ci: run web typecheck and tests on web-only PRs

[jamby77]

Problem

api-tests.yml only triggers on apps/api/**, packages/**, proprietary/** and pnpm-lock.yaml. A PR that touches only apps/web/** (e.g. #472) runs no web typecheck and no web tests — only CLA / Constants Guard / bot reviews.

web is already a matrix entry in scripts/ci-test-matrix.mjs (package (web) runs pnpm build --filter web... → tsc && vite build, then vitest run), so the gap is just the trigger.

Change

• Paths filter: add apps/web/**, plus package.json, pnpm-workspace.yaml, the workflow itself and scripts/ci-test-matrix.mjs (CI changes previously didn't run CI).
• dedicated_jobs output from the matrix script: false only when every changed file lives in apps/web (or inert docs/.md paths).
• api-tests, ai-facade-tests, ai-py-facade-tests now needs: test-matrix and are gated on it, so web-only PRs don't pay for the full API suite.

Coverage is unchanged for everything else: any change touching api, packages, proprietary, or a root file still runs all dedicated jobs, and workflow_dispatch still runs everything. I deliberately did not gate api-tests on the workspace dependency graph, since api reaches into proprietary/* without declaring it as a workspace dependency.

Verification

• Web on master locally: tsc --noEmit clean, vitest run 82 files / 676 tests pass.
• Simulated diffs against the new script:

Changed	Node suites	Dedicated jobs
apps/web/...	web	skipped
apps/web/... + docs/x.md	web	skipped
apps/web/... + apps/api/...	web	run
packages/shared/...	2	run
proprietary/entitlement/...	0	run
package.json	all	run

This PR itself touches the workflow + script, so it runs the full suite.

🤖 Generated with Claude Code

---

Note

Low Risk
CI trigger and job gating only; no application runtime, auth, or data-path changes.

Overview
Extends the API Tests workflow so PRs that only touch apps/web actually run CI (typecheck/build/vitest via the existing matrix), and stops paying for API/AI dedicated jobs on those PRs.

The workflow path filter now includes apps/web/**, root workspace manifests (package.json, pnpm-workspace.yaml), and changes to the workflow or scripts/ci-test-matrix.mjs so CI edits and web-only changes trigger the pipeline. ci-test-matrix.mjs emits a new dedicated_jobs flag: it is false when the diff-selected suites are confined to isolated apps (currently web); otherwise it stays true (including “run everything” when there is no PR base or a change outside any package). api-tests, ai-facade-tests, and ai-py-facade-tests now depend on test-matrix and run only when dedicated_jobs == 'true', while matrix package-tests still run for web on web-only changes.

^{Reviewed by Cursor Bugbot for commit bd47753. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated automated test workflows to account for web app, workspace, dependency, and CI configuration changes.
  • CI now determines whether dedicated API and AI test jobs are needed based on the affected project areas.
  • Isolated web-only changes can avoid running unrelated dedicated API test jobs, improving CI efficiency.
  • Added clearer test-matrix reporting to indicate when dedicated jobs are selected.

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a87796d7-d002-4522-972d-7fbc6e6eddb4

📥 Commits

Reviewing files that changed from the base of the PR and between 074c0d3 and bd47753.

📒 Files selected for processing (2)

• .github/workflows/api-tests.yml
• scripts/ci-test-matrix.mjs

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI matrix script now emits a dedicated_jobs flag for isolated web changes. The API test workflow exposes this flag and uses it to gate API and AI facade test jobs. Pull-request path filters now include web and CI configuration files.

Changes

Dedicated CI job gating

Layer / File(s)	Summary
Dedicated job flag computation scripts/ci-test-matrix.mjs	The script defines web as an isolated app, computes dedicatedJobs, logs the result, and writes dedicated_jobs to GITHUB_OUTPUT.
Workflow trigger and job gating .github/workflows/api-tests.yml	The pull-request filter includes web, workspace, package, workflow, and matrix-script changes. The workflow exposes dedicated_jobs and gates the API and AI facade test jobs on its true value.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main CI change: running web typecheck and tests for web-only pull requests.
Description check	✅ Passed	The description provides a detailed problem statement, implementation summary, behavior details, and verification results. It does not use the template's exact Summary, Changes, and Checklist headings…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[KIvanow]

Good, tightly-scoped fix for a real gap - web-only PRs weren't running any web typecheck or tests, and since web was already a matrix entry this is just wiring the trigger. Approving.

The part I specifically checked: gating api-tests / ai-facade-tests / ai-py-facade-tests with job-level if: + needs: test-matrix rather than a workflow-level paths skip is the right call. Skipped jobs report a "skipped" conclusion that branch protection counts as passing, so a web-only PR won't hang on a required check that never reports. That's the trap this avoids, and it's easy to get wrong. The dedicated_jobs boolean also coerces to the "true"/"false" strings the == 'true' gate expects.

One tiny non-blocking note: dedicatedJobs comes from [...selected].some(...), which is false for an empty selected - so an empty set would skip the dedicated jobs while also running no node suites. It looks unreachable (the else branch requires non-empty direct, and withDependents includes it), but an explicit selected.size === 0 guard would document that assumption. Fine to leave.

Nice touch adding the workflow and matrix script to the paths filter so CI changes exercise themselves.