review-ci

name	review-ci
description	CI, GitHub Actions, caching, hooks, deploy review. USE WHEN: user runs /review-ci or explicitly asks for this review. DO NOT USE WHEN: implementing features or fixing bugs unless the user asked for a review.
disable-model-invocation	true

Review CI

Run a CI-focused review: GitHub Actions workflow, caching, lockfile and reproducibility, branch/trigger strategy, Dependabot, Husky pre-commit, and deploy pipeline. Your reply must be a plan of suggested changes: concise, actionable, and structured-not only prose.

Invocation

Text after the slash command is additional scope/focus - narrow the review accordingly. If none given, use the default scope described below.

Best practices alignment

• Workflow - Checkout with sufficient fetch depth when needed; Node and pnpm versions pinned and aligned with package.json engines/packageManager; steps run in a sensible order (install → lint → typecheck → build).
• Caching - pnpm store and optionally Turborepo remote cache to speed runs; cache keys include lockfile hash where appropriate.
• Reproducibility - CI install uses --frozen-lockfile (or equivalent) so builds fail on lockfile drift; same Node/pnpm versions as local dev.
• Permissions - Minimal permissions (e.g. contents: read for CI that only needs to read repo); no write unless deploy or release.
• Secrets - No secrets in logs; use GitHub secrets for any tokens; mask in outputs if needed.
• Hooks - Pre-commit runs formatter/lint on staged files; fast and deterministic (e.g. oxfmt format only or check).
• Deploy - Deploy step separate from main CI or behind approval; optional smoke/health check after deploy.

Align with root AGENTS.md for root pnpm scripts and tooling.

Deep technical review

Conduct a CI-only review. Inspect the following and call out violations or improvements.

GitHub Actions workflow

• Artifacts: .github/workflows/ci.yml.
• Checks: Action versions match the repository's current supported workflow versions; fetch-depth: 0 (blobless) when --affected needs full history. pnpm derives its version from packageManager; Node matches engines; pnpm store cache enabled. Steps: frozen install; parallel boundaries + lint:check + format:check + (check-types --affected and types:check); then turbo run build --affected with VITE_API_BASE_URL set. Does not invoke root pnpm run ci as a single step (local pnpm run ci is the full-repo PR gate including build). Job and step names are clear. Permissions stay least-privilege (contents: read for non-deploy CI). Remote cache via TURBO_TOKEN/TURBO_TEAM when configured. No secrets are echoed; same-branch concurrency may cancel superseded PR runs.

Caching

• Artifacts: .github/workflows/ci.yml, turbo.json, package.json.
• Checks: pnpm cache: enabled via cache: 'pnpm' in setup-node or pnpm/action-setup. Turborepo: if remote cache used, token and config correct; otherwise local cache only. Cache key: include lockfile or pnpm-lock.yaml hash so cache invalidates on dependency change. No overly broad keys that cause unnecessary cache misses.

Lockfile and reproducibility

• Artifacts: .github/workflows/ci.yml, package.json (scripts) / CI frozen install, package.json (engines, packageManager), pnpm-lock.yaml.
• Checks: Install command uses frozen lockfile (e.g. pnpm install --frozen-lockfile or pnpm install --frozen-lockfile). Lockfile committed. packageManager in package.json matches pnpm version used in CI. engines.node matches Node version in workflow. No pnpm install without frozen in CI (would allow drift).

Branch and trigger strategy

• Artifacts: .github/workflows/ci.yml.
• Checks: Trigger: push to all branches (or to main/beta and PRs) as documented. Pull requests: if CI runs on PR, it uses same workflow. No redundant triggers that double runs unless intended. Optional: only run on certain paths (paths-filter) if repo is large and some changes don’t need full build.

Dependabot and dependency updates

• Artifacts: .github/dependabot.yml (if present), root and app package.json.
• Checks: Dependabot configured for npm (or pnpm); schedule and open-pull-requests-limit set. Grouping: optional groups (e.g. minor-patch) to reduce PR noise. Versioning strategy: allow or ignore as needed. CI runs on Dependabot PRs so updates are validated.

