ci: wire coco-dev-versions and import-specifiers drift checks into ci.yml

[hurryup52]

Summary

Two checks in test:ci — coco-dev-versions:check and import-specifiers:check — had no GitHub Actions job running them, so each could silently diverge with zero CI signal. import-specifiers:check (#9221) already had this happen twice (#9240, #9249). This wires both into ci.yml.

Five prior attempts on this issue

Five different contributors already opened PRs against this exact issue (#9894, #9913, #9927, #9928, #9929) — all closed, none merged. I looked into why before writing this one:

• ci: run the two test:ci-only drift checks in the workflow #9913, ci: run coco-dev-versions and import-specifiers drift checks in CI #9928, ci: two test:ci drift checks are never executed by any GitHub Actions job #9929 were each auto-closed for CI is failing (Superagent Supply Chain Scan), despite each PR's own review explicitly rating that signal Not blocking (Advisory). All three inserted the two new steps right after the existing "Branding drift check" step — a position before validate-code's five actions/cache/restore/actions/cache/save steps. That shifts those steps' position in the job's step array, and Superagent's scanner then flags the unchanged, already-repo-standard cache action as a "newly added risky dependency" — a false positive (a maintainer comment on unrelated PR ci(verifiability): verify our own public claims nightly, as an outsider #9973 describes the identical mechanism, and confirms it doesn't block an owner PR, but a contributor PR's auto-close heuristic acts on the raw "CI failing" signal regardless of the review's own advisory verdict). This PR instead adds both new steps at the very end of validate-code — after Upload UI bundle stats to Codecov, its current last step — which is after every cache step in the job, so nothing's position shifts.
• ci: wire coco-dev-versions and import-specifier checks into the workflow #9894 added the step-level if: cocoDev gate but never added cocoDev to validate-code's own job-level if:, so a PR touching only k8s/coco-dev/** would skip the whole job. This PR adds cocoDev inside the job-level condition's innermost parenthesized OR-group (verified the exact paren placement matters: appending it outside the draft-check wrapper instead would silently make a draft PR touching only k8s/coco-dev/** skip the draft-check bypass and run the whole heavy job unconditionally — ci-skip-draft-prs.test.ts only does substring checks, so it wouldn't catch that mistake).
• ci: wire the coco-dev-versions and import-specifiers drift checks into CI (#9649) #9927 was auto-closed for an unrelated reason (the author's contributor-PR-cap was exceeded).

What changed

• .github/workflows/ci.yml: new cocoDev filter output (k8s/coco-dev/**, scripts/check-coco-dev-versions*.ts), added to validate-code's job-level gate, plus two new named steps at the end of that job, each carrying a comment naming the gap it closes, matching the "Dead source-file check" step's shape as the issue specifies. import-specifiers:check's gate uses the issue's literal condition string verbatim (I confirmed by reading scripts/check-import-specifiers.ts that its NODENEXT_ROOTS scan technically also covers packages/loopover-ui-kit, gated only by the separate ui filter — but the issue's Deliverable 3 points at a byte-precise condition string, and this repo has precedent for exact-match tests on step if: strings in this file, so I kept the literal text rather than risk an unrequested deviation).
• test/unit/check-import-specifiers-script.test.ts: a real-tree regression test calling findImportSpecifierViolations() with no injected fakes, asserting [], citing chore(imports): packages/loopover-ui-kit drifted from #9221's extension convention (introduced by #9239) #9240/chore(imports): test/unit/engine-coverage-script.test.ts drifted from #9221's extension convention (introduced by #9245) #9249 — mirroring check-coverage-bolt-on-filenames-script.test.ts:51's exact shape.

