improvement(ci): parallel jobs, Turbo cache, affected-only checks

[yokoszn]

What this changes

A full rewrite of .github/workflows/ci.yml plus supporting changes to turbo.json, scripts/, packages/cli, and .dockerignore. The original workflow was a single serial pipeline taking ~55 minutes. The new one is a parallel job graph that completes in 5–15 minutes depending on what changed.

---

Original system (baseline on main)

Structure: Two sequential jobs, one after the other.

test → ephemeral-integration
     └→ docker-build

test job did everything in serial:

1. yarn install (no cache)
2. yarn npm audit — security gate blocking the build even if nothing changed
3. yarn build:packages (Turbo cache disabled — cache: false)
4. yarn generate
5. yarn build:packages again, post-generate
6. Dep-version check, i18n sync/usage check
7. yarn typecheck — all packages, every time
8. yarn test — all packages, every time
9. yarn build:app — Next.js build

ephemeral-integration ran after test fully finished and repeated steps 1–5 from scratch (no shared artifacts), then ran all 311+ Playwright specs on a single runner with no sharding.

docker-build also ran after test, building three Dockerfiles sequentially.

Key problems:

• No caching of any kind — yarn install (~2 min), node_modules extraction (~85s), Turbo outputs, Playwright browsers reinstalled every run
• turbo.json had "cache": false on build and typecheck, and "globalPassThroughEnv": ["*"] — every environment variable was part of the cache key, making Turbo remote cache effectively useless
• Audit serialised with the build; a yarn.lock-stable run still waited on a full CVE scan
• Integration rebuilt the entire app (~95s) in every run, separately from test
• No affected-only filtering — changing one file typechecked and tested every package in the monorepo
• All 311+ integration tests ran on a single runner for every PR and every push
• Stale runs were not cancelled — rapid pushes queued multiple 55-minute runs
• Action versions targeted Node.js 20, running on Node 24 only via a forced override

---

New system (this PR)

Structure: Six parallel jobs with a shared build.

prepare ──┬──► test ──────────────────────────────► merge-coverage (push only)
audit   ──┤                                              ▲
lint    ──┘──► ephemeral-integration (parallel) ─────────┘
          └──► docker-build (parallel, skipped for CI-only PRs)

---

Removed

What	Why removed
Serial yarn install with no cache in every job	Replaced by .yarn/cache + node_modules GHA cache. On yarn.lock-stable runs, install is skipped entirely.
Repeated full package build in ephemeral-integration	Eliminated by prepare uploading compiled packages/*/dist/ + generated files as build-artifacts. All downstream jobs download instead of rebuild.
Repeated yarn build:app in every integration shard	Eliminated by uploading the tarred .mercato/next/ as app-build. All 15 shards extract it instead of rebuilding (~95s × 15 = ~24 min saved per full-suite run).
Turbo "cache": false on build and typecheck	Replaced with "cache": true + correct inputs and outputs. Unlocks both local .turbo GHA cache and optional remote cache.
"globalPassThroughEnv": ["*"] in turbo.json	Replaced with "globalEnv": ["NODE_ENV"]. The wildcard caused every ephemeral runner env var to be part of the turbo cache key, producing a near-zero hit rate.
Audit inline in the test job	Extracted to a standalone audit job that runs in parallel and is skipped entirely when yarn.lock has not changed (GHA cache keyed on lockfile hash).
Playwright browsers installed fresh every run	Replaced by GHA cache keyed on Playwright version. Install only runs on version bump.
All packages typechecked and tested every PR	Replaced by --filter=[origin/$base_ref]... on PRs — only affected packages and their dependents run. Full run on pushes to protected branches.
All 311+ integration tests on a single runner every run	CI/docs PRs: skipped. Module PRs: affected-only, single runner. Shared-package PRs and pushes: 15-shard parallel.
docker-build waiting on test to finish	Docker now starts as soon as prepare finishes — runs in parallel with test and integration.
docker-build on CI/infra-only PRs	Skipped entirely when skip_integration == true. Avoids a 10+ min rebuild from Docker layer cache busting when innocuous files change (e.g. turbo.json).
Node.js 20-targeting action versions	Upgraded across all workflow files: checkout@v6, setup-node@v6, cache@v5, upload-artifact@v7, download-artifact@v8.

