chore: rm orphan notion-sync.ts copies - #32
Conversation
Both copies were MD5-identical (45723e4b30dfd91864ec2d7cd6954abc) and outside tsconfig.json include (client/src, shared, server) — never built, never imported. Refs: chittycanon://gov/killlist/2026-06-02-notion Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR deletes the 553-line Notion integration module and simplifies the GitHub Actions workflow to run linting and production deployment on pushes to ChangesNotion integration removal
CI/CD workflow simplification
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a340eb6ddc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1,553 +0,0 @@ | |||
| import { Client } from '@notionhq/client'; | |||
There was a problem hiding this comment.
When NOTION_TOKEN is set, both cross-session-sync/init-sync.sh:122-126 and src/cross-session-sync/init-sync.sh:122-126 enter notion-integration and run npx tsx notion-sync.ts create-dashboard; this deletion removes the only tracked file in that directory, so a fresh checkout no longer has the directory or script and initialization aborts under Notion-configured environments. Either keep this target or update the init scripts to use the replacement implementation before deleting it.
Useful? React with 👍 / 👎.
Remove 285-line fantasy workflow that: - referenced /Users/nb/ local Mac paths (never runs on GitHub runners) - used non-existent 'codex mcp --init' / 'codex review' CLI - tried to deploy 5 separate services from this repo's CI Replace with minimal working pipeline: - lint on all PRs and pushes - deploy:production (wrangler.optimized.toml) on push to main
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/ecosystem-cicd.yml (1)
1-1: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winExplicitly minimize and avoid persisting the GitHub token. The workflow currently inherits repository token defaults and stores the checkout token in Git config before running package scripts.
.github/workflows/ecosystem-cicd.yml#L1-L1: addpermissions: { contents: read }..github/workflows/ecosystem-cicd.yml#L19-L19: setpersist-credentials: false..github/workflows/ecosystem-cicd.yml#L33-L33: setpersist-credentials: false.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ecosystem-cicd.yml at line 1, Minimize GitHub token access and prevent checkout credentials from being persisted: in .github/workflows/ecosystem-cicd.yml lines 1-1 add permissions with contents read, and in the checkout steps at lines 19-19 and 33-33 set persist-credentials to false.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ecosystem-cicd.yml:
- Around line 11-12: Move CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID from
the workflow-level env into the deploy job’s env, keeping them available only to
deploy and absent from the lint job.
---
Nitpick comments:
In @.github/workflows/ecosystem-cicd.yml:
- Line 1: Minimize GitHub token access and prevent checkout credentials from
being persisted: in .github/workflows/ecosystem-cicd.yml lines 1-1 add
permissions with contents read, and in the checkout steps at lines 19-19 and
33-33 set persist-credentials to false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 30485210-5a3c-479c-81da-2943a9ccae55
📒 Files selected for processing (1)
.github/workflows/ecosystem-cicd.yml
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Keep production Cloudflare credentials out of the PR lint job.
Workflow-level env injects this token into lint, where PR code runs npm ci and npm run lint. A same-repository PR can exfiltrate the production token through a modified lifecycle or lint script. Move these variables under deploy only.
Proposed fix
-env:
- CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
- CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-
deploy:
+ env:
+ CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+ CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ecosystem-cicd.yml around lines 11 - 12, Move
CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID from the workflow-level env into
the deploy job’s env, keeping them available only to deploy and absent from the
lint job.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9acf41beb2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| node-version: '20' | ||
| cache: npm | ||
| - run: npm ci | ||
| - run: npm run lint |
There was a problem hiding this comment.
On every PR and main-branch push, this step reports success without guaranteeing that lint ran: the root dependencies do not install ESLint, the repository has no ESLint configuration, and package.json ends the lint command with || echo 'Linting complete', which converts missing-tool, configuration, and lint errors to exit code 0. Because the production deployment only needs: lint, a main push can therefore deploy after a false-green gate; install/configure ESLint and stop swallowing its exit status.
Useful? React with 👍 / 👎.
| deploy: | ||
| name: Deploy to Cloudflare | ||
| needs: lint | ||
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' |
There was a problem hiding this comment.
When two commits are pushed to main close together, these deployment jobs can run concurrently because the workflow defines no concurrency group or stale-run cancellation. If the older run spends longer in npm ci or Wrangler, its deployment can finish after the newer run and roll the shared Cloudflare production worker and routes back to the older commit; serialize this job or cancel superseded main-branch deployments.
Useful? React with 👍 / 👎.
|
|
||
| deploy: | ||
| name: Deploy to Cloudflare | ||
| needs: lint |
There was a problem hiding this comment.
For a direct push to main, this job now depends only on lint and can deploy while the repository's security-review.yml and path-scoped chittyos-compliance.yml workflows are still running or have failed; separate GitHub Actions workflows cannot satisfy this needs. This removes the previous in-pipeline compliance dependency, so a commit containing a hardcoded ChittyID or another security violation can reach production despite a red security workflow; make the required checks part of this dependency chain before deploying.
Useful? React with 👍 / 👎.
1 participant
Part of notion search-and-destroy. Both copies MD5-identical and outside tsconfig include — unbuilt, unimported. See chittycanon://gov/killlist/2026-06-02-notion.
Summary by CodeRabbit