Validation

• npm run actionlint — clean.
• npm run lint:composite-actions — clean (this PR touches no .github/actions/** content, so it's a no-op check here).
• npx vitest run test/unit/check-import-specifiers-script.test.ts test/unit/ci-skip-draft-prs.test.ts test/unit/observability-ci.test.ts test/unit/ci-engine-miner-filters.test.ts test/unit/ci-dependency-cache.test.ts — all pass, including the new real-tree test.
• Full npm run test:ci — green except two pre-existing failures in test/contract/validate-mcp.test.ts (a stdio MCP contract test hitting its 180s timeout under this run's system load) that are unrelated to this diff — confirmed by stashing this PR's changes and re-running that file alone against the clean tree: it passed (163s, just under the timeout), reproducing the same marginal timing flake with zero relation to ci.yml or the import-specifiers test.

Expectation

.github/workflows/** is a hard guardrail path, so this PR will be held for manual review, not auto-merged, regardless of how clean CI comes back — that's the correct, expected outcome for a workflow change here, not a failure signal.

Closes #9649

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-31 04:27:36 UTC}

2 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/ci.yml (matched .github/workflows/**).

Review summary
This PR wires `coco-dev-versions:check` and `import-specifiers:check` into `ci.yml`, which previously ran only via local `npm run test:ci` with zero CI signal (and had already drifted twice per #9240/#9249). The diff adds a `cocoDev` paths-filter output, threads it into `validate-code`'s job-level `if:` at the correct innermost OR position (so a draft PR touching only coco-dev paths still skips, unlike #9894's bug), and appends both new steps at the very end of `validate-code` (right after `Upload UI bundle stats to Codecov`, confirmed by the diff's own hunk context) so it doesn't shift the earlier cache-step positions that broke three prior attempts via a Superagent false positive. The added regression test calls the real `findImportSpecifierViolations()` with no args against the actual repo tree rather than a fabricated payload, and CI is green, so it is exercising the real path, not manufacturing state.

Nits — 6 non-blocking

• ci.yml:937-947 duplicates the backend/mcp/engine/miner/discoveryIndex filter list between the new 'Import specifiers check' step condition and other gating logic elsewhere in the file — worth a comment or shared reference if this list needs to grow again.
• The `scripts/check-coco-dev-versions*.ts` glob in the new `cocoDev` filter can't be verified against the actual script filename since the script itself isn't in this diff — confirm it matches the real file.
• The PR description text visible here doesn't show an explicit 'Closes ci: two test:ci drift checks are never executed by any GitHub Actions job #9649' line (it's truncated at 2000 chars), though the change is unmistakably scoped to that issue based on the extensive inline commentary.
• Consider a short top-of-file comment or doc note listing which `test:ci` checks are and are not yet wired into `ci.yml`, so a future gap like this is easier to spot without re-auditing the whole workflow.
• If the backend/mcp/engine/miner/discoveryIndex condition list is likely to keep growing, extract it to a reusable composite/step output rather than repeating it inline.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9649
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 24 registered-repo PR(s), 6 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	hurryup52; Gittensor profile; 24 PR(s), 0 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal

Linked issue satisfaction

Addressed
The diff adds the cocoDev path filter and includes it in validate-code's job-level if, adds both named steps at the end of validate-code (each gated per the issue's spec and commented in the required style), and adds a real-tree regression test calling findImportSpecifierViolations() with no injected fakes, asserting [] and citing #9240/#9249 as required.

Review context

• Author: hurryup52
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, TypeScript, Dart, MDX, Rust
• Official Gittensor activity: 24 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: guardrail_hold
• config: e7c19559a468f0d84534069a29b625433a44e75b1a30a30591d15cecda1b540c · pack: oss-anti-slop · ci: passed
• record: fd816353b4bf0f0ffab0aac3ff925e7c33e4a1c63784cc5b73964696d6bd3534 (schema v6, head c0e18d8)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.88%. Comparing base (244f3a9) to head (c0e18d8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9986   +/-   ##
=======================================
  Coverage   91.88%   91.88%           
=======================================
  Files         928      928           
  Lines      113722   113722           
  Branches    27436    27436           
=======================================
  Hits       104489   104489           
  Misses       7936     7936           
  Partials     1297     1297           

Flag	Coverage Δ
backend	95.67% <ø> (ø)
control-plane	100.00% <ø> (ø)
rees	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.