[ac-pplx]

Summary

Pull CI and the merge queue now run the admin console's unit tests, type
check and production build. Until now nothing in either ran ui/'s
npm test, tsc or npm run build, so two console pull requests that each
passed alone could merge and leave main's console broken. The only npm work
in CI was the console loop's checks in the SPACE Guide job.

• A new Admin console job in
  common-ci.yml runs, in ui/:
  npm ci --ignore-scripts, npm test, npx --no-install tsc --noEmit -p .
  and npm run build, on Node 22.23.3 with NEXT_TELEMETRY_DISABLED=1. It
  needs no network beyond the package install, and no secrets.
• A new scope, ci/check-scopes/console.run,
  lists ui/**. ui/ imports and reads nothing from outside itself, and the
  workflow and CI scripts are already in run-all.txt. A change outside
  ui/ skips the job, and the skipped job passes.
• The job restores the npm cache. ui/package-lock.json is now one of
  that cache's inputs in
  package-cache.py and in the trim before a
  save. The SPACE Guide job saves that cache, so on main it also installs
  ui/'s packages, and the copy it saves holds them.
• --no-install: if TypeScript were missing, plain npx tsc would fetch the
  unrelated tsc package and exit 0.

A failed console job fails common, and space-pull-ci in both
pull-ci.yml and
merge-queue-ci.yml already requires
common to succeed. Neither aggregator changes.

Validation

• The job's commands at this head, on a box limited to 4 cores: install
  4.5 s, tests 1.9 s (363 pass), type check 3.8 s, build 39 s, total about
  49 s. That is with an empty npm cache; with a warm cache the total is about
  41 s.
• On a draft branch with one extra commit that passes a number to
  URLSearchParams in ui/src/lib/sandbox-list.ts, the same commands stop at
  tsc with TS2345 while all 363 unit tests pass. On GitHub's runners, as
  the do-not-merge draft DO NOT MERGE: show the console CI job failing #1650 (now closed): install and tests passed, the
  type check failed with that TS2345, and space-pull-ci failed with it.
• The tests, type check and build all pass inside a network namespace that
  has no network.
• ci/scripts/test-check-needed.sh (new console cases) passes. It fails
  without console.run. scripts/tests/test_package_cache.py passes.
• The npm key changes when ui/package-lock.json changes. After trim with
  the three lockfiles, npm ci --offline in ui/ succeeds. With the old two
  lockfiles it fails.
• actionlint 1.7.12 with shellcheck reports nothing new on common-ci.yml.
  The only findings are ones main already has.
• Merge queue: the reuse record names the base and merge trees, and the
  workflow files are part of those trees. A reused Pull CI run therefore ran
  this same job on the same tree, and its record exists only if common
  passed.
• On GitHub's runners at this head, the Admin console job passed in 75 s.

Severity and risk

Severity: medium. Without this gate, console breakage reached main
silently.

Risk: a console pull request whose build or type check is already broken now
fails CI. Every pull request that changes ui/, a workflow or a CI script
gains a job of a minute or two, which runs alongside the other jobs.
The npm cache key changes once, so the first main run after the merge saves
a new copy. To roll back, revert the commit.

Rollout

This changes only CI and has no runtime peers. Open pull requests run the new
job on their next run after the merge, since their merge commit then includes
it.

AI assistance: Claude Code drafted the code, the commit and this description.

🤖 Generated with Claude Code

[coderabbitai]

Automatic approval withheld

Automatic approval is disabled by the configured approval policy for this pull request. Review comments and requests for changes continue normally.

Commit: 232ed142a7af.

No actionable comments were generated in the recent review.

Walkthrough

The pull request adds a scoped CI job for the admin console. The job restores the shared npm cache, installs UI dependencies, runs tests and TypeScript checking, and builds the console. The npm cache inputs now include the UI lockfile. Scope documentation and regression checks describe when the console check runs.

Possibly related PRs

• perplexityai/SPACE#1434: Adds the .run scope contract used to select checks based on changed paths.

Merge Risk: Minimal · up to 232ed

The console gains CI checks without an identified merge-blocking issue; merge after normal checks.

Security architecture risk: Low · up to 232ed

The new console checks use a read-only job without persisted checkout credentials. Shared-cache publication remains restricted to successful main-branch runs. No concrete security regression was found; the remaining exposure is bounded to CI execution and dependency caching.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Pull-request changes to UI scripts, tests, or dependencies can influence code executed in the new console runner. The reviewed path exposes that runner’s workspace and shared npm cache consumption, but supplies no production credentials or deployment step. The shared-cache dependency spans the documentation, console-loop, and UI consumers.

