convoy: flip visual-diff to a hard merge gate (harden-visual-diff-gate brief 2/2) #140

Merged

varutasu merged 1 commit from convoy/harden-visual-diff-gate-brief-2-flip-gate into main

2026-06-12 23:03:17 -04:00

varutasu commented

2026-06-12 22:59:20 -04:00

(Migrated from github.com)

Why

Brief 2/2 of `harden-visual-diff-gate`. PR #138 shipped the seed workflow; PR #139 (`54495fe`) landed the fresh baseline regenerated against post-glass-redesign main on CT 111. The gate can now flip without false-failing every UI-touching PR.

What

`visual-diff.yml` — drop `continue-on-error: true`. Visual drift is now a hard merge gate.
`ci.yml` — 9th `forbidden-patterns` check. Greps `visual-diff.yml` for `^\scontinue-on-error:\strue` and fails the build if it returns. Risk #3 of the convoy made concrete. Scoped narrowly to that one file. Job renamed "8 checks" → "9 checks"; all `Check N/8` labels renumbered.
`AGENTS.md` — sweep stale language. § Visual baselines drops the "Known staleness 2026-06-12" callout. § Screenshot diff leads with "hard merge gate", documents the intentional-change runbook, references the new ci.yml check, and explicitly calls out the org-setting caveat for the seed workflow's auto-PR step.
`tests/visual/homepage.spec.ts` — docblock rewrite. Matches the AGENTS.md runbook.
`seed-visual-baselines.yml` — patch the `peter-evans/create-pull-request@v6` failure case. Discovered during Brief 1's first dispatch (run 27454132468): the org has "Allow GitHub Actions to create and approve pull requests" disabled, so the PR-open sub-step fails. Branch is pushed cleanly even when this fails. Patched: `continue-on-error: true` on the create-PR step (narrowly scoped with inline rationale distinguishing it from the just-removed `visual-diff.yml` flag), plus new disambiguation steps that detect the branch-pushed-pr-blocked case via `git ls-remote` and exit non-zero with the exact `gh pr create` command in the failure notice.
`harden-visual-diff-gate.md` — convoy doc update. Status → shipping; Step 2 marked SHIPPED; Decision D4 added + ratified (option C: accept org setting, manual `gh pr create` fallback).

Decision D4 — peter-evans failure handling

Option	Picked?	Why
A. Flip the org-level setting on	No	Real surface increase — any future PR-creating workflow could be abused.
B. PAT `HOMELAB_CI_PAT`	No	Adds another rotating secret to the homelab inventory.
C. Manual `gh pr create` fallback documented as the runbook	Yes	Baseline regen is ~once-per-major-UI-change. Manual step is ~30s. No new attack surface or secret.

The workflow exits non-zero on outcome C so the operator can't miss the followup; failure logs include the exact ready-to-paste `gh pr create ...` command.

Test plan

`npm run lint` — clean (1 pre-existing unrelated warning)
`npm run test:run` — 24 files / 118 tests pass
CI on this PR: `Forbidden patterns (9 checks)` passes, `Screenshot diff` passes against fresh baseline, convoy-metrics-gate passes
After merge: smoke test the 9th check by opening a throwaway PR re-adding `continue-on-error` to `visual-diff.yml`; confirm it fails (or skip if confident in the grep)

Convoy closeout

After this PR merges, `harden-visual-diff-gate` is DONE:

Brief 1: SHIPPED (PR #138, `c100c5f`)
Baseline refresh: SHIPPED (PR #139, `54495fe`)
Brief 2 (this PR): shipping
All acceptance criteria from `.convoys/harden-visual-diff-gate.md` § Acceptance met.

