Conversation
Workflows (org reusable callers, shapes copied from template-nextjs-app): - .github/workflows/psd-ci.yml: two jobs calling reusable-psd-ci.yml, one per bun/Hono backend (CloudRunBackend, CloudflareWorker) via the working-directory input. The Swift app (LessonLens/) is not covered — it needs a macOS runner; left as a TODO comment in the workflow. - .github/workflows/claude-review.yml: reusable-claude-review.yml caller with the Dependabot actor guard (dependabot runs cannot grant id-token: write to the called workflow). - .github/workflows/license-check.yml: reusable-license-check.yml caller. Dependabot (.github/dependabot.yml): github-actions weekly at root, npm ecosystem weekly for /CloudRunBackend and /CloudflareWorker (npm ecosystem reads bun.lock), minor/patch updates grouped. Starter tests (repo previously had zero tests; both wired as the standard 'test' script running 'bun test' — no new devDependencies, bun:test is built in): - CloudRunBackend/tests/index.test.ts: exercises the real Hono app fetch handler (health payload values, security headers, JSON 404 with echoed path, 401 on unauthenticated /analyze) plus the exported in-memory rate limiter (allows to limit then blocks, status reflects consumed quota). - CloudflareWorker/tests/index.test.ts: same surface via app.request() with a stub Bindings env (health, security headers, 404, 401). Agent context: new CLAUDE.md (repo map, verified build/test commands, stack, anti-patterns including never weakening CI) and AGENTS.md pointer. Local verification: bun install --frozen-lockfile, bun run build (CloudRunBackend), and bun test pass in both component directories (7 pass / 4 pass, 0 fail).
Org default workflow token is read-only and called reusable workflows cannot elevate beyond the caller's grant, so claude-review (id-token) and OpenWiki (contents/PR write) were silently broken. Defect found by independent Codex review on psd401-prr#115; patched org-wide.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
.github/workflows/psd-ci.yml— org reusable CI caller (reusable-psd-ci.yml@main), two jobs viaworking-directory:CloudRunBackend/andCloudflareWorker/(both bun + Hono). The Swift app (LessonLens/) is not covered: the reusable gate runs on ubuntu and the app needs a macOS/Xcode runner — left as a TODO comment in the workflow..github/workflows/claude-review.yml— reusable caller with the Dependabot actor guard (exact template shape)..github/workflows/license-check.yml— reusable caller (exact template shape)..github/dependabot.yml— github-actions weekly + npm weekly for both backend directories (npm ecosystem readsbun.lock), minor/patch grouped.CLAUDE.md(new, repo had none) — short map: components, verified commands, stack, anti-patterns incl. "never weaken CI".AGENTS.md— one-line pointer.testscripts (bun test, built-in runner, no new devDependencies):CloudRunBackend/tests/index.test.ts— real Hono app via its fetch handler: exact health payload values, security headers, JSON 404 with echoed path, 401 on unauthenticated/analyze; plus the exported rate limiter (allows exactlylimitcalls then blocks; status arithmetic).CloudflareWorker/tests/index.test.ts— same surface viaapp.request()with a stub Bindings env.Starter-test rationale
No tests existed. These assert exact response values and rate-limit counts against the real app object (nothing mocked away), so they fail if the health contract, middleware headers, 404 shape, auth gate, or limiter arithmetic breaks. Paths needing Google OAuth/Gemini/KV credentials are covered only for their unauthenticated rejection branch — honest scope, no tautologies.
Verification evidence
Run locally on this branch:
AI disclosure
Prepared with Claude Code (Fable 5) as part of the Phase 3 wave-2a CI standardization; all workflow shapes copied from
PSD401/template-nextjs-appand tests verified locally as above.Human review + merge required.