CI: run Pro compatibility smokes in hosted tests

[justin808]

Summary

Relevant Pro package changes selected hosted Pro tests, but that workflow only executed the Node renderer test command. The packed React 16/17 compatibility smoke added in #4652 could therefore be skipped while the hosted run still appeared green.

The selected Pro package job now runs the full react-on-rails-pro test command, which includes the isolated packed React 16.14 and 17.0 webpack/SSR smokes, while preserving the dedicated Node renderer test step. A workflow contract spec ties the selected run_pro_tests route to both commands so this gap cannot silently recur.

Fixes #4644.

Related: #4652

Validation

• TDD replay: bundle exec rspec spec/react_on_rails/hosted_ci_workflow_spec.rb failed before the workflow edit because the selected job lacked pnpm --filter react-on-rails-pro test; it now passes with 1 example and 0 failures.
• actionlint .github/workflows/pro-test-package-and-gem.yml — passed.
• script/ci-changes-detector-test.bash — passed all 77 detector cases; Pro changes select run_pro_tests=true and run_js_tests=false.
• pnpm --filter react-on-rails-pro test — passed 620 package tests plus packed React 16.14.0 and 17.0.2 install, webpack, and SSR runtime smokes.
• pnpm --filter react-on-rails-pro-node-renderer run ci — passed; the existing Node renderer path remains covered.
• pnpm run lint, pnpm start format.listDifferent, and pnpm run nps check-typescript — passed.
• (cd react_on_rails && BUNDLE_GEMFILE=../Gemfile bundle exec rubocop) — passed.
• git diff --check origin/main...HEAD and the pre-push branch lint hook — passed.
• yamllint .github/ remains red on the repository's existing document-start and 80-column baseline; before/after comparison found no new finding from this diff.
• .agents/bin/validate --changed passed dependency setup, docs, lint, formatting, TypeScript, builds, Pro dummy bundles, all Pro package/packed compatibility tests, and Pro Node renderer tests. Its later broad OSS generator phase was stopped after unrelated existing npm ERESOLVE retries for react-on-rails-rsc@19.2.1-rc.0 versus Pro's ^19.0.5 optional peer plus environment/config failures; focused changed-surface gates above are complete.

Workflow and rollout evidence

• Classification: semantic CI-routing change in .github/workflows/pro-test-package-and-gem.yml; a post-merge exercise issue is required before merge.
• Labels: ready-for-hosted-ci, force-full-hosted-ci. Force-full is appropriate because the behavior being repaired is the hosted selector-to-Pro-job route itself; the final-head workflow log must explicitly show both packed React versions.
• Mechanism target: checklist+replay.
• Motivating miss: the post-merge audit of Test: add packaged Pro smokes for React 16 and 17 #4652 found that green hosted CI never invoked the new Pro compatibility smoke.
• Replay evidence: the new contract spec reproduced the missing command before the fix and passes after it. A sweep of 17 open PRs found four touching the newly enforced Pro surface: Redact RSC rendering error details from client DOM in production #4631, Add rsc-guardrails agent skill + payload-escaping regression test + advisory hook #4599, Use raw bodies to avoid render request escaping #4579, and [Pro] Reconnect stale renderer keep-alive; clarify per-thread connection math (#4571) #4575; all are behind current main. The stale-base race control is to require those affected heads to update to current main and rerun current hosted Pro CI before merge.
• Non-goal: no CI selector rewrite, trigger/permission change, runtime behavior change, or expansion of the React compatibility matrix.
• Lockfiles/Dependabot: not applicable; no dependency or lockfile changed.
• Flagship demo: not applicable; no product default, package pin, generator output, or recommended Pro/RSC path changed.
• Changelog: not user-visible; this corrects regression evidence routing without changing released behavior or support claims.

Review receipt and churn

• App-bundled Codex 0.144.2 reviewed committed branch origin/main...d5c4fcd0d from immutable base c74239fab; result: clean, with no accepted or rejected findings.
• Included lenses: CI correctness, security/secret exposure, compatibility coverage, regression-test reachability, and release-process routing. Included paths are the workflow and its contract spec; no branch-diff paths were excluded.
• The Homebrew reviewer was unavailable because it was too old for the configured model; the app-bundled reviewer completed successfully. The additional Claude review and /simplify pass were unavailable because the local Claude CLI is not authenticated (Not logged in); no substitute engine weakened the primary clean review.
• Pre-push review churn: one focused corrective commit; no post-push fix rounds yet.