---

Added

What	Effect
prepare job	Single canonical build producing two artifacts (build-artifacts, app-build). Scope computation runs here so integration shards start immediately after prepare without waiting for typecheck.
lint job	Parallel ESLint run alongside prepare and audit. Fails fast before heavy work starts.
merge-coverage job	Aggregates per-shard Istanbul summaries after all 15 integration shards complete and writes the merged report to the GitHub step summary. Only runs on push (sharded) runs.
Scope computation in prepare	Analyses git diff origin/$base_ref --name-only and emits skip_integration (bool), affected_modules (comma list), and shard_matrix (JSON array). Drives all downstream job decisions.
OM_INTEGRATION_MODULES filtering	When affected_modules is non-empty, playwright.config.ts filters specs to only the affected modules' tests.
15-shard Playwright matrix on push	Full-suite runs distribute 311+ tests across 15 parallel runners. Each shard writes a coverage-shard-N/ subdirectory; merge-coverage recombines them.
--shard N/M CLI flag	Added to packages/cli/src/lib/testing/integration.ts — passes through to Playwright's own --shard arg.
scripts/merge-coverage.mjs	New script (zero external deps) that sums Istanbul totals across shards and resolves per-file conflicts by picking the shard with higher coverage.
Turbo remote cache wiring	TURBO_TOKEN / TURBO_TEAM plumbed into all turbo run steps. If secrets are set, remote cache is active; if not, local .turbo GHA cache is used. No config required.
Concurrency groups	ci-${{ github.ref }} group cancels in-flight runs on the same branch when a new push arrives.
.dockerignore improvements	Added **/testing/ and CI-only scripts (merge-coverage.mjs, i18n-check-sync.ts, i18n-check-usage.ts) to prevent these files from busting Docker's COPY packages/ layer cache.
Turbo "inputs" on build task	"inputs": ["$TURBO_DEFAULT$", "generated/**"] — includes gitignored generated files in the cache key, preventing false Turbo cache hits on the second post-generate build.

---

Modified (same purpose, different behaviour)

What	Before	After
ephemeral-integration trigger	After test (serial, gated on typecheck + unit tests)	After prepare + audit + lint (parallel with test)
Integration test scope	Always full suite, 311 tests	CI/docs PRs: skipped. Module PRs: affected-only, single shard. Shared-package PRs and pushes: 15-shard full suite.
yarn install	Ran unconditionally in every job	Skipped when node-modules-${{ runner.os }}-${{ hashFiles('yarn.lock') }} cache hits
Security audit	Blocking step in test job	Standalone parallel job, result cached on yarn.lock hash
yarn build:app in prepare	Unconditional	Skipped when skip_integration == true — saves ~95s for CI/docs-only PRs
docker-build dependency	needs: test	needs: prepare — runs in parallel with test and integration
docker-build scope	Always ran on non-fork PRs/pushes	Skipped when skip_integration == true
merge-coverage on missing shard data	exit 1 (failed the job)	exit 0 with warning — graceful degradation

---

Unchanged

• All environment variables passed to the ephemeral server (OM_ENABLE_ENTERPRISE_MODULES, JWT_SECRET, etc.)
• OM_INTEGRATION_APP_READY_TIMEOUT_SECONDS: '180' timeout
• The Playwright test suite itself — no tests added or removed
• docker-build steps — same three Dockerfiles, same GHA layer cache config
• snapshot.yml and release.yml job logic — only action version bumps applied
• CI must still be green before merge — only the time to get there changes

