ci(workflows): exclude pages/api/** from visual-diff path filter #26

Merged

varutasu merged 1 commit from convoy/tighten-visual-diff-path-filter into main

2026-05-26 23:51:22 -04:00

varutasu commented

2026-05-26 23:49:53 -04:00

(Migrated from github.com)

Summary

Tighten .github/workflows/visual-diff.yml's paths: filter so API-only PRs no longer trigger the Screenshot diff workflow. Single negated-glob entry inserted immediately after pages/**. Closes the queued tighten-visual-diff-path-filter follow-up tracked in .convoys/ship-readiness.md § Queued convoys.

Why

pages/** matches pages/api/** too, so any PR touching only API routes (Next.js Pages-router backend) was triggering the visual-diff workflow even though it can't possibly move a single rendered pixel. Empirical false-positives:

PR #19 cors-tighten (squash da50d78) — 24 files, all under pages/api/**. Triggered Screenshot diff, swallowed via continue-on-error: true.
PR #20 add-rate-limiting (squash 708ef45) — 6 routes under pages/api/ plus lib/rate-limit.js and pages/admin/card-import.js. Same false-trigger.

Cost per false-trigger: ~55s of CI runtime — wait-for-vercel-preview against the deployed preview, plus Playwright npm ci + npx playwright install + the visual project run. The job exits 0 (Decision-4 end state of adopt-playwright-smoke until seed-visual-baselines-on-linux lands), but it still posts a "Visual Diff — view run" comment and clutters the Checks tab with a green-but-meaningless run.

The change

Single edit in .github/workflows/visual-diff.yml:

paths:
  - 'pages/**'
  - '!pages/api/**'   # NEW — must follow 'pages/**' to subtract from it
  - 'components/**'
  - 'styles/**'
  - 'tailwind.config.js'
  - 'postcss.config.js'

GitHub Actions evaluates paths: with minimatch and supports !-prefixed exclusions per the published path-filter cheatsheet. Order matters: a !pattern only takes effect if it appears AFTER an include that already matched the path. Hence !pages/api/** sits at index 1, immediately after pages/**.

All five existing entries are preserved verbatim; only the one exclusion entry plus an inline comment block (explaining the ordering rule and naming the empirical PRs that motivated this) is added.

preview-smoke.yml is intentionally untouched — its on: block has no paths: filter at all (triggers on every PR targeting main, with skip-via-PR-body-directive in the gate job). There is no false-positive shape to fix there. Smoke SHOULD run on every PR, including API-only ones, because changes to pages/api/** can break the home-redirect / sign-in / /api/health endpoints the smoke spec exercises. Documented in the convoy file's § Scope.

Test plan (post-merge verification)

YAML parse + lint baseline + vitest were all green at commit time, but those don't actually verify the path filter works — only that we didn't break anything else. The only true verification is that the next API-only PR after this merges does NOT trigger Screenshot diff. The convoy file's § Verification plan documents this explicitly as deferred-to-post-merge; the doc-writer pass that closes the convoy will record the next API-only PR's number + a "Screenshot diff: not triggered" line as the as-shipped success criterion (mirroring .convoys/fix-reset-db-script.md's same line for scripts/** PRs).

We deliberately do NOT live-verify by pushing a throwaway API-only commit to a sacrificial branch and watching CI — that'd be theater. GitHub's path-filter semantics are documented and stable; the YAML parse + the syntax match against the published cheatsheet is enough pre-merge confidence for a P3-polish convoy.

Pre-merge gates (recorded at convoy time):

YAML parses; `paths:` deserializes to `['pages/', '!pages/api/', 'components/', 'styles/', 'tailwind.config.js', 'postcss.config.js']` (order-sensitive)
`npm run lint` → exit 1 with 128 problems (baseline preserved)
`npm run test:run` → 21/21 in ~1s

Follow-ups

seed-visual-baselines-on-linux (P3 polish, already queued by adopt-playwright-smoke) — once visual baselines are seeded under tests/visual/__screenshots__/ from a Linux runner, the Screenshot diff job will start posting real visual-diff comparisons and continue-on-error: true can be removed. Orthogonal to this PR.
Fallback-if-needed — if the post-merge verification step shows the exclusion didn't fire (R1 in the convoy file), restructure the paths: filter to per-feature globs (pages/dashboard.js, pages/cards/**, pages/decks/**, …). Track only if R1 actually surfaces.

