index 111..222 100644
  context line 14
 `;
 
-// Two hunks in the same file: {1,2,3} from the first hunk, {20,21,22} from
-// the second (the RIGHT counter resets to each hunk's own header).
+// Two hunks in one file; each resets the RIGHT counter to its own header.
 const MULTI_HUNK_DIFF = `diff --git a/multi.ts b/multi.ts
 index 1..2 100644
 --- a/multi.ts
@@ -101,8 +98,7 @@ index 0..6
 +line three
 `;
 
-// A trailing "\ No newline at end of file" marker on both sides must not
-// perturb the RIGHT counter: anchors are still {1,2}.
+// A trailing "\ No newline at end of file" marker must not perturb the RIGHT counter.
 const NO_NEWLINE_DIFF = `diff --git a/nonewline.ts b/nonewline.ts
 index 7..8 100644
 --- a/nonewline.ts
@@ -115,9 +111,7 @@ index 7..8 100644
 \\ No newline at end of file
 `;
 
-// git appends a literal TAB after a `+++` path that needs quoting (here,
-// because it contains a space); the tab must be stripped so anchors key on
-// "has space.ts", not "has space.ts\t".
+// git appends a literal TAB after a quoted `+++` path; it must be stripped.
 const TAB_PATH_DIFF = `diff --git a/has space.ts b/has space.ts
 index 9..a 100644
 --- a/has space.ts
@@ -127,10 +121,7 @@ index 9..a 100644
 +added line
 `;
 
-// A pure rename (100% similarity) carries no `---`/`+++`/`@@` lines at all,
-// followed by a normal file's diff — the parser must not leak state (e.g. a
-// leftover `currentFile`) from the header-less rename section into the next
-// file.
+// A pure rename carries no `---`/`+++`/`@@` lines; state must not leak into the next file's diff.
 const RENAME_ONLY_THEN_NORMAL_DIFF = `diff --git a/old-name.ts b/new-name.ts
 similarity index 100%
 rename from old-name.ts
@@ -144,10 +135,7 @@ index 1..2 100644
 +added
 `;
 
-// An added line whose literal content is "++ b/not-a-real-header.ts" appears
-// in the diff, prefixed by the diff's own "+", as "+++ b/not-a-real-header.ts"
-// — a `+++`-lookalike that must not hijack `currentFile` because it occurs
-// inside a hunk, not between a `diff --git` boundary and the first `@@`.
+// An added line whose content looks like a `+++` header must not hijack `currentFile`.
 const PLUS_LOOKALIKE_DIFF = `diff --git a/lookalike.ts b/lookalike.ts
 index 1..2 100644
 --- a/lookalike.ts
@@ -828,10 +816,6 @@ describe("buildReviewPayload", () => {
   });
 
   test("truncates the very first payload's body when it already exceeds the cap with zero comments to fold", () => {
-    // Not anchorable (line 999 is outside the diff hunk), so this produces a
-    // body-only payload with no inline comments — the 422-retry fold path
-    // never runs, so only truncating `buildReviewPayload`'s own body catches
-    // an oversized initial POST.
     const finding = makeFinding({ file: "file.ts", line: 999, claim: "x".repeat(70_000) });
     const review = makeMergedReview({ findings: [finding] });
     const payload = buildReviewPayload(review, anchors, footer);
@@ -1045,10 +1029,7 @@ describe("post flow via injected ReviewIo", () => {
         if (opts.failSupersede) {
           return Promise.reject(new Error("listReviews failed"));
         }
-        // Mirror real GitHub: a review posted earlier in the same run shows
-        // up in later listings as a marker-bearing bot review. The supersede
-        // pass must snapshot BEFORE posting or it would wrap the fresh
-        // review as "superseded" too.
+        // Mirrors real GitHub: a review posted earlier in the same run shows up in later listings.
         const alreadyPosted = postedReviews.map((payload, i) => ({
           id: 900 + i,
           body: payload.body,
@@ -1141,9 +1122,6 @@ describe("post flow via injected ReviewIo", () => {
 
     await postConsolidatedReview(io, 42, review, footer);
 
-    // With no prior AI review on the PR, nothing may be wrapped as superseded
-    // — especially not the review this run just posted (which the fake's
-    // listReviews, like real GitHub, includes in post-POST listings).
     expect(postedReviews).toHaveLength(1);
     expect(updatedReviews).toEqual([]);
     expect(updatedComments).toEqual([]);
@@ -1230,8 +1208,6 @@ describe("post flow via injected ReviewIo", () => {
   });
 
   test("posts a truncated body on the very first attempt for an oversized body-only review (no comments to fold)", async () => {
-    // Not anchorable, so there's no inline comment for GitHub to 422 on — the
-    // old behavior threw here instead of posting a truncated body.
     const finding = makeFinding({ file: "file.ts", line: 999, claim: "x".repeat(70_000) });
     const review = makeMergedReview({ findings: [finding] });
     const { io, postedReviews } = makeReviewIo({ diff: SINGLE_HUNK_DIFF });