Skip to content

Fix CAP-001 (ci) + RWX dispatch trigger - #76

Merged
yakimoto merged 1 commit into
mainfrom
feat/rwx-dispatch
Sep 15, 2026
Merged

yakimoto merged 1 commit into
mainfrom
feat/rwx-dispatch

Conversation

@yakimoto

@yakimoto yakimoto commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

User description

Un-reddens main (capabilities.json missed the ci command from #75; proven by RWX run 7c0d0fd3 which fails only on this assertion). Adds dormant wave-cli-verify dispatch trigger (typecheck+vitest, read-only).


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.


Note

Low Risk
Manifest and read-only CI dispatch config only; no runtime CLI or auth changes.

Overview
Restores CAP-001 compliance by adding the missing ci subcommand to capabilities.json, aligning the manifest with the wave ci command already registered in the CLI (fixes the subcommand parity test that was failing on main).

Adds a dormant RWX ad-hoc dispatch workflow (.rwx/dispatch.yml) with trigger wave-cli-verify: clones the repo at a chosen SHA, installs Node 22.23.2, and runs npm ci, type-check, and vitest—intended to exercise the wave-ci / rwx-dispatch path without changing push CI. Optional environment is passed through as DISPATCH_ENV for labeling only.

Reviewed by Cursor Bugbot for commit b8661fe. Bugbot is set up for automated code reviews on this repo. Configure here.


CodeAnt-AI Description

Register the CI command and add an on-demand CLI verification workflow

What Changed

  • The ci command is now included in the published CLI capability list
  • An on-demand verification run can clone a selected commit, install Node.js, run type checks, and execute the test suite
  • Verification runs accept an optional environment label without affecting push-based CI or deployments

Impact

✅ CI command appears in capability discovery
✅ On-demand type and test verification
✅ Safer read-only validation without deployments

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because your workspace is out of credits. Ask your workspace admin to add credits to resume reviews. Manage billing

@codeant-ai

codeant-ai Bot commented Sep 15, 2026

Copy link
Copy Markdown

🤖 CodeAnt AI — Review Status

Status Commit Started (UTC) Finished (UTC)
✅ Reviewed your PR b8661fe Sep 15, 2026 · 19:07 19:08

@codeant-ai

codeant-ai Bot commented Sep 15, 2026

Copy link
Copy Markdown

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@sourcery-ai

sourcery-ai Bot commented Sep 15, 2026

Copy link
Copy Markdown

Reviewer's Guide

Restores the missing ci capability in the manifest and adds an explicitly dispatched RWX verification workflow that checks out the target commit and runs type-checking plus Vitest without deployment or push-CI side effects.

Sequence diagram for the dormant RWX verification dispatch

sequenceDiagram
    actor Dispatcher
    participant RWX
    participant Checkout
    participant Node
    participant Verify

    Dispatcher->>RWX: dispatch wave-cli-verify
    RWX->>Checkout: git/clone 2.1.0
    RWX->>Node: nodejs/install 1.2.0
    RWX->>Verify: npm ci --no-audit --no-fund
    Verify->>Verify: npm run type-check
    Verify->>Verify: npx vitest run
Loading

File-Level Changes

Change Details Files
Restore the missing CI capability declaration so the main branch capability assertion passes.
  • Add the ci command to the capabilities manifest.
  • Align the manifest with the capability introduced by the earlier change.
capabilities.json
Add a dormant RWX dispatch workflow for read-only repository verification.
  • Define the wave-cli-verify dispatch trigger with an optional environment label.
  • Pin the workflow to the dispatched commit and use the trial environment by default.
  • Clone the repository, install Node.js 22.23.2, and run dependency installation, type-checking, and Vitest.
  • Keep the trigger separate from push CI so it runs only when explicitly dispatched.
.rwx/dispatch.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@coderabbitai

coderabbitai Bot commented Sep 15, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 008e9d42-d4a0-41c3-95b9-1e760013d148

📥 Commits

Reviewing files that changed from the base of the PR and between cbb9e14 and b8661fe.

