ci: run quality-gate checks on Cursor Origin Codebase

[nikomatt69]

Issue for this PR

N/A — Origin-hosted CI for Cursor Codebase.

Type of change

• New feature

What does this PR do?

This repo is currently a GitHub inbound mirror, so GitHub Actions stay the runner and Origin PRs are unavailable until the repo is detached.

Cursor Codebase CI (Depot/Buildkite) only runs on Origin-hosted repos. This change:

• Adds Depot quality-gate workflows under .depot/ (validate, typecheck, test, generate, nix-eval, storybook, security)
• Lets autofix / report / review / /autofix run on nikoemme/nikcli as well as nikomatt69/nikcli
• Updates script/ci-autofix.ts so Origin is not treated as the wrong repository
• Keeps publish, desktop, Railway, and Windows jobs GitHub-only

After merge, to actually run CI on cursor.com/codebase:

1. Repo Settings → Detach from GitHub (Danger Zone), so Origin becomes the source of truth
2. Codebase Apps → connect Depot

How did you verify your code works?

bun test test/release/ci-coherence.test.ts test/release/ci-integration.test.ts test/release/ci-targeted.test.ts test/release/automation.test.ts — all passing.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/security.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, CC0-1.0, Unlicense, 0BSD

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/security.yml

[github-actions]

This Depot test workflow is Linux-only (the matrix has a single linux entry and runs on depot-ubuntu-24.04-8), but the Set OS-specific paths step still carries the full Windows branch copied from .github/workflows/test.yml (backslashes, ${{ runner.temp }}\\nikcli-e2e, etc.). That branch is dead code on Depot runners and adds ~35 lines of noise. Since the goal stated in the PR is to keep Depot Linux-only, this whole if/else can collapse to just the else branch. Suggestion: remove lines 42-58 (the Windows if block) and unindent the Linux branch to sit directly under run: |. Only an actual suggestion — feel free to leave it as-is if you intentionally want byte-for-byte parity with the GitHub copy for diffability.

[nikomatt69]

Review — ci: run quality-gate checks on Cursor Origin Codebase

Reviewed at head 71f245d. The split is sensibly drawn — quality gates dual-run, publish/desktop/Railway stay GitHub-only so releases can't double-fire, and test/release/ci-coherence.test.ts asserts that boundary rather than trusting it. Encoding "these workflows exist and the Depot pipeline does not reference publish" as a test is the right way to keep a duplicated pipeline from drifting.

This PR has gone stale, and one finding follows from that.

.github/workflows/test.yml gains:

runs-on: ${{ matrix.settings.host }}
if: matrix.settings.name != 'windows' || github.repository == 'nikomatt69/nikcli'

Two problems:

1. matrix is not available in a job-level if. GitHub's context-availability table allows only github, needs, vars and inputs in jobs.<job_id>.if — matrix is available in runs-on, strategy, container and step-level if, but not there. This should fail the workflow with an unrecognized-named-value error rather than skip the Windows leg. The conditional-matrix form is the usual way to express it:

   strategy:
     matrix:
       settings: ${{ github.repository == 'nikomatt69/nikcli' && fromJSON('[…linux…, …windows…]') || fromJSON('[…linux…]') }}

2. The entry it guards no longer exists. live-main's test.yml has since dropped the Windows matrix entry outright — the comment there records that it only ran bun test:e2e:local, which had been failing on every commit because "the node_modules/.bin bun shim wins the PATH lookup under the hoisted linker and dies with Bun failed to remap this bin". So this hunk guards nothing and will conflict on rebase. Dropping it is probably the whole fix.

Worth rebasing on live-main generally — the base here is bc38095 from 2026-08-17 and ci-pipeline.yml / test.yml have both moved since.

(Aside, since it's the same root cause: that documented Bun failed to remap this bin failure is exactly what #231's test (windows) job is still hitting.)

