[0x4007]

Ignore dotenv secret variants and backups while retaining intentional example, sample, and template files. All nine existing root env/backup paths match the new rules, and path-only inspection found no tracked env secrets or backups.

This also repairs the replay baseline's verification integration: the Codex adapter has a real executable consumer, research artifacts and standalone C++ files no longer select unrelated Bun tests, and Darwin-only containment tests run through an explicit affected-Darwin segment. First-party TS/JS adapters and runtime-referenced data retain their applicable checks. Workflow triggers and deployment behavior are unchanged.

Validation passed on the verification source tree: focused selector/prelaunch tests, changed-file lint/format, strict application TypeScript checking, Knip, actual changed-path/config/native/TS-adapter controls, and the pinned Codex synthetic replay with two dispatches and durable KV reopen. The final ignore-only commit additionally passed git check-ignore, path-only git ls-files, and git diff --check; its verification source files are unchanged.

No workflow was manually dispatched or rerun. Automatic post-merge CI is a separate hosted receipt.

[ubiquity-os]

Important

Ownership check: this pull request is left open.

[coderabbitai]

Walkthrough

The pull request updates changed-path classification and CI test selection, makes test groups platform-aware, and changes the Darwin workflow to use the test runner. It adds a Codex Responses conformance script that validates options, runs a fixture replay, and verifies captured evidence. It also adds ignore rules for .env.* files with exceptions for example, sample, and template files.

Possibly related PRs

• ubiquity/ai.ubq.fi#1336: Both PRs change affected-test selection and the workflow scope contract used for manual CI dispatch.

Merge Risk: Moderate · up to 6a1d5

The new changed-path selector can silently skip tests. A changed C++ test adapter may not run, and a research data file that a runtime reader consumes may be treated as documentation-only. CI would report success without running checks. Fix both selector gaps before merging.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the dotenv ignore change, which is in the .gitignore diff. It also names replay checks, which the changes to test-scope, test-runner, and the Codex conformance script cover. The title …
Description check		The description covers the .gitignore rules for dotenv files, the replay baseline fixes, Darwin test routing, and the validation the author ran. These match the changed files, so the description is on…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the dotenv ignore change, which is in the .gitignore diff. It also names replay checks, which the changes to test-scope, test-runner, and the Codex conformance script cover. The title is broad and lists two unrelated areas, but both are real parts of the changeset.

Full details: Description check

Explanation

The description covers the .gitignore rules for dotenv files, the replay baseline fixes, Darwin test routing, and the validation the author ran. These match the changed files, so the description is on topic.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Actionable comments posted: 2

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 51736b2d-d427-49d8-b0b8-de26c7c6822f

Commits

Reviewing files that changed from the base of the PR and between db1d78c and 6a1d579.

Files selected for processing: 7

• .github/workflows/deno-deploy.yml
• .gitignore
• scripts/responses-conformance-codex.ts
• scripts/test-runner-prelaunch.test.ts
• scripts/test-runner.ts
• scripts/test-scope.test.ts
• scripts/test-scope.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Major · Functional Correctness · Heavy lift

Distinguish regular expressions from string literals.

A valid runtime reader can contain:

const quotePattern = /["']/;
readFileSync(new URL("../docs/research/selector-fixture.json", import.meta.url));

The scanner treats the regular expression's " as an opening string delimiter. It consumes the following file-read expression and misses its path. The JSON change then becomes documentation-only, which skips runtime checks despite the active consumer.

Use syntax-aware literal traversal that distinguishes regular expressions and visits template expressions.

[coderabbitai]

Major · Functional Correctness · Quick win

Keep changed C++-component test files eligible for selection.

If an unimported cpp/tests/example.test.ts changes, separateComponentPaths marks it separate because runtime traversal does not start in cpp/. This filter then removes the changed test before selectAffectedTestFiles can select it by identity. With no other affected tests, the runner exits successfully without executing it, including through the explicit files segment.

Keep first-party TS/JS test files eligible even when their component is separate. Cover this through detectTestSelection; the new tests exercise only the lower-level selector.