Restore PR CI; build the Kotlin for CodeQL; OpenCode security review

[HereLiesAz]

CI. .github/workflows/ci.yml is back. It is the source that central CI Validation binds to by hash, so the controller swaps it for a tracker. It runs:

• workspace build + test on Node 24;
• the conformance-fixture drift check;
• the Compose storefront: Wasm, Android assembleDebug, desktopTest, :azp:test.

Needs HereLiesAz/workflows#83 (hash 37131af3…).

CodeQL. java-kotlin used autobuild, which finds no build at the repo root, so it failed on every run including main. It is now a manual build:

• Java 17;
• ./gradlew compileKotlinDesktop :azp:compileKotlin in apps/storefront-cmp, run under the tracer;
• version frozen.

CodeQL 2.27.1 (the version the runner uses) supports Kotlin 2.4.20.

Security review. .github/workflows/security-review.yml binds to the new central opencode-security-review.yml. It is a read-only OpenCode review of each PR, posted as one comment and advisory only. It replaces the Copilot security review. Needs HereLiesAz/workflows#84 (hash f92c8098…).

After it lands, turn off the Copilot review in Settings → Code security / Copilot → Code review so the failing github-advanced-security check stops appearing.

Order: workflows#83 and #84 merge first, then this PR.

Validated locally:

• pnpm fixtures shows no drift.
• The CodeQL compile command succeeds.
• desktopTest and :azp:test pass.
• assembleDebug and Wasm were not run here: this sandbox has no Android SDK, and yarn gets a 403 from codeload. Both run on the hosted runner.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QwYWVPse8spRrfMMcuTJPv

Summary by Sourcery

Restore repository validation, make Kotlin CodeQL analysis build successfully, and replace the pull-request security review with an advisory OpenCode workflow.

New Features:

• Restore pull-request and push CI validation for workspace builds, tests, conformance fixtures, and Compose storefront checks.
• Add an advisory OpenCode security review workflow for pull requests.

Bug Fixes:

• Fix Kotlin CodeQL analysis by replacing repository-root autobuild detection with a manual storefront build.

Enhancements:

• Configure CodeQL Kotlin analysis with the storefront Java 17 toolchain and relevant Kotlin compilation targets.

CI:

• Run CI validation on Node 24 and the Compose storefront on the hosted runner.
• Replace the previous Copilot security review workflow with the centrally managed OpenCode review.

Tests:

• Add automated detection of stale conformance fixtures.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
azphalt	Error		Sep 27, 2026 6:17am UTC

[sourcery-ai]

Reviewer's Guide

Restores hash-bound CI validation and expands it to cover workspace, fixture, and Compose storefront checks, while fixing CodeQL Kotlin analysis by using a Java 17 manual Gradle build from the storefront project instead of repository-root autobuild.

Sequence diagram for manual Kotlin CodeQL build

sequenceDiagram
    participant CodeQL as CodeQL workflow
    participant Runner as GitHub runner
    participant Gradle as storefront-cmp Gradle
    participant Kotlin as Kotlin compiler

    CodeQL->>Runner: setup-java Java 17
    CodeQL->>Gradle: compileKotlinDesktop
    CodeQL->>Gradle: :azp:compileKotlin
    Gradle->>Kotlin: compile Kotlin sources under tracer
    Kotlin-->>Gradle: compilation results
    Gradle-->>CodeQL: build succeeds
    CodeQL->>CodeQL: analyze

Loading

File-Level Changes

Change	Details	Files
Restores the repository CI workflow with Node and Compose storefront validation jobs.	Adds workspace install, build, and test validation on Node 24. Adds a generated conformance-fixture drift check. Adds Wasm, Android debug assembly, desktop tests, and Kotlin verifier tests for the Compose storefront. Pins the storefront validation to Java 17 and prevents version mutation during CI.	.github/workflows/ci.yml
Replaces failing CodeQL Kotlin autobuild with a traced Gradle compilation tailored to the storefront project.	Switches the java-kotlin matrix entry from autobuild to manual mode. Configures Corretto Java 17 for Kotlin analysis. Compiles the desktop Kotlin source and the azp subproject from apps/storefront-cmp under CodeQL tracing. Disables Gradle build cache and freezes the project version during analysis.	.github/workflows/codeql.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sourcery-ai]

Sorry @HereLiesAz, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.