Made with Cursor

## Why Brief 2/2 of \`harden-visual-diff-gate\`. PR #138 shipped the seed workflow; PR #139 (\`54495fe\`) landed the fresh baseline regenerated against post-glass-redesign main on CT 111. The gate can now flip without false-failing every UI-touching PR. ## What - **\`visual-diff.yml\` — drop \`continue-on-error: true\`.** Visual drift is now a hard merge gate. - **\`ci.yml\` — 9th \`forbidden-patterns\` check.** Greps \`visual-diff.yml\` for \`^\\s*continue-on-error:\\s*true\` and fails the build if it returns. Risk #3 of the convoy made concrete. Scoped narrowly to that one file. Job renamed \"8 checks\" → \"9 checks\"; all \`Check N/8\` labels renumbered. - **\`AGENTS.md\` — sweep stale language.** § Visual baselines drops the \"Known staleness 2026-06-12\" callout. § Screenshot diff leads with \"hard merge gate\", documents the intentional-change runbook, references the new ci.yml check, and explicitly calls out the org-setting caveat for the seed workflow's auto-PR step. - **\`tests/visual/homepage.spec.ts\` — docblock rewrite.** Matches the AGENTS.md runbook. - **\`seed-visual-baselines.yml\` — patch the \`peter-evans/create-pull-request@v6\` failure case.** Discovered during Brief 1's first dispatch (run 27454132468): the org has \"Allow GitHub Actions to create and approve pull requests\" disabled, so the PR-open sub-step fails. Branch is pushed cleanly even when this fails. Patched: \`continue-on-error: true\` on the create-PR step (narrowly scoped with inline rationale distinguishing it from the just-removed \`visual-diff.yml\` flag), plus new disambiguation steps that detect the branch-pushed-pr-blocked case via \`git ls-remote\` and exit non-zero with the exact \`gh pr create\` command in the failure notice. - **\`harden-visual-diff-gate.md\` — convoy doc update.** Status → shipping; Step 2 marked SHIPPED; Decision D4 added + ratified (option C: accept org setting, manual \`gh pr create\` fallback). ## Decision D4 — peter-evans failure handling | Option | Picked? | Why | |---|---|---| | A. Flip the org-level setting on | No | Real surface increase — any future PR-creating workflow could be abused. | | B. PAT \`HOMELAB_CI_PAT\` | No | Adds another rotating secret to the homelab inventory. | | C. Manual \`gh pr create\` fallback documented as the runbook | **Yes** | Baseline regen is ~once-per-major-UI-change. Manual step is ~30s. No new attack surface or secret. | The workflow exits non-zero on outcome C so the operator can't miss the followup; failure logs include the exact ready-to-paste \`gh pr create ...\` command. ## Test plan - [x] \`npm run lint\` — clean (1 pre-existing unrelated warning) - [x] \`npm run test:run\` — 24 files / 118 tests pass - [ ] CI on this PR: \`Forbidden patterns (9 checks)\` passes, \`Screenshot diff\` passes against fresh baseline, convoy-metrics-gate passes - [ ] After merge: smoke test the 9th check by opening a throwaway PR re-adding \`continue-on-error\` to \`visual-diff.yml\`; confirm it fails (or skip if confident in the grep) ## Convoy closeout After this PR merges, \`harden-visual-diff-gate\` is **DONE**: - Brief 1: SHIPPED (PR #138, \`c100c5f\`) - Baseline refresh: SHIPPED (PR #139, \`54495fe\`) - Brief 2 (this PR): shipping - All acceptance criteria from \`.convoys/harden-visual-diff-gate.md\` § Acceptance met. Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-06-12 22:59:25 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	Jun 13, 2026 2:59am

[vc]: #9EasKE9B2WHx/QUawfi/OFU8FNyB/xpETgyET5eemtw=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWNvbnZveS1oYXJkZW4tMGU2MTZmLXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIn0sImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMvdGNnLXZhdWx0LzZnNXJhdXFXTm5mU2RDY0ZWekplcGRETVVrU24iLCJwcmV2aWV3VXJsIjoidGNnLXZhdWx0LWdpdC1jb252b3ktaGFyZGVuLTBlNjE2Zi1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCJ9XSwicmVxdWVzdFJldmlld1VybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS92ZXJjZWwtYWdlbnQvcmVxdWVzdC1yZXZpZXc/b3duZXI9c3R3bC1sYWJzJnJlcG89dGNnLXZhdWx0JnByPTE0MCJ9 The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/6g5rauqWNnfSdCcFVzJepdDMUkSn) | [Preview](https://tcg-vault-git-convoy-harden-0e616f-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-convoy-harden-0e616f-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | Jun 13, 2026 2:59am | <a href="https://vercel.com/vercel-agent/request-review?owner=stwl-labs&repo=tcg-vault&pr=140" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-06-12 22:59:29 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	✅ pass
Visual diff	✅ pass

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ✅ pass | | Visual diff | ✅ pass | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.

github-actions[bot] commented

2026-06-12 23:02:00 -04:00

(Migrated from github.com)

Visual Diff

Screenshots and diffs uploaded as artifacts: view run

If intentional changes: update snapshots locally with npx playwright test --project=visual --update-snapshots and commit.

## Visual Diff Screenshots and diffs uploaded as artifacts: [view run](https://github.com/stwl-labs/tcg-vault/actions/runs/27454567471) If intentional changes: update snapshots locally with `npx playwright test --project=visual --update-snapshots` and commit.