---

Hardening

Area	Change
Stale run prevention	Concurrency group cancels queued runs immediately on new push
Turbo cache key correctness	globalPassThroughEnv: ["*"] → globalEnv: ["NODE_ENV"] — eliminates phantom cache misses from ephemeral runner metadata in the hash
Turbo input correctness	generated/** added to build task inputs — prevents false hits when generated TypeScript files change but are not git-tracked
Audit isolation	Audit failure blocks the run independently of build/test; yarn.lock-stable runs skip it entirely
Artifact integrity	if-no-files-found: error on both uploaded artifacts — CI fails immediately if a produce step silently produced nothing
Artifact filename safety	Next.js chunk files contain colons (e.g. [externals]_node:fs_promises_*.js) which upload-artifact rejects — fixed by tarring .mercato/next/ before upload and extracting after download
Docker layer cache stability	.dockerignore additions prevent testing utilities and CI scripts from busting the COPY packages/ layer
Node.js action runtime	All actions upgraded to Node.js 24-native versions — removes forced compatibility shim and deprecation warnings
process.env restore in tests	Fixed env var teardown in activity-executor.test.ts — previously set the var to the string "undefined" on cleanup when it was originally unset

---

Measured wall times

Scenario	Before	After
CI/docs-only PR (this branch)	~18 min	~5.5 min
PR touching 1 module	~55 min	~12–14 min
PR touching shared packages	~55 min	~16–18 min
Push to main/develop (full suite)	~55 min	~16–18 min
Stale run on re-push	completes (~55 min)	cancelled in <5 sec

The remaining bottleneck for module PRs is ephemeral server startup time inside each integration shard (~120–150s), which is determined by app initialisation speed rather than CI configuration.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added automated coverage merging for distributed integration tests.
  • Implemented module-scoped integration test filtering and Playwright test sharding.

• Tests

  • Restructured CI/CD pipeline with parallel job execution and artifact reuse across test stages.

• Chores

  • Optimized build caching configuration and refined Docker image file exclusions.

[coderabbitai]

Warning

Rate limit exceeded

@yokoszn has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 43 minutes and 37 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 43 minutes and 37 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 86eb216a-7df8-46bb-a289-0fae915a44b6

📥 Commits

Reviewing files that changed from the base of the PR and between 789dd74 and 899c620.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

📝 Walkthrough

Walkthrough

The changes implement a comprehensive CI/CD performance optimization strategy by enabling Turbo caching with controlled environment pass-through, restructuring the CI workflow with a new prepare job that computes affected modules and shard matrices, implementing Playwright integration test sharding with coverage merging, adding module-scoped test filtering, reorganizing job dependencies to enable parallel execution, and documenting the complete initiative.

Changes

Cohort / File(s)	Summary
CI Workflow Restructuring .github/workflows/ci.yml	Introduced prepare job computing affected modules and shard matrices; refactored test, ephemeral-integration, and docker-build jobs with new dependencies; added merge-coverage job for aggregating shard coverage; added concurrency controls and upgraded action versions (checkout v4→v6, setup-node v4→v6, upload/download-artifact v4→v7).
Workflow Configuration Updates .github/workflows/qa-deploy.yml, .github/workflows/snapshot.yml	Added FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 environment variable; snapshot workflow added concurrency settings; upgraded checkout and upload-artifact action versions.
Build & Caching Configuration turbo.json, .dockerignore	Turbo: replaced globalPassThroughEnv: ["*"] with globalEnv: ["NODE_ENV"]; enabled build and typecheck task caching with explicit cache inputs. Dockerignore: added exclusions for **/testing/ directories and CI-only scripts (merge-coverage.mjs, i18n-check-*.ts).
Test Execution & Coverage .ai/qa/tests/playwright.config.ts, packages/cli/src/lib/testing/integration.ts, scripts/merge-coverage.mjs	Playwright config: replaced discoveredSpecPaths with filteredSpecPaths that respect OM_INTEGRATION_MODULES environment variable. Integration CLI: added --shard N/M argument support. New script: merge-coverage.mjs consolidates per-shard Playwright coverage from coverage-shard-* directories into merged summaries.
Documentation .ai/specs/2026-04-10-ci-cd-performance.md	New specification documenting current CI/CD topology (55-minute baseline), root-cause analysis (always-run suite, disabled caching, ephemeral setup), proposed improvements (Turbo caching, module filtering, sharding, concurrency groups, prebuilt containers), implementation progress, risk assessment, and phased rollout plan.