📒 Files selected for processing (2)
  • .rwx/dispatch.yml
  • capabilities.json

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (8)
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: cubic · AI code reviewer
  • GitHub Check: Cursor Approval Agent: Pull Request Router and Approver
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: Cursor Bugbot
  • GitHub Check: Macroscope - Approvability Check
  • GitHub Check: Macroscope - Approvability Check
  • GitHub Check: Cursor Security Agent: Security Reviewer
🔇 Additional comments (2)
capabilities.json (1)

27-27: LGTM!

.rwx/dispatch.yml (1)

18-18: 🔒 Security & Privacy | 🛡️ Analyzed with Security Review

Restrict the dispatch environment.

Line 18 maps the free-form event.dispatch.params.environment value to init.environment. If RWX environments provide different secrets, runners, or permissions, a caller could select a privileged environment while executing an untrusted ref through npm ci or Vitest. Use a fixed trial environment or validate the value against an allowlist of non-privileged environments.


📝 Summary

Summary by CodeRabbit

  • New Features
    • Added support for the ci subcommand in the Wave CLI capabilities list.
  • Chores
    • Added an optional dispatch workflow for running dependency checks, type validation, and tests against a selected environment.

Walkthrough

The change exposes the ci Wave CLI subcommand and adds a dormant RWX dispatch workflow. The workflow clones the triggering commit, installs Node.js 22.23.2, and runs dependency installation, type checking, and Vitest with DISPATCH_ENV.

Changes

CLI CI dispatch verification

Layer / File(s) Summary
Expose CI capability
capabilities.json
The wave CLI capabilities list now includes the ci subcommand.
Run RWX verification
.rwx/dispatch.yml
The RWX configuration defines the wave-cli-verify dispatch parameter, initializes from the triggering commit, configures Ubuntu 24.04 with rwx/base 1.2.0, installs Node.js 22.23.2, and runs dependency installation, type checking, and Vitest with DISPATCH_ENV.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant RWX dispatch
  participant Wave CLI repository
  participant Wave CLI verification
  RWX dispatch->>Wave CLI repository: Clone the triggering commit
  RWX dispatch->>Wave CLI verification: Set up Node.js 22.23.2
  RWX dispatch->>Wave CLI verification: Run dependency installation, type checking, and Vitest with DISPATCH_ENV
Loading

Merge Risk: ⚪ Minimal · up to b8661

The new CI capability and dormant verification dispatch have no confirmed merge-blocking issue.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies both main changes: registering the CI capability and adding the RWX dispatch trigger.
Description check ✅ Passed The description accurately explains the missing ci capability entry and the dormant, read-only RWX verification workflow.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/rwx-dispatch
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch feat/rwx-dispatch

Comment @coderabbitai help to get the list of available commands.

@codeant-ai codeant-ai Bot added the size:M This PR changes 30-99 lines, ignoring generated files label Sep 15, 2026
@gitar-bot

gitar-bot Bot commented Sep 15, 2026

Copy link
Copy Markdown

Note

Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom.
Learn more

Code Review ✅ Approved

Restores CAP-001 compliance by adding the missing ci subcommand to capabilities.json, and adds a dormant RWX ad-hoc dispatch workflow for wave-cli-verify. No issues found.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Gitar

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 2 files

Confidence score: 3/5

  • In .rwx/dispatch.yml, the RWX base environment may omit dev dependencies, causing tsc to be unavailable and allowing npx to fetch an unpinned Vitest, so the advertised checks may not run reliably — use npm ci --include=dev --no-audit --no-fund.
  • In .rwx/dispatch.yml, the dispatched environment is exported only as unused DISPATCH_ENV, so run titles will not identify the target environment — add a dispatch-level title that includes it.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".rwx/dispatch.yml">

<violation number="1" location=".rwx/dispatch.yml:40">
P2: If the RWX base environment omits dev dependencies, this install cannot run the advertised checks reliably: `tsc` is missing and `npx` may fetch an unpinned Vitest. Use `npm ci --include=dev --no-audit --no-fund` so type-check and tests always use the locked dev toolchain.</violation>

<violation number="2" location=".rwx/dispatch.yml:44">
P3: Dispatching an `environment` value does not put it in the run title: this mapping only exports it as unused `DISPATCH_ENV`, and the dispatch trigger defines no `title`. Add a dispatch-level `title: wave-cli-verify (${{ init.environment }})` and remove or consume the unused environment export.</violation>
</file>
Architecture diagram
sequenceDiagram
    participant DevOps as CI/CD Pipeline
    participant RWX as RWX Dispatch System
    participant WF as wave-cli-verify Workflow
    participant GH as GitHub Actions
    participant Repo as wave-av/cli Repo
    participant NPM as npm Registry
    participant CLI as CLI Capability System

