fix(review): derive repo-profile check publication from reviewCheckMode

[JSONbored]

Summary

• PR feat(review): extract a codebase-grounded repo profile from RAG + signals #3039 (merged) added extractRepoProfile's contributionWorkflow.gatePublishesCheck field, but derived it from the legacy gateCheckMode/checkRunMode settings fields directly instead of reviewCheckMode — the actual runtime authority for whether the review check publishes (feat(selfhost): configurable review-check publish mode (required/visible/disabled) #2852). A repo with reviewCheckMode: "disabled" and a stale legacy gateCheckMode: "enabled" was reported as publishing a check it does not actually publish.
• Fixes the derivation to settings.reviewCheckMode !== "disabled", matching the settings resolver's own authority.
• Replaced the two existing tests that encoded the old (buggy) legacy-field-only behavior with tests asserting the correct reviewCheckMode-driven behavior across all three of its values (required, visible, disabled), including the exact stale-legacy-field scenario described above.
• Also applied a cheap, related hardening nit from the same review: deriveCommandsFromPackageJson's scripts parse now excludes array values (typeof [] === "object" in JS, so an array-valued scripts field previously slipped past the object check), with a regression test.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed. (No issue: a small, scoped correctness fix to PR feat(review): extract a codebase-grounded repo profile from RAG + signals #3039, found by that PR's own review and fixed same-day after it merged before the fix could land.)

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Ran typecheck plus the full targeted test file (test/unit/repo-profile.test.ts, 30/30 passing, confirmed 100% branch coverage on src/review/repo-profile.ts via vitest run --coverage --coverage.include) rather than the full suite, per this repo's convention of scoping local verification to the affected area for small fixes and letting CI verify the rest. Proved causality on both changes by reverting each fix and confirming its regression test fails, then restoring and confirming it passes.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS changes.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP changes; extractRepoProfile is not yet wired to a route.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Visible UI changes include a UI Evidence section below with screenshots. (N/A — no visible UI changes.)
• Public docs/changelogs are updated where needed. (N/A — no docs/changelog changes.)

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-04 10:14:43 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This change correctly moves repo-profile check publication reporting to the same authority used by the runtime settings resolver: `settings.reviewCheckMode !== "disabled"`. The stale-legacy regression is covered directly, and the added package.json hardening avoids treating array indices as script names without changing normal object-script behavior. I do not see a reachable correctness issue in the changed code.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 60 registered-repo PR(s), 51 merged, 421 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 60 PR(s), 421 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 60 PR(s), 421 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.09%. Comparing base (3bf6de7) to head (4362e1f).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3044      +/-   ##
==========================================
- Coverage   96.10%   96.09%   -0.01%     
==========================================
  Files         261      261              
  Lines       28872    28871       -1     
  Branches    10510    10509       -1     
==========================================
- Hits        27746    27745       -1     
  Misses        492      492              
  Partials      634      634              

Files with missing lines	Coverage Δ
src/review/repo-profile.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.