Sequence Diagram(s)

sequenceDiagram
    participant GHA as GitHub Actions
    participant Prepare as prepare job
    participant Audit as audit job
    participant Lint as lint job
    participant Test as test job
    participant IntTest as ephemeral-integration job
    participant Merge as merge-coverage job

    GHA->>Prepare: trigger (git diff analysis)
    activate Prepare
    Prepare->>Prepare: compute affected modules<br/>build shard matrix
    Prepare->>Prepare: build packages + generate<br/>rebuild with generated
    alt integration enabled
        Prepare->>Prepare: build Next.js app
    end
    Prepare->>GHA: upload build-artifacts<br/>upload app-build
    deactivate Prepare

    par
        Prepare->>Audit: notify ready
        activate Audit
        Audit->>GHA: run Yarn audit<br/>cache on yarn.lock
        deactivate Audit
    and
        Prepare->>Lint: notify ready
        activate Lint
        Lint->>GHA: run Turbo lint<br/>(filtered packages)
        deactivate Lint
    and
        Prepare->>Test: notify ready
        activate Test
        Test->>GHA: download build-artifacts
        Test->>GHA: run typecheck & tests<br/>(scoped to changes)
        Test->>GHA: run yarn test:scripts
        deactivate Test
    end

    Prepare->>IntTest: send shard matrix<br/>(none or N shards)
    activate IntTest
    IntTest->>GHA: download app-build
    IntTest->>GHA: extract + run sharded tests<br/>OM_INTEGRATION_MODULES set
    par
        IntTest->>GHA: shard 1 (coverage output)
    and
        IntTest->>GHA: shard 2 (coverage output)
    and
        IntTest->>GHA: shard N (coverage output)
    end
    deactivate IntTest

    alt shard matrix not ["none"]
        IntTest->>Merge: notify shards complete
        activate Merge
        Merge->>GHA: download all shard artifacts
        Merge->>Merge: merge coverage-summary.json<br/>from coverage-shard-*
        Merge->>GHA: upload merged coverage
        deactivate Merge
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 Hops excitedly with carrot in paw

Shards now scatter like seeds we sow,
Turbo caches make workflows flow,
Modules filtered, coverage merged so bright,
CI runs faster—parallel might!
✨ celebratory binky ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'improvement(ci): parallel jobs, Turbo cache, affected-only checks' directly and accurately summarizes the three main changes: introducing parallel CI jobs, enabling Turbo caching, and implementing affected-only test execution.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch improvement/ci-performance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (6)

.dockerignore (1)

75-77: Minor: Duplicate ignore entries.

.github (line 4) and .vscode (line 7) already appear earlier in the file. These duplicates are harmless but add maintenance overhead.

🧹 Proposed cleanup

 # CI/CD
-.github
-.vscode
+# (already ignored above)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.dockerignore around lines 75 - 77, Remove the duplicate ignore entries by
deleting the repeated lines ".github" and ".vscode" in the .dockerignore so each
directory appears only once; ensure the earlier occurrences remain and remove
the later ones to avoid redundant entries.

.ai/specs/2026-04-10-ci-cd-performance.md (1)

21-27: Optional: Add language identifiers to fenced code blocks.

The ASCII diagrams and text output blocks could use text or plaintext as a language identifier to satisfy markdown linters, though this is purely cosmetic.