Merge qualification

• Release gate: main beta phase with release tracker #3823 in development mode; standard merge qualification applies.
• Merge authority: auto_merge_when_gates_pass from the active maintainer batch.
• Current head: d5c4fcd0da526e924f54061d383627edc8c918d8.
• Required gate: attempt 2 passed on the exact head.
• Force-full hosted CI: all 9 dispatched workflows completed successfully on the exact head, including the gem/generator matrix and the Pro package workflow.
• Hosted compatibility evidence: the Pro package job ran the full Pro command, logged successful packed React 16.14.0 and 17.0.2 install/build/SSR smokes, and preserved the Node renderer suite.
• Independent QA: qa-evidence v1 is satisfied with no release-blocking findings.
• Reviews: Claude, Greptile, and CodeRabbit produced current-head artifacts; triage found no MUST-FIX or DISCUSS items and zero unresolved threads.
• Strict merge ledger: generated at 2026-07-14T05:48:16Z with complete_allowed: true, no violations, and no unknown fields.
• Base movement: main advanced only through unrelated Fix ambiguous prerelease retries #4654 release-rake/docs/spec files; there is no overlap with this PR's workflow and contract-spec paths.

Confidence note:

• Validated: TDD contract replay, actionlint, the full detector harness, full Pro package and Node renderer tests, packed React 16/17 runtime smokes, lint/format/type checks, OSS RuboCop, diff checks, independent QA, three configured review systems, the required PR gate, and all nine force-full hosted workflows.
• Evidence: the exact-head hosted runs, QA record, review-triage record, and strict merge-ledger result are linked or identified above.
• UNKNOWN: none.
• Residual risk: the broad local aggregate validator's unrelated generator phase did not finish locally, but the exact-head hosted gem/generator matrix completed successfully; no remaining merge-safety risk is identified.
• Decision points: 0.

---

Summary by CodeRabbit

• Tests
  • Added coverage to verify that the Pro hosted CI workflow runs the expected JavaScript, React compatibility, and Node Renderer checks.
  • Confirmed the workflow is correctly gated and references the required packaged compatibility test command.

[coderabbitai]

Walkthrough

The Pro hosted CI workflow now runs Pro package JavaScript tests. A new RSpec spec validates workflow gating, compatibility smoke commands, the package test script, and the Node Renderer CI command.

Changes

Pro hosted CI validation

Layer / File(s)	Summary
Package test workflow and validation .github/workflows/pro-test-package-and-gem.yml, react_on_rails/spec/react_on_rails/hosted_ci_workflow_spec.rb	Adds pnpm --filter react-on-rails-pro test to the gated package test job and verifies the workflow commands and Pro package script through RSpec.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• shakacode/react_on_rails#4622: Updates the Pro package test script with Jest suite-selection validation used by this workflow.

Suggested labels: ready-for-hosted-ci

Suggested reviewers: alexeyr-ci2

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The workflow now runs the Pro test command in hosted CI and the spec enforces it, matching the requested hosted compatibility smoke coverage.
Out of Scope Changes check	✅ Passed	The changes are limited to the Pro hosted workflow and its contract spec, with no unrelated edits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: running Pro compatibility smoke tests in hosted CI.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jg-codex/4644-hosted-pro-smoke-routing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[justin808]

Workflow Change Audit:

• Head SHA: d5c4fcd0da526e924f54061d383627edc8c918d8
• Semantic classification: CI-routing change in .github/workflows/pro-test-package-and-gem.yml.
• Secret references: unchanged before/after; no secret was added, removed, renamed, or exposed. The job retains its existing REACT_ON_RAILS_PRO_LICENSE mapping.
• permissions:: unchanged before/after.
• on: triggers and workflow-dispatch inputs: unchanged before/after.
• Third-party actions: none added, removed, or version-changed.
• Jobs, matrices, conditions, concurrency, and reusable-action calls: unchanged. The existing package-js-tests job remains gated by should_run_hosted_ci == 'true' and run_pro_tests == 'true'.
• Command routing before: the selected job ran only pnpm --filter react-on-rails-pro-node-renderer run ci. After: it first runs pnpm --filter react-on-rails-pro test, then preserves the separate Node renderer command.
• Local verification: actionlint passed; the new workflow contract spec passed; all 77 detector cases passed; full Pro package tests, packed React 16.14/17.0 smokes, and Node renderer tests passed. Full yamllint .github/ retains only the repository's existing document-start/80-column baseline, with no new diff finding.
• New-gate rollout: checklist+replay. The motivating miss was Test: add packaged Pro smokes for React 16 and 17 #4652's green hosted run that skipped the compatibility smoke. The contract spec reproduces that missing command before the fix and passes after it. The open-PR sweep found Redact RSC rendering error details from client DOM in production #4631, Add rsc-guardrails agent skill + payload-escaping regression test + advisory hook #4599, Use raw bodies to avoid render request escaping #4579, and [Pro] Reconnect stale renderer keep-alive; clarify per-thread connection math (#4571) #4575 touching the enforced Pro surface and behind current main; those affected heads must update to a main containing this change and rerun current hosted Pro CI before merge.
• Dependabot/lockfile compatibility: not applicable; no lockfile or dependency manifest changed.
• Required post-merge exercise: Follow-up: Exercise GitHub Actions changes from PR #4656 #4657 records the exact dispatch event, expected React 16/17 and Node renderer evidence, owner, and cleanup instructions.

[greptile-apps]

Greptile Summary

This PR updates the hosted Pro CI path to run the full Pro package tests. The main changes are:

• Adds pnpm --filter react-on-rails-pro test to the selected Pro package test job.
• Keeps the dedicated Pro Node Renderer CI command in the same job.
• Adds an RSpec workflow contract for the Pro hosted CI commands and packed React smoke script.

Confidence Score: 5/5

This looks safe to merge after a small test hardening cleanup.

• The workflow command is added on the intended hosted Pro job path.
• The existing Node Renderer command keeps its step-specific junit environment.
• The new spec covers the command strings, but it does not check whether matching steps have their own skip conditions.

react_on_rails/spec/react_on_rails/hosted_ci_workflow_spec.rb

Important Files Changed

Filename	Overview
.github/workflows/pro-test-package-and-gem.yml	Adds the full Pro package test command before the existing Pro Node Renderer CI command in the selected hosted Pro job.
react_on_rails/spec/react_on_rails/hosted_ci_workflow_spec.rb	Adds a workflow contract spec for the selected Pro job and the packed React compatibility smoke script.

_{Reviews (1): Last reviewed commit: "CI: route Pro compatibility smokes throu..." | Re-trigger Greptile}

[claude]

Review: CI: run Pro compatibility smokes in hosted tests

Overview

Small, well-scoped fix to .github/workflows/pro-test-package-and-gem.yml. The package-js-tests job had a step misleadingly named "Run JS unit tests for Pro package" whose run: line actually only invoked pnpm --filter react-on-rails-pro-node-renderer run ci — so the Pro package's own test suite (including the packed React 16/17 compatibility smoke added in #4652) never ran in hosted CI, even though the step name implied it did. This PR splits that into two correctly-named steps and adds a regression spec (hosted_ci_workflow_spec.rb) that parses the workflow YAML and asserts both commands are present in the selected job.

Verification performed

• Confirmed via gh pr diff that the diff is exactly 3 added lines in the workflow (new step name/run + blank line) plus the new spec file — minimal, surgical change.
• Confirmed packages/react-on-rails-pro/package.json's test script chains test:packed-react-compatibility, so the new pnpm --filter react-on-rails-pro test step now does exercise the packed-compatibility smoke.
• Checked for duplicate/removed coverage elsewhere in the workflow — react-on-rails-pro package tests were not run anywhere else in this file, so this closes a real coverage gap without duplicating work.
• Checked the "Store test results" artifact upload step (packages/react-on-rails-pro-node-renderer/jest) — the Pro package's own jest.config.js has no jest-junit reporter configured, so it produces no output that step would need to pick up. No gap there.
• Verified the repo_root/YAML-parsing logic in the new spec resolves to the actual repo root and that the job/step keys (package-js-tests, if, steps[].run) match the real workflow structure.