Trust Boundaries and Controls

• observed — The new console job restores and consumes the npm cache without a save step. The existing Guide publication path remains gated on a successful push to main, a save decision, and successful upload preparation. Adding the UI consumer does not relax those publication conditions.

Resilience and Maintainability Implications

• inferred — A failed install can still reach cache reporting, but cannot pass the subsequent success-gated preparation required for publication. A restore without a matched key clears the local cache directory, and a fallback from different inputs requests a fresh publication. These paths preserve cache failure containment in the expanded flow.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title describes the console CI checks and meets the title requirements.
Description Follows The Pr Template		The description contains all four required items: Summary, Validation, Severity and risk, and an AI assistance line with the tool and its contributions.
Bug Fixes Name A Regression Test		The PR changes CI and documentation. It does not fix application behavior under crates/, shim/, or ui/.
Weakened Safeguards Are Justified		The diff does not remove or weaken an existing safeguard. The new console check has a documented scope. Its reused cache restore step can fail without stopping the job because a cache miss only requir…
Public-Safe Content		The diff, title, and description contain no content that matches the stated failure conditions.

Full details: Weakened Safeguards Are Justified

Explanation

The diff does not remove or weaken an existing safeguard. The new console check has a documented scope. Its reused cache restore step can fail without stopping the job because a cache miss only requires a download.

Recent review info

Automatic approval policy

Commit: 232ed142a7af.

Setting	Effective value	Source
Automatic approvals	Disabled	Override 4
Merge risk	Low	Override 2
Security risk	Not set	Global configuration

Matching overrides (numbered as in the resolved configuration):

• Override 2 — any author; paths: **, !ui/**; merge risk: Low.
• Override 4 — any author; paths: .coderabbit.yaml, .coderabbit.yml, coderabbit.yaml, coderabbit.yml, .coderabbit.config.ts, **/AGENTS.md, **/CLAUDE.md, .agents/**, .claude/**, .claude-plugin/**, CONTRIBUTING.md, docs/versioning.md, docs/rust/space-conventions.md, docs/rust/space-review-lessons.md, .github/**, ci/**, !ci/scripts/setup-nextest-*.sh, scripts/source_guards/**, scripts/check*, clippy.toml, deny.toml, .gitleaks.toml, .pre-commit-config.yaml, lefthook.yaml, rust-toolchain.toml, .cargo/**, supply-chain/**, pyproject.toml, uv.lock, **/package.json, **/package-lock.json, **/go.mod, **/go.sum, **/requirements*.txt, **/requirements*.in, proto/**, db/**, crates/l40_api/api/src/auth.rs, crates/l40_api/api/src/auth/**, crates/l40_api/api/src/middleware/auth*, crates/l40_api/api/src/middleware/auth/**, crates/l40_api/api/src/routes/authz.rs, crates/l10_foundation/bearer/**, crates/l10_foundation/rustls/**, crates/l10_foundation/guest/**, crates/l10_foundation/pii/**, shim/**, docker/**, !docker/Dockerfile.rust-build-kind, templates/**, infra/space/aws/**, infra/space/cluster/**, infra/space/identity/**, infra/space/observability/**, infra/space/packer/**, infra/space/kind/charts/**, LICENSE, SECURITY.md; automatic approvals: disabled.

Any matching disabled override withholds approval, regardless of risk. Otherwise, the strictest explicitly set limit wins for each score. Limits omitted by all matching overrides inherit the global configuration.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: perplexityai/SPACE
• Branch: main
• File: .coderabbit.yaml
• Commit: 94c51e4
• Layers: Repository YAML; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 995087a5-d8c8-4e26-883a-6f0e3ea0a6b1

Commits

Reviewing files that changed from the base of the PR and between 94c51e4 and 232ed14.

Files selected for processing: 6

• .github/workflows/common-ci.yml
• CONTRIBUTING.md
• ci/check-scopes/README.md
• ci/check-scopes/console.run
• ci/scripts/package-cache.py
• ci/scripts/test-check-needed.sh

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 1 remain after this review.

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.

[johnlouie-pplx]

Approving. This puts the console's tests, type check, and build behind the existing required check. The new job passed, and the separate type-error check confirmed that a console failure reaches that gate.