feat: 670 per reviewer skip

.env.githubci

@@ -50,7 +50,7 @@ SCYLLA_HAS_ENTERPRISE_FEATURES='false'
 GRAPHQL_MAX_DEPTH=10
 EXPOSE_SENSITIVE_IMPLEMENTATION_DETAILS_IN_ERRORS=true
 ALLOW_USER_INPUT_LOCALHOST_URIS=true
-DATABASE_PRINT_LOGS=true
+DATABASE_PRINT_LOGS=false
 
 GROQ_SECRET_KEY=
 

.github/workflows/apply_pr_checks.yaml

@@ -277,6 +277,9 @@ jobs:
       - name: Lint client
         run: docker compose run --rm --quiet-pull client npm run lint
 
+      - name: Test client
+        run: docker compose run --rm --quiet-pull client npm run test:prepush
+
       - name: Build client
         run: docker compose run --rm --quiet-pull client npm run build
 

.github/workflows/e2e.yaml

@@ -82,6 +82,7 @@ jobs:
           cp server/.env.example server/.env
           cp db/.env.example db/.env
           cp client/.env.example client/.env
+          sed -i "s/^ITEM_QUEUE_TRAFFIC_PERCENTAGE=.*/ITEM_QUEUE_TRAFFIC_PERCENTAGE='1'/" server/.env
 
       - name: Install dependencies
         run: |
@@ -144,7 +145,7 @@ jobs:
           PLAYWRIGHT_BASE_URL: http://localhost:3000
 
       - name: Upload Playwright report
-        if: ${{ !cancelled() }}
+        if: ${{ failure() }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: playwright-report

.github/workflows/zizmor.yml

@@ -3,8 +3,10 @@ name: GitHub Actions security analysis
 on:
   push:
     branches: ['main']
+    paths: ['.github/workflows/**']
   pull_request:
     branches: ['**']
+    paths: ['.github/workflows/**']
 
 concurrency:
   group: zizmor-${{ github.ref }}

.nvmrc

@@ -1 +1 @@
-24.16.0
+24.18.0

AGENTS.md

@@ -200,6 +200,8 @@ Two things differ from a local dev setup:
 
 ## Human-approval-required actions
 
+Routine local setup and verification commands, including `npm ci` and existing build/test/lint/format/check scripts, do not require approval; the gates below apply to the changes being made, not merely to running commands.
+
 Stop and get explicit human approval before:
 
 - Changing license headers, copyright notices, or any legal text (including `LICENSE`).
@@ -208,7 +210,7 @@ Stop and get explicit human approval before:
 - Deleting or renaming an existing GraphQL type or field — this breaks cached Apollo client state and any downstream consumer. Additive changes are usually safe; removals need a migration plan.
 - Rewiring `server/iocContainer` in a way that changes service lifecycles or startup order — cascading effects on tests and boot.
 - Auth, session, or request middleware (under `server/api.ts`) — security-sensitive; prefer a small, reviewable PR with explicit callouts.
-- Adding, removing, or upgrading any library or package (including transitive dependencies in `package-lock.json`) — confirm licenses are compatible with Apache 2.0 and that there are no known CVEs.
+- Adding, removing, or upgrading any dependency (including transitive dependencies in `package-lock.json`) — confirm licenses are compatible with Apache 2.0 and that there are no known CVEs.
 - Multi-thousand-line diffs — ROOST policy is that reviewers can digest the change. Split into reviewable PRs; regenerated codegen and lockfile bumps are the only exceptions.
 
 ## Commit attribution

Dockerfile

@@ -7,7 +7,7 @@
 # Docker's cache will let us skip installs when the dependencies haven't changed.
 # We build on debian because it has fewer dependency issues than Alpine for our
 # native modules, and we don't really care about the larger image size.
-FROM node:24.14.1-bullseye-slim AS server_base
+FROM node:24.18.0-bullseye-slim AS server_base
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
 
@@ -19,7 +19,7 @@ FROM server_base AS build_backend
 RUN npm run build
 
 # make a shared layer that can be the base for worker and api images.
-FROM node:24.14.1-bullseye-slim AS backend_base
+FROM node:24.18.0-bullseye-slim AS backend_base
 WORKDIR /app
 RUN apt-get update && apt-get install dumb-init
 COPY --from=build_backend ["/app/package.json", "/app/package-lock.json", "./"]

client/.dockerignore

@@ -10,3 +10,4 @@
 !tailwind.config.js
 !tsconfig.json
 !nginx.conf
+!tsconfig.test.json

client/.eslintrc.cjs

@@ -23,7 +23,7 @@ module.exports = {
   extends: ['plugin:react/recommended', 'plugin:react-hooks/recommended'],
   parser: '@typescript-eslint/parser',
   parserOptions: {
-    project: ['./tsconfig.json'],
+    project: ['./tsconfig.json', './tsconfig.test.json'],
     tsconfigRootDir: __dirname,
   },
   ignorePatterns: [

client/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.14.1-bullseye-slim AS client_base
+FROM node:24.18.0-bullseye-slim AS client_base
 WORKDIR /app
 
 # ARG is used to get the release id into the ENV from the command line, and then
@@ -20,7 +20,7 @@ ARG VITE_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
 ENV DISABLE_ESLINT_PLUGIN=true
 RUN NODE_OPTIONS="--max-old-space-size=5250" VITE_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=$VITE_OTEL_EXPORTER_OTLP_TRACES_ENDPOINT npm run build
 
-FROM nginx:1.27-bookworm AS serve
+FROM nginx:1.29.1-bookworm AS serve
 COPY --from=build /app/build /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80

client/eslint/__tests__/customRules.test.js

@@ -1,22 +1,24 @@
-const { Linter } = require('eslint');
-const rule = require('../no-casting-in-getFieldValueForRole');
+import tsParser from '@typescript-eslint/parser';
+import { Linter } from 'eslint';
 
-const linter = new Linter();
+import rule from '../no-casting-in-getFieldValueForRole.js';
+
+const linter = new Linter({ configType: 'flat' });
 
 const runLint = (code) => {
-  const messages = linter.verify(code, {
-    plugins: {
-      custom: {
-        rules: {
-          'no-casting-in-getFieldValueForRole': rule,
-        },
+  const messages = linter.verify(code, [
+    {
+      plugins: {
+        local: { rules: { 'no-casting-in-getFieldValueForRole': rule } },
+      },
+      rules: { 'local/no-casting-in-getFieldValueForRole': 'error' },
+      languageOptions: {
+        parser: tsParser,
+        ecmaVersion: 2015,
+        sourceType: 'module',
       },
     },
-    rules: {
-      'custom/no-casting-in-getFieldValueForRole': 'error',
-    },
-    languageOptions: { ecmaVersion: 2015, sourceType: 'module' },
-  });
+  ]);
   return messages;
 };