Code quality / style

• Both new/existing "Run JS unit tests..." steps omit an explicit working-directory: . override that sibling steps in the same job (Install Node modules with pnpm, Build workspace packages) set explicitly, even though the job's defaults.run.working-directory is react_on_rails_pro. This isn't a bug — pnpm --filter walks up to find pnpm-workspace.yaml at the repo root regardless of cwd — but it's a pre-existing inconsistency (not introduced by this PR) that could confuse a future reader skimming for the working directory of each step. Not blocking.
• The regression spec is a reasonable, low-cost way to guard against this exact regression recurring (asserting on parsed YAML rather than actually running CI), and its scope is tightly matched to the bug it's guarding against.

Risk / performance

• The test:packed-react-compatibility smoke packs and installs two React versions during the job, adding runtime to the previously-underscoped step — expected/intentional given the PR's purpose (this is exactly the coverage that was silently skipped before).
• No security concerns — no secrets, permissions, or trigger conditions were touched.

Verdict

Correct, minimal fix with a regression test tightly scoped to the actual bug. No blocking issues found.

[justin808]

Corrective exact-head QA evidence

Independent QA passed locally on exact PR head d5c4fcd0da526e924f54061d383627edc8c918d8 with no findings. Hosted final-head routing remains the outstanding part of this required QA lane, so the structured status remains in_progress until the dispatched Pro workflow log proves both compatibility cases.

Key results:

• pnpm --filter react-on-rails-pro test — 620 tests passed plus exact packed React 16.14.0 and 17.0.2 success lines.
• Prepared pnpm --filter react-on-rails-pro-node-renderer run ci — 41/41 suites and 543/543 tests passed.
• The first unprepared Node-renderer run lacked the hosted workflow's generated dummy bundles; after running the exact workspace and Pro dummy build prerequisites, every affected suite passed. This was environment preparation, not a PR finding.
• The redundant broad gem suite spent 21 minutes in unrelated generator dependency-install churn and was terminated with captured process evidence; the changed contract spec passed directly and is statically included by the normal gem-spec task.

QA lane: ROR-B-qa-pro, generation 3, hard binding codex-subagent@strongest/xhigh; claim retained for hosted-log replay.

[justin808]

+ci-status

[github-actions]

CI Status

Head SHA: d5c4fcd0da52
Changed files: 2
Docs-only heuristic (matches ci-changes-detector metadata paths): no
ready-for-hosted-ci label: absent
force-full-hosted-ci label: absent
Current hosted-CI waiver: not present for this SHA

Only the required gate is active unless hosted CI is requested.

[justin808]

+ci-force-full

[github-actions]

Force-Full Hosted CI Requested

Triggered 9 workflow(s) for d5c4fcd0da52.
Mode: force-full hosted CI (bypasses optimized change selection).
Added ready-for-hosted-ci and force-full-hosted-ci, so future commits will bypass optimized hosted CI selection until +ci-stop-full is used.

View progress in the Actions tab.

[justin808]

QA evidence v1 — qa-pro-4644

qa_evidence_version: v1
lane: qa-pro
lane_target: qa-pro-4644
holder: ROR-B-qa-pro
binding: codex-subagent@strongest/xhigh
instance_id: ror-b-qa-pro-v1
claim_generation: 3
head_sha: d5c4fcd
qa_status: satisfied
release_blocking: clear
findings: none
confidence: high

hosted_replay:

• run_id: 29307631512
• run_url: https://github.com/shakacode/react_on_rails/actions/runs/29307631512
• event: workflow_dispatch
• head_sha: d5c4fcd
• status/conclusion: completed/success
• job_id: 87004504031
• job_name: package-js-tests
• job_url: https://github.com/shakacode/react_on_rails/actions/runs/29307631512/job/87004504031
• job_status/conclusion: completed/success
• required_step: Run JS unit tests for Pro package — success
• required_step: Run JS unit tests for Pro Node Renderer package — success

immutable_log_observations:

• 2026-07-14T05:09:18.8353083Z — Run pnpm --filter react-on-rails-pro test
• 2026-07-14T05:09:19.1772517Z — pnpm run test:suite-selection && pnpm run test:non-rsc && pnpm run test:streaming && pnpm run test:rsc && pnpm run test:packed-react-compatibility
• 2026-07-14T05:10:16.0490224Z — node scripts/packed-react-compatibility-smoke.mjs
• 2026-07-14T05:10:26.6326995Z — React 16.14.0: packed install, node export, webpack build, and SSR runtime passed
• 2026-07-14T05:10:29.3270263Z — React 17.0.2: packed install, node export, webpack build, and SSR runtime passed
• 2026-07-14T05:10:29.5341326Z — Run pnpm --filter react-on-rails-pro-node-renderer run ci
• 2026-07-14T05:14:08.1846390Z — Test Suites: 41 passed, 41 total
• 2026-07-14T05:14:08.1847012Z — Tests: 543 passed, 543 total
• 2026-07-14T05:14:08.1848191Z — Ran all test suites.

packed_non_rsc_evidence:

• same_command_binding: The logged Pro package test chain invokes test:packed-react-compatibility before the step succeeds.
• direct_resolution_absence: The exact-head smoke requires react-on-rails-rsc resolution to throw MODULE_NOT_FOUND.
• dependency_tree_absence: The same smoke rejects react-on-rails-rsc in the isolated pnpm dependency tree.
• webpack_graph_absence: The same smoke rejects react-on-rails-rsc in the packed consumer webpack module graph.
• packed_core_identity: The same smoke requires Pro to resolve the isolated consumer's exact react-on-rails instance.
• verdict: satisfied

local_evidence_summary:

• Strict PR security preflight: PASS
• Expected/local/remote head identity: PASS
• Workflow routing and security-invariant comparison: PASS
• actionlint: PASS
• CI detector harness: 77 run, 0 failed
• hosted_ci_workflow_spec.rb: 1 example, 0 failures
• Focused spec RuboCop: no offenses
• Pro license headers: 857 in-scope files current
• Local Pro package test: PASS, including exact React 16.14.0 and 17.0.2 packed lines
• Prepared local Node-renderer CI: 41 suites and 543 tests passed
• Final worktree cleanliness and diff check: PASS

process_gap:

• mechanism_target: checklist+replay
• motivating_miss: A local Node-renderer attempt without the hosted workflow's built/restored dummy bundles produced misleading ENOENT failures.
• checklist: Build workspace packages; build or restore Pro dummy webpack test bundles; verify non-empty ssr-generated/server-bundle.js and ssr-generated/rsc-bundle.js; then run Node-renderer CI.
• replay_evidence: Prepared local replay passed 41 suites / 543 tests; hosted package-js-tests replay passed both required steps.
• non_goal: No runtime behavior change or extra workflow scope is proposed by this evidence record.

[justin808]

Address-review summary

Scan scope: full PR history; no prior address-review checkpoint.

Mattered

• None. No MUST-FIX or DISCUSS feedback was found.

Optional

• Greptile step-condition hardening was autonomously deferred and resolved. Verification: the selected workflow step has no step-level if:, and the exact-head hosted job executed pnpm --filter react-on-rails-pro test successfully. Adding a future-proofing assertion now would restart the final-candidate gate without correcting current behavior. Reply: CI: run Pro compatibility smokes in hosted tests #4656 (comment)

Skipped

• CodeRabbit reported no actionable comments.
• Claude's current-head review found no blocking issues.
• Greptile's summary repeated the optional step-condition hardening thread; no separate action was needed.

Deferred-work tracking: dropped as not worth tracking; the suggestion is optional future-proofing rather than a current defect.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

[justin808]

QA evidence v1 — corrected replay marker

This restates the final-head QA result in the canonical replayable schema. The prior QA evidence remains accurate; only its hidden marker syntax was non-canonical.

• QA required: yes
• QA lane status: satisfied
• Release-blocking status: clear
• Findings: none
• Hosted run: https://github.com/shakacode/react_on_rails/actions/runs/29307631512
• Packed Pro job: https://github.com/shakacode/react_on_rails/actions/runs/29307631512/job/87004504031