fix(pr-policy): stop over-flagging presentation-only UI PRs as clinical-risk#965
Conversation
The PR Policy check failed on nearly every PR because the clinical-risk
classifier matched any src/{lib,app,components} file whose path contained a
generic token (clinical, search, answer, source, document, ...). The main UI
lives under src/components/clinical-dashboard/, so ~44% of src files auto-tripped
"clinical risk" and were forced through the full 7-item Clinical Governance
Preflight, which then failed whenever the section was missing or reworded.
- Narrow classification: presentation surfaces (src/app pages, src/components)
are clinical-risk only for access/privacy/patient/upload/download tokens.
Clinical behavior in src/lib, API routes, supabase/, and scripts stays gated.
- Tolerate governance rewording: require the section present, every box checked,
and at least the required item count — instead of exact-string matching.
- Update self-tests to cover the narrowed classification and tolerant matching.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014MG846R4YM51NojUf9XthF
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
2 participants
Summary
PR Policycheck kept failing on nearly every PR because the clinical-risk classifier inscripts/pr-policy.mjsmatched any file undersrc/{lib,app,components}whose path contained a generic token (clinical,search,answer,source,document,rank,citation, …). Since the whole main UI lives undersrc/components/clinical-dashboard/(path contains "clinical"), plus many*search*/*answer*/*document*files, 255 of 584src/**files (44%) auto-tripped "clinical risk" — including pure spacing/colour changes — and were then forced to complete the full 7-item Clinical Governance Preflight.src/apppages +src/components) are now clinical-risk only for access/privacy tokens (auth|permission|privacy|security|upload|download|patient). Clinical behavior —src/app/api/**,src/lib/**(retrieval/answer/ingestion/governance/privacy),supabase/, and ingestion/governance scripts — stays fully gated.- [ ]), and at least the required item count — tolerating light rewording/reformatting that previously failed (e.g. feat(ui): compact bottom search dock on phones everywhere except the home hero #964, fix(db): restore orphan migration versions for Supabase Preview #952).clinical-dashboard/→ "requires the section"), feat(ui): compact bottom search dock on phones everywhere except the home hero #964 (search-bar restyle → "missing 4 items").Verification
npm run check:pr-policy— runsnode scripts/pr-policy.mjs --self-test(updated for narrowed classification + tolerant matching) andscripts/check-pr-policy-workflow.mjs(workflow contract unchanged). Both pass.npx eslint scripts/pr-policy.mjs— clean;npx prettier --check scripts/pr-policy.mjs— clean.ok: true; a genuine clinical-behavior change (src/lib/answer-synthesis.ts) with no governance section → still fails.npm run verify:pr-local/verify:ui— this change is a CI metadata-policy script only (no app runtime, UI, or provider surface); the targeted self-test + lint above are the relevant gate.Risk and rollout
pr-policy.ymlruns the trusted script fromgithub.workflow_sha(base/main), so the relaxed rules take effect for open PRs only after this merges tomain; re-running the check then re-evaluates them.Notes
scripts/check-pr-policy-workflow.mjsand the workflow-contract self-tests stay green. TherequiredClinicalGovernanceItemsexport is preserved (the dormantsync-pr-policy-bodyjob inci.ymlimports it).scripts/pr-policy.mjsmatches no clinical token — so the Clinical Governance Preflight section does not apply to this PR.🤖 Generated with Claude Code
Generated by Claude Code