Also applies to: 45-62, 72-74, 195-198

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.ai/specs/2026-04-10-ci-cd-performance.md around lines 21 - 27, The fenced
ASCII diagram blocks (e.g., the block containing "prepare", "test",
"merge-coverage", "audit", "lint", "ephemeral-integration", "docker-build")
should include a language identifier like ```text or ```plaintext to satisfy
linters; update each relevant fenced block (including the other occurrences at
the ranges you noted) by changing the opening fence to ```text (or ```plaintext)
so the diagram and text output are marked as plain text.

.github/workflows/ci.yml (4)

387-394: Consider passing Turbo credentials to the test step.

The typecheck step (lines 383-385) passes TURBO_TOKEN and TURBO_TEAM for remote caching, but the test step (lines 387-394) does not. If yarn test runs through Turbo, it could benefit from remote cache as well.

💡 Optional: Add Turbo credentials to test step

       - name: Test
         # Same scoping as typecheck — affected packages only on PRs.
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             yarn turbo run test --filter=[origin/${{ github.base_ref }}]...
           else
             yarn test
           fi
+        env:
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 387 - 394, The Test step currently
runs the same turbo-aware commands as typecheck but does not export Turbo remote
cache credentials; update the "Test" step to export the same environment
variables used in the typecheck step by adding TURBO_TOKEN and TURBO_TEAM to the
step's environment so both branches (yarn turbo run test --filter=[origin/${{
github.base_ref }}]... and yarn test) can use remote caching; ensure the env
keys exactly match TURBO_TOKEN and TURBO_TEAM.

---

491-500: Hardcoded Playwright version in cache key may drift from installed version.

The cache key uses playwright-chromium-${{ runner.os }}-v1.50.0, but this version is hardcoded. If the project upgrades Playwright, the cache key won't update automatically, potentially causing mismatches between cached and required browser versions.

Consider deriving the version dynamically from the lockfile or package.json:

💡 Dynamic Playwright version example

      - name: Get Playwright version
        id: playwright-version
        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@v5
        with:
          path: ~/.cache/ms-playwright
          key: playwright-chromium-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 491 - 500, Replace the hardcoded cache
key used by the step with id "playwright-cache" so it derives the Playwright
version dynamically; add a preceding step (e.g., id "playwright-version") that
reads the installed Playwright package version from package.json or
`@playwright/test` and writes it to GITHUB_OUTPUT, then use that output in the
cache key (instead of "v1.50.0") so the cache key and the "npx playwright
install --with-deps chromium" install step stay in sync when Playwright is
upgraded.

---

527-572: Consider extracting coverage display logic to reduce duplication.

The coverage display code (lines 539-572) is nearly identical to the merged coverage display (lines 623-656). This duplication increases maintenance burden.

Consider extracting this to a reusable shell script (e.g., scripts/display-coverage.sh) or a composite action that both steps can invoke with a summary file path argument.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 527 - 572, The two nearly identical
coverage display blocks (the "Display integration coverage summary" step that
reads SUMMARY_FILE and the merged coverage display step) should be extracted
into a single reusable script or composite action (e.g.,
scripts/display-coverage.sh) so both steps invoke the same logic; implement a
script that accepts the summary file path (like the current "$SUMMARY_FILE") and
performs JSON parsing, console output, and appending to GITHUB_STEP_SUMMARY,
then replace the inline node -e blocks in the steps with a call to that script
(or action) passing the summary file argument to eliminate duplication while
keeping behavior identical.

---

612-613: Consider conditioning display on merge success.

