fix(tooling): fall back to uncached lints and force nightly scope

[d-oit]

Two follow-ups from the plans/147 and plans/149 sweeps, both in the same class: a check that looks like it ran.

1. The gate accused the wrong thing when its lint cache was missing (plans/147 §4.1)

quality_gate.sh sources scripts/lib/lint_cache.sh only when the file exists, but calls lint_if_changed unconditionally. With the library absent the helper is undefined, so every call failed as command not found and the gate reported ✗ shellcheck failed: <file> for every shell file — a false failure, with the cause invisible (that call discards stderr).

It now defines an uncached fallback and warns once. The contract is unchanged, and a real finding still fails the gate.

2. A scheduled run had no guaranteed scope (plans/149 §5.1)

The nightly's e2e-tests needs unit-tests, and both gate on changes.outputs.any_code. On a schedule there is no diff, so that value came from dorny/paths-filter's fallback (list every file as added) — verified in today's 07:59Z run (Detected 1404 changed files, any_code = true). It worked by accident; had it resolved to false, the nightly would have silently no-opped again.

A forced step now writes the outputs as true for schedule and workflow_dispatch, and every job output prefers it. PRs and pushes keep their real diff, so PR scope and cost are untouched.

Also in this PR, in the same file: two yamllint warnings cleared (truthy on on:, comment indentation on workflow_dispatch) and the SC2129 findings in both output steps.

Why today's nightly looked broken

The 07:59Z run skipped every job, but its head (064702a) predates the plans/149 fix (9d693ba, 10:14 UTC) — a scheduled run uses the workflow as it exists on the default branch at trigger time. The next nightly is the first scheduled execution of the fixed workflow.

Verification

• bats tests/quality-gate-lint-cache.bats — 3/3 pass; with the fix reverted, test 1 fails (reproduces the false failure) while the fail-closed test keeps passing.
• pnpm exec vitest run src/lib/__tests__/workflows.test.ts — 64/64; dropping the forced step fails the new contract test.
• ./scripts/quality_gate.sh — all gates passed. yamllint (CI parity) and actionlint exit 0.

Implementation record: plans/151.

---

📝 Summary by GitNexus

Summary

This appears to be a tooling and CI change focused on lint-cache fallback behavior and nightly test scope. The graph shows no dependent or execution-flow reach, but the workflow configuration warrants focused review.

🟠 HIGH blast radius. A tooling and CI change centered on scripts/quality_gate.sh and .github/workflows/ci-and-labels.yml, with no graph-resolved dependents.

Review scripts/quality_gate.sh alongside tests/quality-gate-lint-cache.bats first, since the PR title and branch indicate changes to uncached lint fallback behavior. The accompanying workflow test in src/lib/__tests__/workflows.test.ts and the nightly-scope plan material indicate that CI behavior is part of the change surface.

.github/workflows/ci-and-labels.yml is the HIGH-risk file. Confirm that its nightly scope aligns with the guard described by fix/lint-cache-fallback-and-nightly-guard, and that the script behavior remains covered when cached lint results are unavailable.

Added by GitNexus for PR #817. Edit freely — this block is replaced on the next review, everything above it is left untouched.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
do-knowledge-studio	Ready	Preview, v0	Sep 24, 2026 6:33pm UTC

[github-actions]

Blocked merge diagnosis — blocked
⏳ Check run(s) still in progress: ["shellcheck","Codacy Static Code Analysis","Diagnose Blocked Merge State","GitHub Actions Workflow Validation","Secret Detection","Detect Changes","Infrastructure as Code Security","Shell Script Security Analysis","commitlint","Trivy Filesystem Security Scan","labeler","Analyze (actions)","Analyze (javascript-typescript)"]

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[nexuscheck]

GitNexus Review · PR #817

2 issues found across 1 file.

🤖 Agent context — 4 symbols · 7 files

Summary

This appears to be a tooling and CI change focused on lint-cache fallback behavior and nightly test scope. The graph shows no dependent or execution-flow reach, but the workflow configuration warrants focused review.

🟠 HIGH blast radius. A tooling and CI change centered on scripts/quality_gate.sh and .github/workflows/ci-and-labels.yml, with no graph-resolved dependents.

Review scripts/quality_gate.sh alongside tests/quality-gate-lint-cache.bats first, since the PR title and branch indicate changes to uncached lint fallback behavior. The accompanying workflow test in src/lib/__tests__/workflows.test.ts and the nightly-scope plan material indicate that CI behavior is part of the change surface.

.github/workflows/ci-and-labels.yml is the HIGH-risk file. Confirm that its nightly scope aligns with the guard described by fix/lint-cache-fallback-and-nightly-guard, and that the script behavior remains covered when cached lint results are unavailable.

🟠 HIGH blast radius — no downstream dependents were found in the code graph; review the dependent list before merging.

Blast Level	Dependents	Modules	Files
🟠 HIGH	0	0	7

What changed

Symbol Changes (4)

Kind	Symbol	Location
Section	Plan 147 — 'quality_gate.sh --changed' Could Silently Check Nothing (2026-09-23)	plans/147-quality-gate-changed-scope-2026-09-23.md:1
Section	4. Follow-ups	plans/147-quality-gate-changed-scope-2026-09-23.md:140
Section	Plan 149 — Nightly E2E Sweep Covers Every Viewport (2026-09-24)	plans/149-nightly-full-viewport-e2e-2026-09-24.md:1
Section	5. Follow-ups	plans/149-nightly-full-viewport-e2e-2026-09-24.md:183

Changed Files (7)

File	Status
.github/workflows/ci-and-labels.yml	🟡 modified
plans/147-quality-gate-changed-scope-2026-09-23.md	🟡 modified
plans/149-nightly-full-viewport-e2e-2026-09-24.md	🟡 modified
plans/151-quality-gate-lint-cache-and-nightly-guard-2026-09-24.md	🟢 added
scripts/quality_gate.sh	🟡 modified
src/lib/__tests__/workflows.test.ts	🟡 modified
tests/quality-gate-lint-cache.bats	🟢 added

What to check

File Risk (2)

File	Risk	Category
.github/workflows/ci-and-labels.yml	🟠 HIGH	CI/CD
plans/151-quality-gate-lint-cache-and-nightly-guard-2026-09-24.md	🟢 LOW	Documentation

Prompt for AI agents (2 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.

