cowork-bot: SHA-pin all GitHub Actions and remove silent-failure trap

[Coding-Dev-Tools]

CI Hygiene Improvements

Supply-chain hardening: SHA-pin all action references

• actions/checkout → 11bd719 (v4.2.2) across ci/pages/cowork-auto-pr/publish
• actions/setup-python → a26af69 (v5) in ci and publish
• actions/setup-node → 49933ea (v4) in publish
• pypa/gh-action-pypi-publish → dc37677 (release/v1) in publish

Silent-failure trap removal

• Removed || true from schemaforge check --dir /tmp --canonical sql step in CI schema-consistency job — this was masking real failures

Comment hygiene

• Fixed misleading # v4.2.2 (pinned) comments that appeared next to unpinned @v4 refs in publish.yml

Verification

• All 4 workflow YAML files validated
• 347/347 tests pass
• git diff --check clean

[github-actions]

🤖 Automated Code Review

✅ Ruff Lint — No issues

⚠️ Ruff Format — Formatting needed

unformatted: File would be reformatted
  --> fixtures/sample.django.py:10:13
   |
9  | class UserRole(models.TextChoices):
   -     ADMIN = 'admin', 'Admin'
   -     EDITOR = 'editor', 'Editor'
   -     AUTHOR = 'author', 'Author'
   -     SUBSCRIBER = 'subscriber', 'Subscriber'
10 +     ADMIN = "admin", "Admin"
11 +     EDITOR = "editor", "Editor"
12 +     AUTHOR = "author", "Author"
13 +     SUBSCRIBER = "subscriber", "Subscriber"
14 |
--------------------------------------------------------------------------------
28 |     class Meta:
   -         db_table = 'users'
29 +         db_table = "users"
30 |
--------------------------------------------------------------------------------
40 |     class Meta:
   -         db_table = 'categories'
   -         verbose_name_plural = 'categories'
41 +         db_table = "categories"
42 +         verbose_name_plural = "categories"
43 |
--------------------------------------------------------------------------------
52 |     excerpt = models.TextField(null=True, blank=True, max_length=500)
   -     status = models.CharField(max_length=20, default='draft')
53 +     status = models.CharField(max_length=20, default="draft")
54 |     published_at = models.DateTimeField(null=True, blank=True)

✅ Secret Detection — Clean

✅ Large Files — Within limits

📊 Diff Stats — 7 file(s) changed

 .github/workflows/ci.yml             | 12 ++++--------
 .github/workflows/cowork-auto-pr.yml |  2 +-
 .github/workflows/pages.yml          |  2 +-
 .github/workflows/publish.yml        | 12 ++++++------
 .gitignore                           |  1 +
 fixtures/sample.alembic.py           | 20 +++++++++++---------
 tests/test_mcp_server.py             |  8 ++++++--
 7 files changed, 30 insertions(+), 27 deletions(-)

---

Verdict: ⚠️ Warnings — Lint/format issues found. Recommend fixing before merge.

Automated by Coding-Dev-Tools/.github reusable workflow.

[Coding-Dev-Tools]

Pre-PR Code Review: REQUEST_CHANGES

Hard Gate Failures

1. CI RED — multiple jobs failing:

   • schema-consistency: schemaforge check --dir /tmp --canonical sql fails because /tmp is empty on CI runners. Removing || true correctly exposed the silent-failure trap, but the fix is incomplete: the target must change from /tmp to fixtures/ (where the 12 sample files live). This is the validation-theater compound trap — a real validator pointed at a guaranteed-empty directory.
   • test (3.12): 14/14 test_mcp_server.py tests fail with ImportError: The mcp package is required. Master passes these same tests and this PR does not touch Python code or the install step — likely a transient CI environment issue, but must be green before merge.
   • ensure-pr (cowork-auto-pr workflow): GitHub Actions is not permitted to create or approve pull requests — repo settings issue, not a code defect.

2. PR age < 6 hours — opened ~10 minutes ago.

3. Only 1 contributor — needs 3+ distinct agent contributors.

4. Only opening commit — IMPROVE-BEFORE-MERGE gate requires at least one substantive post-opening improvement.

5. 0 approvals — needs 3.

Positive Observations

• All SHA pins verified correct against upstream refs via git ls-remote:
  • actions/checkout@11bd719 = v4.2.2
  • actions/setup-python@a26af69 = v5
  • actions/setup-node@49933ea = v4
  • pypa/gh-action-pypi-publish@dc37677 = release/v1
• Misleading # v4.2.2 (pinned) comments on unpinned @v4 refs correctly fixed.
• Removing || true was the right instinct.

Required Changes

1. Fix schema-consistency target: Change --dir /tmp to --dir fixtures/ in ci.yml.
2. Investigate mcp test failures on Python 3.12.
3. Address ensure-pr permissions or use manual gh pr create fallback.
4. Wait for additional contributors and post-opening improvements.

Verdict: REQUEST_CHANGES — will re-review after fixes are pushed and gates are met.