Using if: always() on line 613 will run the display step even if the merge step (line 610) fails. This could show stale or missing data. Consider conditioning on the merge step's outcome:

       - name: Display merged integration coverage
-        if: always()
+        if: success()
         run: |

Alternatively, keep always() if visibility of partial results is preferred.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 612 - 613, The "Display merged
integration coverage" step is currently guarded by if: always(), which runs even
when the earlier merge step failed; change its condition to only run on merge
success by replacing if: always() with a success check against the merge step
(e.g., if: steps.merge.outcome == 'success' or if:
steps["merge-integration"].outcome == 'success' depending on that step's id), or
use if: success() scoped to the job/needs if the merge is in a different job
(e.g., if: needs.merge.outputs.<flag> == 'true'); ensure you reference the
actual merge step id (e.g., merge or merge-integration) when updating the
condition.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 668-676: The docker-build job is being skipped when
needs.prepare.outputs.skip_integration == 'true' even if Dockerfiles changed;
update the prepare job (integration-scope step that sets FULL_SUITE_PATTERN /
skip_integration) to include Docker-related paths (e.g., Dockerfile,
apps/docs/Dockerfile, docker/**) in the full-suite detection, or alternatively
add a separate check in the docker-build job's if condition to also run when
Docker paths changed; specifically modify the prepare job's pattern logic or the
docker-build job's if clause so docker-build runs when Dockerfile/docker/
changes despite skip_integration being true.

In @.github/workflows/qa-deploy.yml:
- Around line 3-5: There are duplicate workflow-level env: blocks so the later
env block overwrites the earlier one and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 is
never set; fix by merging both env: blocks into a single top-level env: mapping
and ensure FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true' is included alongside the
other environment variables (i.e., consolidate the env key so both the existing
variables from the second env block and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24
appear under one env:).

---

Nitpick comments:
In @.ai/specs/2026-04-10-ci-cd-performance.md:
- Around line 21-27: The fenced ASCII diagram blocks (e.g., the block containing
"prepare", "test", "merge-coverage", "audit", "lint", "ephemeral-integration",
"docker-build") should include a language identifier like ```text or
```plaintext to satisfy linters; update each relevant fenced block (including
the other occurrences at the ranges you noted) by changing the opening fence to
```text (or ```plaintext) so the diagram and text output are marked as plain
text.

In @.dockerignore:
- Around line 75-77: Remove the duplicate ignore entries by deleting the
repeated lines ".github" and ".vscode" in the .dockerignore so each directory
appears only once; ensure the earlier occurrences remain and remove the later
ones to avoid redundant entries.

In @.github/workflows/ci.yml:
- Around line 387-394: The Test step currently runs the same turbo-aware
commands as typecheck but does not export Turbo remote cache credentials; update
the "Test" step to export the same environment variables used in the typecheck
step by adding TURBO_TOKEN and TURBO_TEAM to the step's environment so both
branches (yarn turbo run test --filter=[origin/${{ github.base_ref }}]... and
yarn test) can use remote caching; ensure the env keys exactly match TURBO_TOKEN
and TURBO_TEAM.
- Around line 491-500: Replace the hardcoded cache key used by the step with id
"playwright-cache" so it derives the Playwright version dynamically; add a
preceding step (e.g., id "playwright-version") that reads the installed
Playwright package version from package.json or `@playwright/test` and writes it
to GITHUB_OUTPUT, then use that output in the cache key (instead of "v1.50.0")
so the cache key and the "npx playwright install --with-deps chromium" install
step stay in sync when Playwright is upgraded.
- Around line 527-572: The two nearly identical coverage display blocks (the
"Display integration coverage summary" step that reads SUMMARY_FILE and the
merged coverage display step) should be extracted into a single reusable script
or composite action (e.g., scripts/display-coverage.sh) so both steps invoke the
same logic; implement a script that accepts the summary file path (like the
current "$SUMMARY_FILE") and performs JSON parsing, console output, and
appending to GITHUB_STEP_SUMMARY, then replace the inline node -e blocks in the
steps with a call to that script (or action) passing the summary file argument
to eliminate duplication while keeping behavior identical.
- Around line 612-613: The "Display merged integration coverage" step is
currently guarded by if: always(), which runs even when the earlier merge step
failed; change its condition to only run on merge success by replacing if:
always() with a success check against the merge step (e.g., if:
steps.merge.outcome == 'success' or if: steps["merge-integration"].outcome ==
'success' depending on that step's id), or use if: success() scoped to the
job/needs if the merge is in a different job (e.g., if:
needs.merge.outputs.<flag> == 'true'); ensure you reference the actual merge
step id (e.g., merge or merge-integration) when updating the condition.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 81674a52-ea99-4e50-a6da-47b688ab3d80