<file name="src/lib/__tests__/workflows.test.ts">

<violation number="1" location="src/lib/__tests__/workflows.test.ts:219">
P2: Assert the forced output is evaluated before fallbacks — The new test documents that each output must prefer 'steps.forced.outputs.*', but 'toContain' also passes if that term is appended after an earlier fallback. With GitHub Actions '||' expressions, an earlier non-empty fallback wins, so such an ordering would not force scheduled/manual jobs even though this test passes.
</violation>

<violation number="2" location="src/lib/__tests__/workflows.test.ts:209">
P3: Verify that the forced step emits every forced path output — The test is named and documented as forcing every path, and the workflow's 'forced' step is expected to emit 'frontend=true', 'tooling=true', and 'any_code=true' ('.github/workflows/ci-and-labels.yml' lines 75-79). This assertion verifies only 'any_code=true'; the output-reference loop only verifies that the absent frontend/tooling step outputs would be mentioned, not that they are set. Thus deleting either emission would still pass this regression test while restoring fallback-dependent values for that output.
</violation>

</file>

Full detail lives in the GitNexus check run for this commit.

[nexuscheck]

GitNexus Review · PR #817

2 issues found across 1 file.

🤖 Agent context — 4 symbols · 7 files

Summary

This appears to be a tooling and CI change focused on lint-cache fallback behavior and nightly test scope. The graph shows no dependent or execution-flow reach, but the workflow configuration warrants focused review.

🟠 HIGH blast radius. A tooling and CI change centered on scripts/quality_gate.sh and .github/workflows/ci-and-labels.yml, with no graph-resolved dependents.

Review scripts/quality_gate.sh alongside tests/quality-gate-lint-cache.bats first, since the PR title and branch indicate changes to uncached lint fallback behavior. The accompanying workflow test in src/lib/__tests__/workflows.test.ts and the nightly-scope plan material indicate that CI behavior is part of the change surface.

.github/workflows/ci-and-labels.yml is the HIGH-risk file. Confirm that its nightly scope aligns with the guard described by fix/lint-cache-fallback-and-nightly-guard, and that the script behavior remains covered when cached lint results are unavailable.

🟠 HIGH blast radius — no downstream dependents were found in the code graph; review the dependent list before merging.

Blast Level	Dependents	Modules	Files
🟠 HIGH	0	0	7

What changed

Symbol Changes (4)

Kind	Symbol	Location
Section	Plan 147 — 'quality_gate.sh --changed' Could Silently Check Nothing (2026-09-23)	plans/147-quality-gate-changed-scope-2026-09-23.md:1
Section	4. Follow-ups	plans/147-quality-gate-changed-scope-2026-09-23.md:140
Section	Plan 149 — Nightly E2E Sweep Covers Every Viewport (2026-09-24)	plans/149-nightly-full-viewport-e2e-2026-09-24.md:1
Section	5. Follow-ups	plans/149-nightly-full-viewport-e2e-2026-09-24.md:183

Changed Files (7)

File	Status
.github/workflows/ci-and-labels.yml	🟡 modified
plans/147-quality-gate-changed-scope-2026-09-23.md	🟡 modified
plans/149-nightly-full-viewport-e2e-2026-09-24.md	🟡 modified
plans/151-quality-gate-lint-cache-and-nightly-guard-2026-09-24.md	🟢 added
scripts/quality_gate.sh	🟡 modified
src/lib/__tests__/workflows.test.ts	🟡 modified
tests/quality-gate-lint-cache.bats	🟢 added

What to check

File Risk (2)

File	Risk	Category
.github/workflows/ci-and-labels.yml	🟠 HIGH	CI/CD
plans/151-quality-gate-lint-cache-and-nightly-guard-2026-09-24.md	🟢 LOW	Documentation

Prompt for AI agents (2 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.

<file name="src/lib/__tests__/workflows.test.ts">

<violation number="1" location="src/lib/__tests__/workflows.test.ts:219">
P2: Assert the forced output is evaluated before fallbacks — The new test documents that each output must prefer 'steps.forced.outputs.*', but 'toContain' also passes if that term is appended after an earlier fallback. With GitHub Actions '||' expressions, an earlier non-empty fallback wins, so such an ordering would not force scheduled/manual jobs even though this test passes.
</violation>

<violation number="2" location="src/lib/__tests__/workflows.test.ts:209">
P3: Verify that the forced step emits every forced path output — The test is named and documented as forcing every path, and the workflow's 'forced' step is expected to emit 'frontend=true', 'tooling=true', and 'any_code=true' ('.github/workflows/ci-and-labels.yml' lines 75-79). This assertion verifies only 'any_code=true'; the output-reference loop only verifies that the absent frontend/tooling step outputs would be mentioned, not that they are set. Thus deleting either emission would still pass this regression test while restoring fallback-dependent values for that output.
</violation>

</file>

Full detail lives in the GitNexus check run for this commit.