fix(scripts): compute nightly-audit 24h window in UTC

[JakubAnderwald]

Closes #511

Summary

scripts/nightly-audit.sh built its "24 hours ago" cutoff in local time. It then compared that cutoff as a string against GitHub's UTC createdAt/mergedAt. On the Mac mini (CET/CEST) the cutoff ran 1–2h ahead of UTC, so the audit silently dropped the first 1–2 hours of its window. That affected support-issue attachment-failure detection and the post-merge main-CI check. Both date branches on the YESTERDAY= line (BSD -v-24H and the GNU -d '24 hours ago' fallback) now pass -u, as the approved plan specified. The suffix-less %Y-%m-%dT%H:%M:%S format is kept. It is a prefix of GitHub's Z-suffixed form, so the jq >= filters needed no change.

Parity report

parity:infra-only: no app platform is affected. The diff stays entirely under scripts/; nothing in apps/** or packages/shared/** changed.

• infra — scripts/nightly-audit.sh (cutoff computation) ✅
• infra — scripts/__tests__/nightly-audit-window.test.mjs (regression guard) ✅

Test plan

• bash -n scripts/nightly-audit.sh: passed
• node --test scripts/__tests__/nightly-audit-window.test.mjs: 3/3 passed
• Mutation check on scratch copies: the new test fails when -u is removed from both branches, only the GNU branch, or only the macOS branch, and when a TZ=UTC prefix replaces -u
• pnpm format:check: passed
• cd scripts && pnpm test: 1691/1694 passed. The 3 failures are in factory-agent-intest.test.mjs → intest_check_lane_outcomes (extracted, real bash). They are the tests that assert a process holding a lane log gets killed (HELD_DEAD expected). They fail the same way on a clean git archive HEAD export of main (d2b0957), so they were already failing in this environment and are not caused by this change. They don't read nightly-audit.sh.
• n/a pnpm migration:check: no schema changes
• n/a pnpm lint / pnpm typecheck: no app or package code touched

Drift vs. approved plan

Only the two files the plan listed were touched. The new test has the text-level checks the plan asked for:

• exactly one YESTERDAY= assignment;
• at least 2 date invocations on it, each carrying a standalone -u;
• every whole-word date on the line is one the parser captured, so a date in an unexpected position fails loudly.

One addition beyond the plan, in the same file: a behavioural check. It runs the real YESTERDAY= line under a non-UTC POSIX TZ (XYZ-05:45, so it doesn't depend on tzdata) and asserts three things:

• the result is UTC now−24h, within 60s;
• it has the %Y-%m-%dT%H:%M:%S shape;
• it compares correctly against GitHub-style Z timestamps at the boundary second.

On CI (ubuntu) this also exercises the GNU fallback branch, which the Mac mini never takes.

🤖 Generated by the dark factory (approved plan)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 45 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: JakubAnderwald/drafto/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4aa4e756-0691-4d45-8d9f-67cac326c4d5

📥 Commits

Reviewing files that changed from the base of the PR and between d2b0957 and 5279025.

📒 Files selected for processing (2)

• scripts/__tests__/nightly-audit-window.test.mjs
• scripts/nightly-audit.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
drafto	Ready	Preview	Sep 18, 2026 9:20pm UTC

[JakubAnderwald]

Factory code review

No findings — the change matches the approved plan and fixes the window correctly.

• Blocking: 0
• Should fix: 0
• Nits: 0

What I checked:

• scripts/nightly-audit.sh:46: both date branches now pass -u. On BSD, date -u -v-24H succeeds. On GNU, -v is rejected, the error goes to /dev/null and the || fallback runs date -u -d '24 hours ago'. $YESTERDAY is only read by the two jq filters (createdAt and mergedAt). The suffix-less cutoff is a strict prefix of GitHub's Z-suffixed timestamps, so >= still includes the boundary second. The local-time uses (LOG_FILE, TODAY, log()) are unchanged, as the spec requires.
• scripts/__tests__/nightly-audit-window.test.mjs:
  • I traced DATE_INVOCATION against the new line. It finds 2 invocations, both containing -u, and bareDates also counts 2, so the parse-completeness guard holds.
  • Dropping -u from either branch fails the test.
  • Splitting the line or adding a third date fails loudly rather than passing trivially.
  • The execution test uses a POSIX TZ offset (XYZ-05:45), so it needs no tzdata and would catch a local-time cutoff by a 5h45m drift. It runs on the Linux scripts-tests job (GNU fallback branch) and on macOS (BSD branch).
• No scope drift, no doc statements invalidated (docs only say Stage 3 keeps its schedule), no apps/ or packages/shared/ changes, consistent with parity:infra-only.

[JakubAnderwald]

CodeRabbit CLI review — 52790250f0ec

The CodeRabbit PR bot did not review this commit, so the factory ran the CodeRabbit CLI on the full PR diff at 52790250f0ec (base d2b0957375f8). Outcome: empty.

Opened 0 inline threads.

_{Automated, unverified vendor findings (CodeRabbit CLI, posted by the Drafto factory).}