📥 Commits

Reviewing files that changed from the base of the PR and between f18f549 and 789dd74.

📒 Files selected for processing (9)

• .ai/qa/tests/playwright.config.ts
• .ai/specs/2026-04-10-ci-cd-performance.md
• .dockerignore
• .github/workflows/ci.yml
• .github/workflows/qa-deploy.yml
• .github/workflows/snapshot.yml
• packages/cli/src/lib/testing/integration.ts
• scripts/merge-coverage.mjs
• turbo.json

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Dockerfile-only changes may be incorrectly skipped.

The docker-build job is skipped when skip_integration == 'true', which is determined by whether module-level code changed. However, changes to Dockerfile, apps/docs/Dockerfile, or docker/ directory would not be detected as module changes and would skip Docker validation.

Consider adding Dockerfile paths to the FULL_SUITE_PATTERN in the prepare job, or adding a separate condition for Docker-related file changes.

💡 Option: Add Docker paths to full suite pattern

In the prepare job's integration-scope step, extend the pattern:

-          FULL_SUITE_PATTERN='^packages/shared/|^packages/ui/|^packages/events/|^packages/queue/|^packages/cache/|^packages/search/|^packages/onboarding/|^packages/webhooks/|^packages/core/src/lib/|^packages/enterprise/src/lib/|^apps/mercato/src/(app|lib|components|layout\.|page\.)'
+          FULL_SUITE_PATTERN='^packages/shared/|^packages/ui/|^packages/events/|^packages/queue/|^packages/cache/|^packages/search/|^packages/onboarding/|^packages/webhooks/|^packages/core/src/lib/|^packages/enterprise/src/lib/|^apps/mercato/src/(app|lib|components|layout\.|page\.)|^Dockerfile|^docker/|^apps/docs/Dockerfile'

Or add a separate condition in docker-build to detect Docker file changes independently.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 668 - 676, The docker-build job is
being skipped when needs.prepare.outputs.skip_integration == 'true' even if
Dockerfiles changed; update the prepare job (integration-scope step that sets
FULL_SUITE_PATTERN / skip_integration) to include Docker-related paths (e.g.,
Dockerfile, apps/docs/Dockerfile, docker/**) in the full-suite detection, or
alternatively add a separate check in the docker-build job's if condition to
also run when Docker paths changed; specifically modify the prepare job's
pattern logic or the docker-build job's if clause so docker-build runs when
Dockerfile/docker/ changes despite skip_integration being true.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Duplicate workflow-level env: blocks — first block is silently overwritten.

YAML does not allow duplicate keys at the same level; the second env: block (lines 38–42) overwrites the first (lines 3–4). As a result, FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 is never set.

🔧 Proposed fix: Merge into a single `env:` block

 name: Deploy to Dokploy QA
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
-
-on:
-  workflow_dispatch:
-...
-
-env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
   DOCKERFILE: ./docker/preview/Dockerfile
   BUILD_CONTEXT: .
+
+on:
+  workflow_dispatch:

Also applies to: 38-42

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/qa-deploy.yml around lines 3 - 5, There are duplicate
workflow-level env: blocks so the later env block overwrites the earlier one and
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 is never set; fix by merging both env: blocks
into a single top-level env: mapping and ensure
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true' is included alongside the other
environment variables (i.e., consolidate the env key so both the existing
variables from the second env block and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24
appear under one env:).