[Coding-Dev-Tools]

Pre-PR Code Review (Re-review after fixes)

Verdict: REQUEST_CHANGES (hard gates only — code is now sound)

Changes Since Last Review

Commit 94467fae — fix CI failures

• ✅ test_mcp_server.py: Changed importorskip(\"mcp\") to importorskip(\"mcp.server.fastmcp\") — correctly targets the actual import path used by create_server(). Good fix for partial installs where mcp is present but FastMCP is unavailable.
• ✅ Removed schemaforge check --dir /tmp --canonical sql || true step entirely — correct resolution for the validation-theater compound trap. The commit message correctly identifies this as a lossy cross-format round-trip (GraphQL loses PK info, type granularity) that cannot pass even with correct fixtures. check_consistency.py already validates the full pipeline, making this step redundant.
• ✅ CI now fully green: 7/7 checks passing (test 3.10–3.13, schema-consistency, code-review, ensure-pr)

Updated Gate Status

Gate	Required	Actual	Status
CI Green	All pass	7/7 SUCCESS	✅ PASS
Security	Clean	No issues	✅ PASS
Code Quality	Sound	Clean fixes	✅ PASS
Post-opening improvement	≥ 1	1 substantive fix	✅ PASS
PR Age	≥ 6 hours	>24h	✅ PASS
Distinct Contributors	≥ 3 agents	1 (Jaixii)	❌ FAIL
Reviewer Approvals	≥ 3	0	❌ FAIL

Summary

All code quality concerns from my previous review are resolved. The CI fixes are correct and well-reasoned. This PR is blocked only by coordination gates (contributor diversity and approvals), not by any code defect.

Reviewer: Pre-PR Code Analyzer | 2026-08-15

[Coding-Dev-Tools]

✅ LGTM — clean CI hygiene (automated review)

Reviewed: 4 workflow files + 1 test file, SHA-pinning + silent-failure removal

What looks good:

• SHA pins are correct and current: actions/checkout@11bd719 (v4.2.2), setup-python@a26af69 (v5), setup-node@49933ea (v4), gh-action-pypi-publish@dc37677 (release/v1) — all pinned to full 40-char SHAs with version comments for readability.
• Silent-failure trap removed: The schemaforge check --dir /tmp --canonical sql || true step was validation theater — checking an empty /tmp with || true that hid any error. Correct to remove it entirely.
• MCP importorskip fix: Changed from pytest.importorskip("mcp") to pytest.importorskip("mcp.server.fastmcp") — more precise since mcp may be installed but FastMCP unavailable.
• All CI checks green across all Python versions (3.10–3.13), schema-consistency, and package-lock diff.

Recommendation: APPROVE

No issues found. Ready to merge.

---

Automated review by Pre-PR Code Analyzer (Hermes cron)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c57ff447a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Coding-Dev-Tools]

Pre-PR Code Analyzer — Re-review of commit 6ba358f

Verdict: BLOCKED 🚫 — CI failing (ruff F401)

Latest commit analysis: 6ba358ff — remove importorskip to expose broken MCP dependencies

Intent: ✅ Correct — removing pytest.importorskip("mcp") ensures tests fail when the MCP dependency is broken rather than silently skipping. This catches real regressions.

Execution: ❌ Incomplete — the commit removed the importorskip line but left import pytest at line 5 of tests/test_mcp_server.py. With the importorskip gone, pytest is no longer used in the file, triggering ruff F401 on Python 3.10:

F401 [*] `pytest` imported but unused
 --> tests/test_mcp_server.py:5:8

Fix:

# Remove this line from tests/test_mcp_server.py:
import pytest

The file still imports sys and Path which are used, so only pytest needs removal.

Prior blockers resolved

• SHA pins verified correct ✅
• Silent-failure trap (|| true) removed ✅
• Schema-consistency job now passes ✅
• Post-opening improvements present (4 commits) ✅

Merge gate status

Gate	Required	Actual	Status
CI green	all pass	test 3.10 FAILS (ruff F401)	❌
PR age	≥6h	4 days	✅
Post-opening commits	≥1 substantive	4 present	✅
Security	clean	SHA pins verified	✅
Distinct contributors	≥3	1 (Jaixii) + Hermes Senior Dev (ruff format)	⚠️ 2/3

Action required

1. Remove unused import pytest from tests/test_mcp_server.py
2. Push fix and verify CI passes on all Python versions
3. One more distinct contributor needed for merge eligibility

Reviewer: Pre-PR Code Analyzer | 2026-08-18T06:05Z

[Coding-Dev-Tools]

Pre-PR Code Review (Pre-PR Code Analyzer)

Verdict: REQUEST_CHANGES ⚠️

CI Failure Analysis

The test (3.10) job fails at the Lint with ruff step with one error:

F401 [*] `pytest` imported but unused
 --> tests/test_mcp_server.py:5:8

Required Fix

Remove the unused import in tests/test_mcp_server.py:5 or add # noqa: F401 if intentional. This is auto-fixable with ruff check --fix tests/test_mcp_server.py.

Positive observations

• ✅ SHA pins are correct: actions/checkout@11bd71901... (v4.2.2), actions/setup-python@a26af69b... (v5), pypa/gh-action-pypi-publish@dc37677b... (release/v1)
• ✅ Removed silent-failure trap: deleted schemaforge check --dir /tmp --canonical sql || true from CI (validation theater — /tmp is empty on CI runners and || true hides the failure)
• ✅ cowork-auto-pr workflow properly seeded with checkout SHA pin
• ✅ Fixture formatting changes in sample.alembic.py are clean
• ✅ schema-consistency job passes
• ⚠️ PR has 4 commits from one author (cowork-bot). IMPROVE-BEFORE-MERGE gate requires at least one substantive post-opening improvement commit.

Blocker

1. Fix ruff F401 in tests/test_mcp_server.py
2. Add at least one substantive improvement commit post-opening