Made with Cursor

## Summary Tighten `.github/workflows/visual-diff.yml`'s `paths:` filter so API-only PRs no longer trigger the `Screenshot diff` workflow. Single negated-glob entry inserted immediately after `pages/**`. Closes the queued `tighten-visual-diff-path-filter` follow-up tracked in `.convoys/ship-readiness.md` § Queued convoys. ## Why `pages/**` matches `pages/api/**` too, so any PR touching only API routes (Next.js Pages-router backend) was triggering the visual-diff workflow even though it can't possibly move a single rendered pixel. Empirical false-positives: - **PR #19 `cors-tighten`** (squash `da50d78`) — 24 files, all under `pages/api/**`. Triggered `Screenshot diff`, swallowed via `continue-on-error: true`. - **PR #20 `add-rate-limiting`** (squash `708ef45`) — 6 routes under `pages/api/` plus `lib/rate-limit.js` and `pages/admin/card-import.js`. Same false-trigger. Cost per false-trigger: ~55s of CI runtime — `wait-for-vercel-preview` against the deployed preview, plus Playwright `npm ci` + `npx playwright install` + the `visual` project run. The job exits 0 (Decision-4 end state of `adopt-playwright-smoke` until `seed-visual-baselines-on-linux` lands), but it still posts a "Visual Diff — view run" comment and clutters the Checks tab with a green-but-meaningless run. ## The change Single edit in `.github/workflows/visual-diff.yml`: ```yaml paths: - 'pages/**' - '!pages/api/**' # NEW — must follow 'pages/**' to subtract from it - 'components/**' - 'styles/**' - 'tailwind.config.js' - 'postcss.config.js' ``` GitHub Actions evaluates `paths:` with minimatch and supports `!`-prefixed exclusions per the [published path-filter cheatsheet](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#patterns-to-match-file-paths). **Order matters**: a `!pattern` only takes effect if it appears AFTER an include that already matched the path. Hence `!pages/api/**` sits at index 1, immediately after `pages/**`. All five existing entries are preserved verbatim; only the one exclusion entry plus an inline comment block (explaining the ordering rule and naming the empirical PRs that motivated this) is added. `preview-smoke.yml` is intentionally untouched — its `on:` block has no `paths:` filter at all (triggers on every PR targeting `main`, with skip-via-PR-body-directive in the gate job). There is no false-positive shape to fix there. Smoke SHOULD run on every PR, including API-only ones, because changes to `pages/api/**` can break the home-redirect / sign-in / `/api/health` endpoints the smoke spec exercises. Documented in the convoy file's § Scope. ## Test plan (post-merge verification) YAML parse + lint baseline + vitest were all green at commit time, but those don't actually verify the path filter works — only that we didn't break anything else. The **only true verification** is that the **next API-only PR after this merges does NOT trigger `Screenshot diff`**. The convoy file's § Verification plan documents this explicitly as deferred-to-post-merge; the doc-writer pass that closes the convoy will record the next API-only PR's number + a "Screenshot diff: not triggered" line as the as-shipped success criterion (mirroring `.convoys/fix-reset-db-script.md`'s same line for `scripts/**` PRs). We deliberately do NOT live-verify by pushing a throwaway API-only commit to a sacrificial branch and watching CI — that'd be theater. GitHub's path-filter semantics are documented and stable; the YAML parse + the syntax match against the published cheatsheet is enough pre-merge confidence for a P3-polish convoy. Pre-merge gates (recorded at convoy time): - YAML parses; \`paths:\` deserializes to \`['pages/**', '!pages/api/**', 'components/**', 'styles/**', 'tailwind.config.js', 'postcss.config.js']\` (order-sensitive) - \`npm run lint\` → exit 1 with **128 problems** (baseline preserved) - \`npm run test:run\` → **21/21** in ~1s ## Follow-ups - **`seed-visual-baselines-on-linux`** (P3 polish, already queued by `adopt-playwright-smoke`) — once visual baselines are seeded under `tests/visual/__screenshots__/` from a Linux runner, the `Screenshot diff` job will start posting real visual-diff comparisons and `continue-on-error: true` can be removed. Orthogonal to this PR. - **Fallback-if-needed** — if the post-merge verification step shows the exclusion didn't fire (R1 in the convoy file), restructure the `paths:` filter to per-feature globs (`pages/dashboard.js`, `pages/cards/**`, `pages/decks/**`, …). Track only if R1 actually surfaces. Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-26 23:49:58 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 27, 2026 3:49am

[vc]: #5lQrnpaI4xwc/et6se9yhi+LtkS/YEelzNO9dbGqO0Q=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWNvbnZveS10aWdodGVuLTRlZjNiNy1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCJ9LCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20vcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzL3RjZy12YXVsdC9FbnJSRGdrWEx4M1dmWU1RdEttQ0ZFZXN4a3FWIiwicHJldmlld1VybCI6InRjZy12YXVsdC1naXQtY29udm95LXRpZ2h0ZW4tNGVmM2I3LXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIn1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj12YXJ1dGFzdSZyZXBvPXRjZy12YXVsdCZwcj0yNiJ9 The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/EnrRDgkXLx3WfYMQtKmCFEesxkqV) | [Preview](https://tcg-vault-git-convoy-tighten-4ef3b7-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-convoy-tighten-4ef3b7-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 27, 2026 3:49am | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=26" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-26 23:50:02 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	✅ pass
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ✅ pass | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.