The build-deploy job posts a 'Prêt à tester' comment whose body literally
contains 'Reply **LGTM** pour merger' and 'Reply **KO**' as instructions to
the reviewer. wait-approval re-fetches ALL comments every 30s and greps any
body for \bLGTM\b (checked before KO) — so on the first poll (~30s after
deploy) the bot matched its OWN comment and squash-merged automatically,
with no human review. Regressed in #6937a36 (PR #12) which tightened the
regex to catch 'Tested, LGTM!' but didn't notice the bot body matched.
Fix (sentinel marker + python parse, identity-agnostic so it's safe whether
PR_API_TOKEN is a bot or a personal account):
- build-deploy: embed <!-- tabatago:ready-to-test --> in the bot comment
(HTML comment, invisible in rendered markdown, present in raw body).
- wait-approval: replace the fragile grep-over-JSON with a python3 heredoc
using json.loads + the existing \bLGTM\b / \bKO\b regexes. Skip any
comment whose body contains the sentinel marker. Check KO BEFORE LGTM so
a PR with both signals blocks (matches the existing 'KO blocks' intent).
LGTM still does {"Do":"squash"}; KO still blocks; 2h timeout unchanged.
Verified locally with three scenarios:
bot-only -> PENDING (was LGTM before — the bug)
bot + reviewer -> LGTM (squash-merge still fires)
bot + KO -> KO (block still fires, even with bot LGTM in history)
AGENTS.md §5 step 9, §5 pitfalls, and §8 anti-patterns updated so the doc
describes the marker rule and warns against re-introducing the self-match.
- admin-web-docker.yml: add 'test' job (Node 22, npm ci, tsc --noEmit,
vitest run) gated by the anti-[skip ci] guard, wire needs: [test] on
build-validation and semantic-release, and needs: [semantic-release, test]
on build-and-push. Tests now run as a gate before Docker build validation
on PRs and before semantic-release on main.
- ci.yml: drop the redundant admin-web-test job (now covered by the test
job in admin-web-docker.yml on PRs), remove the admin-web path filter
and output from the changes job, simplify deploy-functions.needs.
- scripts/verify-admin-web-docker.sh: update check_workflow_jobs to expect
4 jobs (test + build-validation + semantic-release + build-and-push) and
check_workflow_needs to expect build-and-push needs [semantic-release, test]
so the verify script stays green with the new job topology.
Bash -e doesn't just kill on pipefail — it exits on ANY non-zero
command. Even without a pipeline, both xcrun devicectl and ios-deploy
return non-zero on failure, killing the script before the exit-code
check.
Fix: wrap both in 'if command; then exit 0; fi' so -e treats them
as condition-tested (no early exit). Fallback now actually runs.
When devicectl fails under bash -e -o pipefail, the pipeline
(xcrun devicectl ... | tail -3) exits non-zero and -e kills
the script before the if-check. The ios-deploy USB fallback
was dead code.
Fix: redirect to temp file, capture exit code explicitly.
No pipeline = pipefail has no side-channel effect.
- Replace browse tab with Supabase-connected explore tab with filters
- Add React Query for data fetching with loading states
- Add 3 structured programs with weekly progression
- Add Supabase anonymous auth sync service
- Add PostHog analytics with screen tracking and events
- Add comprehensive test strategy (Vitest + Maestro E2E)
- Add RevenueCat subscription system with DEV simulation
- Add i18n translations for new screens (EN/FR/DE/ES)
- Add data deletion modal, sync consent modal
- Add assessment screen and program routes
- Add GitHub Actions CI workflow
- Update activity store with sync integration
