ci: run the two test:ci-only drift checks in the workflow

[bitfathers94]

ci: run the two test:ci-only drift checks in the workflow

coco-dev-versions:check and import-specifiers:check were the last two
entries in package.json's test:ci aggregate with no GitHub Actions job
running them, so a version-pin drift or a per-zone import drift could
reach main with zero CI signal (the import guard already had that happen
twice after it shipped).

Add a cocoDev path filter (k8s/coco-dev/** plus the checker itself) and
two named validate-code steps, each gated the same way as the surrounding
drift steps. cocoDev is also added to the validate-code job-level if so a
PR touching only k8s/coco-dev/** still schedules the job and reaches the
new step's own gate; import-specifiers rides filters already in that if.

Also add a real-tree regression assertion so the import-specifier guard
is enforced by the vitest suite, not the workflow step alone.

Closes #9649

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-29 22:27:59 UTC}

3 files · 1 AI reviewer · no blockers · CI failing · unstable

🛑 Suggested Action - Fix Blockers

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/ci.yml (matched .github/workflows/**).

Review summary
This PR wires two previously CI-invisible drift checks (coco-dev-versions:check and import-specifiers:check) into ci.yml by adding a cocoDev path filter, extending validate-code's job-level gate, and adding two step-level gated steps, plus a new workflow-shape test and a real-tree regression assertion for the import-specifier checker. The wiring for coco-dev-versions:check is straightforward and correctly gated (cocoDev filter -> job-level if -> step if), and the new ci-testci-only-drift-checks-wired.test.ts asserts against the actual YAML content rather than a mock. The import-specifiers:check gate (backend + mcp + engine + miner + discoveryIndex) matches every filter shown in this diff/context, but I can't confirm from what's provided whether the checker's NODENEXT_ROOTS also covers packages/loopover-ui-kit, which is gated only by the separate `ui` filter — see nit below.

Nits — 6 non-blocking

• Verify scripts/check-import-specifiers.ts's NODENEXT_ROOTS doesn't include packages/loopover-ui-kit (which only matches the `ui` filter, not backend/mcp/engine/miner/discoveryIndex) — if it does, a ui-kit-only PR introducing a bad relative specifier there would skip the new 'Import-specifiers drift check' step entirely until the next push to main.
• The `scripts/check-coco-dev-versions*.ts` glob in the new cocoDev filter (.github/workflows/ci.yml) is a bit loose; confirm it's intentionally matching a companion test file and not accidentally over-matching unrelated scripts.
• The new regex assertion in test/unit/ci-testci-only-drift-checks-wired.test.ts against the raw filters: YAML text is brittle to reformatting (e.g. reordering the filter list), though that's an acceptable tradeoff for a regression guard on generated workflow text.
• Add a one-line comment or test assertion in test/unit/ci-testci-only-drift-checks-wired.test.ts confirming the import-specifiers gate list matches exactly the checker's NODENEXT_ROOTS/BUNDLER_ROOTS, so a future package addition (e.g. a new packages/* workspace) doesn't silently fall outside the gate the way ui-kit might already be.
• The Superagent Supply Chain Scan CI failure has no detail provided and this branch is 3 commits behind main; given the diff itself touches no dependencies, this is more likely explained by branch staleness than a defect in this PR — worth rebasing to confirm before merge.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

CI checks failing

• Superagent Supply Chain Scan — Supply chain risks detected

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9649
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 101 registered-repo PR(s), 69 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bitfathers94; Gittensor profile; 101 PR(s), 1 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal · LLM: moderate

Linked issue satisfaction

Addressed
The diff adds the cocoDev path filter, gates validate-code's job-level if on it, and adds two named steps for coco-dev-versions:check and import-specifiers:check with the required gating and explanatory comments, plus a real-tree regression test in check-import-specifiers-script.test.ts calling findImportSpecifierViolations() with no injected fakes and citing #9240/#9249 as required. This appears

Review context

• Author: bitfathers94
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript
• Official Gittensor activity: 101 PR(s), 1 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent Supply Chain Scan

Superagent flagged 1 dependency introduced by this pull request.

High risk: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9

• Change: added 55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• Dependency path: .github/workflows/ci.yml → jobs → validate-code → steps → 24 → actions/cache/restore
• Correlated risks: 3
• Why flagged: Detects keylogging and input capture patterns. Location: cache-55cc8345863c7cc4c66a329aec7e433d2d1c52a9/dist/restore-only/index.js. Rules: threat-runtime-keylogging
• Risk score: 4.9

View Superagent Supply Chain Scan

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.86%. Comparing base (d0e5aae) to head (5fb9c24).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9913   +/-   ##
=======================================
  Coverage   91.86%   91.86%           
=======================================
  Files         921      921           
  Lines      113242   113242           
  Branches    27293    27293           
=======================================
  Hits       104025   104025           
  Misses       7929     7929           
  Partials     1288     1288           

Flag	Coverage Δ
backend	95.68% <ø> (ø)
control-plane	100.00% <ø> (ø)
rees	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (CI is failing (Superagent Supply Chain Scan)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.