Three smaller things:

• Action pinning is inconsistent within the PR. .depot/workflows/nix-eval.yml and storybook.yml pin actions/checkout by SHA; .depot/workflows/ci-pipeline.yml, test.yml, typecheck.yml, generate.yml and security.yml use the floating @v7. .depot/actions/setup-bun pins both of its actions by SHA. Since a new CI surface is being stood up here, pinning all of it now is cheaper than a sweep later.
• The Depot copies carry dead Windows code. The bot's earlier note on .depot/workflows/test.yml's Set OS-specific paths still stands, and it extends further than that one block: the if: matrix.settings.name != 'windows' guards on the seed/serve/wait steps are all constant-true on a Linux-only matrix, and .depot/actions/setup-bun carries a Windows) OS=windows case plus a --linker hoisted Windows branch. If Depot has no Windows sandboxes, none of it can ever run. Byte-for-byte parity with the GitHub copy is a legitimate reason to keep it — but if that's the intent, a comment saying so would stop the next reader from deleting it as dead.
• .depot/workflows/security.yml runs bun audit --audit-level=high unconditionally on PRs, while the .github copy gates its new audit job on github.repository == 'nikoemme/nikcli'. Since a .depot/ workflow only runs on Origin anyway that's harmless, just asymmetric.

CI. smoke (windows-latest, *) is red here, as it is on every open PR in this repo including ones that touch no TypeScript — environment, not this diff. Everything else on the head commit is green.

---

Generated by Claude Code

[nikomatt69]

Closing — stale, and blocked on a step outside the diff

Still a draft at 71f245d, base bc38095 from 2026-08-17. The review already on this PR found a defect that has not been addressed, and re-checking live-main today confirms both halves of it:

1. matrix is not available in a job-level if. .github/workflows/test.yml gains if: matrix.settings.name != 'windows' || github.repository == 'nikomatt69/nikcli' at job level. GitHub's context-availability table allows only github, needs, vars and inputs there, so this fails the workflow with an unrecognized-named-value error rather than skipping the Windows leg.
2. It guards an entry that no longer exists. live-main's test.yml has since dropped the Windows matrix entry outright — its comment records that the entry only ran bun test:e2e:local, which was failing on every commit because the node_modules/.bin bun shim wins the PATH lookup under the hoisted linker. The matrix is linux alone now, so this hunk guards nothing and conflicts on rebase.

Beyond the diff, the thing this PR is for cannot happen from a merge. .depot/ workflows only run once the repo is detached from GitHub (Settings → Danger Zone) and Depot is connected under Codebase Apps. Neither has happened — the repo is still a GitHub inbound mirror — so merging this adds ~724 lines of a second CI surface that nothing executes, alongside a .github copy that keeps moving. ci-pipeline.yml and test.yml have both changed since this base, so the duplicate starts out of date on day one.

Closing rather than leaving it open: the merge order here is backwards. Detach first, then port the pipeline against whatever .github looks like at that point.

If it is picked back up, the earlier review's three smaller notes still apply and are cheaper to fix before the copy exists than after:

• Action pinning is inconsistent within the PR. .depot/workflows/nix-eval.yml and storybook.yml pin actions/checkout by SHA; ci-pipeline.yml, test.yml, typecheck.yml, generate.yml and security.yml use floating @v7.
• The Depot copies carry dead Windows code — if: matrix.settings.name != 'windows' guards that are constant-true on a Linux-only matrix, plus a Windows) OS=windows case and a --linker hoisted branch in .depot/actions/setup-bun. Byte-for-byte parity with the GitHub copy is a fine reason to keep it, but say so in a comment or the next reader deletes it as dead.
• .depot/workflows/security.yml runs bun audit --audit-level=high unconditionally while the .github copy gates its audit job on the repository name. Harmless, since a .depot/ workflow only runs on Origin — just asymmetric.

The work is not wrong, and test/release/ci-coherence.test.ts encoding the publish/quality-gate boundary as a test rather than a convention is the right instinct. It is just ahead of the repository.

---

Generated by Claude Code