Husky and pre-commit

• Artifacts: .husky/pre-commit, root package.json (prepare script), .oxfmtrc.json, .oxlintrc.json.
• Checks: Pre-commit hook runs formatter (oxfmt) on staged files only; command is fast (no full lint if format is enough for pre-commit). Use git-format-staged or lint-staged so only staged files are processed. Hook is executable and invoked by Husky. pnpm prepare (or equivalent) installs hooks; documented in AGENTS.md or README. No heavy steps (e.g. full build) in pre-commit.

Deploy pipeline

• Artifacts: .github/workflows/ (any deploy workflow), package.json (deploy script), turbo.json (deploy task).
• Checks: Deploy is separate job or workflow (e.g. on push to main or manual); not mixed with lint in a way that blocks on deploy secrets. Deploy uses same build artifact or rebuilds with same lockfile. Optional: health check or smoke test after deploy (e.g. curl health endpoint). No deploy on every branch unless intended (e.g. preview deploys). Permissions for deploy: only what’s needed (e.g. Cloudflare API token in secrets).

Observability and debugging

• Artifacts: .github/workflows/ci.yml.
• Checks: Failures: step names and job names make it clear where it failed. Optional: upload build or test artifacts on failure for debugging. Logs: no secrets printed; verbose logging only where needed. Optional: status badge in README.

Anti-patterns to flag

• CI install without frozen lockfile (allows drift).
• Node or pnpm version in workflow not matching package.json engines/packageManager.
• Permissions broader than needed (e.g. contents: write when not deploying).
• Pre-commit running full build or slow lint on every commit.
• Deploy on every push to every branch without protection.
• No cache for pnpm or Turborepo when it would speed up runs.
• Dependabot disabled or not validating PRs with CI.

Steps

1. Gather scope - Full CI or specific area (workflow, cache, hooks, deploy, Dependabot). Default to full.
2. Read conventions - AGENTS.md for root scripts (install --frozen-lockfile, check, check-types, build, deploy) and tooling.
3. Inspect workflow - ci.yml: checkout, setup-node, pnpm, install, check, check-types, build; permissions and triggers.
4. Inspect caching - pnpm and Turborepo cache usage; cache keys.
5. Inspect lockfile and install - install-frozen; packageManager and engines; lockfile committed.
6. Inspect Dependabot and Husky - dependabot.yml; .husky/pre-commit and prepare target.
7. Inspect deploy - Deploy workflow or job; permissions; optional health check.
8. Compose plan - Critical / Improvements / Optional; each item: what, where, why. One-line "no issues" per sub-area if none.

Checklist

• Scope clear
• AGENTS.md consulted for pnpm scripts and tooling
• GitHub Actions workflow (steps, versions, permissions) reviewed
• Caching (pnpm, Turborepo) reviewed
• Lockfile and frozen install reviewed
• Branch/trigger strategy reviewed
• Dependabot and pre-commit (Husky/oxfmt) reviewed
• Deploy pipeline and optional smoke test reviewed
• Plan structured as Critical / Improvements / Optional with what/where/why

Context usage

• Use @file for ci.yml, dependabot.yml, .husky/pre-commit, turbo.json, package.json.
• Use @code for specific workflow steps or cache keys when suggesting changes.
• Use @docs or @web for GitHub Actions and pnpm/Turborepo caching best practices.

If context is insufficient, suggest which files or @ references to add.

Review checklist

• Correctness: Workflow runs the right commands in the right order; frozen install is used.
• Conventions: Matches AGENTS.md (pnpm install --frozen-lockfile, pnpm check, pnpm check-types, pnpm build).
• Quality: Reproducible, fast where possible (cache), minimal permissions.
• Actionability: Every suggestion is implementable (e.g. "add cache key", "set fetch-depth").
• Trade-offs: Note any (e.g. cache size vs hit rate).
• Scope: CI only; defer config or security to their reviews.

Output format

Respond with a plan only (no implementation unless the user asks):

1. Critical – Must-fix (no frozen lockfile, wrong Node/pnpm version, permissions too broad, pre-commit broken).
2. Improvements – Worthwhile (caching, explicit permissions, Dependabot grouping, deploy health check).
3. Optional – Nice-to-haves (concurrency, path filters, status badge). Prefix with Nit: for non-blocking polish.

For each item: what to change, where (file/area), and why. If a sub-area has no findings, state it in one line.