    Note over DevOps,RWX: Ad-hoc Dispatch Trigger (dormant until invoked)
    
    DevOps->>RWX: Trigger wave-cli-verify dispatch
    RWX->>WF: Initialize workflow with event params
    WF->>WF: Extract commit SHA + environment label
    
    Note over WF,Repo: Read-only verification pipeline
    
    WF->>GH: git/clone task
    GH->>Repo: Clone repository at specified SHA
    Repo-->>GH: Source code checkout
    GH-->>WF: Code artifact ready
    
    WF->>GH: nodejs/install task
    GH->>GH: Install Node.js 22.23.2
    GH-->>WF: Node runtime ready
    
    WF->>GH: verify task (npm ci)
    GH->>NPM: Fetch dependencies
    NPM-->>GH: Package lock installed
    GH->>GH: Run type-check script
    GH->>GH: Execute vitest suite
    
    alt Verification succeeds
        GH-->>WF: All checks passed
        WF-->>RWX: Success status + DISPATCH_ENV label
    else Verification fails
        GH-->>WF: Test/type error
        WF-->>RWX: Failure status + logs
    end
    
    Note over CLI,Repo: Capability registration check
    
    DevOps->>CLI: Query capabilities manifest
    CLI->>CLI: Validate registered subcommands
    CLI-->>DevOps: Capability list includes 'ci' command
    DevOps-->>CLI: Subcommand parity confirmed
Loading

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread .rwx/dispatch.yml
- key: verify
use: [code, node]
run: |
npm ci --no-audit --no-fund

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: If the RWX base environment omits dev dependencies, this install cannot run the advertised checks reliably: tsc is missing and npx may fetch an unpinned Vitest. Use npm ci --include=dev --no-audit --no-fund so type-check and tests always use the locked dev toolchain.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .rwx/dispatch.yml, line 40:

<comment>If the RWX base environment omits dev dependencies, this install cannot run the advertised checks reliably: `tsc` is missing and `npx` may fetch an unpinned Vitest. Use `npm ci --include=dev --no-audit --no-fund` so type-check and tests always use the locked dev toolchain.</comment>

<file context>
@@ -0,0 +1,44 @@
+  - key: verify
+    use: [code, node]
+    run: |
+      npm ci --no-audit --no-fund
+      npm run type-check
+      npx vitest run
</file context>
Suggested change
npm ci --no-audit --no-fund
npm ci --include=dev --no-audit --no-fund

Comment thread .rwx/dispatch.yml
npm run type-check
npx vitest run
env:
DISPATCH_ENV: ${{ init.environment }}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: Dispatching an environment value does not put it in the run title: this mapping only exports it as unused DISPATCH_ENV, and the dispatch trigger defines no title. Add a dispatch-level title: wave-cli-verify (${{ init.environment }}) and remove or consume the unused environment export.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .rwx/dispatch.yml, line 44:

<comment>Dispatching an `environment` value does not put it in the run title: this mapping only exports it as unused `DISPATCH_ENV`, and the dispatch trigger defines no `title`. Add a dispatch-level `title: wave-cli-verify (${{ init.environment }})` and remove or consume the unused environment export.</comment>

<file context>
@@ -0,0 +1,44 @@
+      npm run type-check
+      npx vitest run
+    env:
+      DISPATCH_ENV: ${{ init.environment }}
</file context>

@macroscopeapp

macroscopeapp Bot commented Sep 15, 2026

Copy link
Copy Markdown

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR adds a dormant, read-only RWX verification workflow and corrects capability metadata without changing the CLI's customer request path. Human review is warranted because unresolved comments identify potentially unreliable dev-tool installation and a mismatch between the advertised run-title labeling and the actual configuration.

Not approved because:

  • Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.

@yakimoto
yakimoto merged commit 30b78b6 into main Sep 15, 2026
26 of 51 checks passed
@yakimoto
yakimoto deleted the feat/rwx-dispatch branch September 15, 2026 20:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M This PR changes 30-99 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant