ci: enforce codecov on miner/mcp/engine/discovery-index-only PRs

[JSONbored]

Summary

• validate-tests (runs test:coverage, uploads lcov to Codecov) only triggered on backend || rees. None of packages/loopover-miner/**, packages/loopover-mcp/**, or packages/loopover-engine/** were in the backend path filter, and packages/discovery-index/** had no filter at all — so a PR scoped to just one of those packages skipped the coverage job entirely. No codecov/patch check even posted, and the required validate aggregate passed anyway (a skipped job counts as success). chore(miner): migrate batch 4.7 foundational lib modules to TypeScript (#7315) #7319 and chore(miner): migrate batch 2.1 utility modules to TypeScript #7320 merged this way with zero tests run.
• Separately, vitest.config.ts's coverage.include was missing packages/loopover-miner/bin/** and all of packages/loopover-mcp/** — even when the coverage job did run (e.g. chore(miner): migrate the CLI bin entry-points to TypeScript #7318, which incidentally also touched scripts/check-miner-package.mjs), those changed files had no instrumentation, so codecov/patch passed with zero real data.
• This PR fixes both: extends validate-tests/validate-tests-merge's trigger to also fire on miner/mcp/engine/discoveryIndex (mirroring the existing rees precedent), adds a discoveryIndex path filter (wired into validate-code too), and closes the coverage.include gaps for packages/loopover-miner/bin/** and packages/loopover-mcp/{lib,bin}/**.
• The two CLI entrypoints that are provably subprocess-only-tested (packages/loopover-miner/bin/loopover-miner.ts, packages/loopover-mcp/bin/loopover-mcp.{js,ts} — exercised only via execFileSync/StdioClientTransport spawning a real node process, never imported in-process) are exempted from patch grading in codecov.yml, the same documented way src/server.ts already is: v8 can't instrument a separate Node process, so grading them would create a permanent, unfixable failure for anyone touching those files.
• All 16 currently-open JS→TS migration issues (packages/loopover-miner/lib batches + chore(mcp): migrate packages/loopover-mcp from plain .js to real TypeScript #7291 for packages/loopover-mcp) now fall under enforced coverage as a result.
• Config-only change; no application/source code touched.

Closes none directly — this is a maintainer-initiated infra fix found while investigating why #7318/#7319/#7320 (JS→TS migration PRs) merged with validate-tests skipped.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — N/A, see Summary: this is a maintainer-initiated CI/Codecov infra fix, not tied to a single pre-filed contributor issue.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck (after building @loopover/engine + @loopover/discovery-index, matching test:ci's own ordering)
• npm run test:coverage locally — not run in full (config-only change, no source touched). Instead ran a real scoped vitest --coverage invocation covering the exact files this PR newly wires into coverage.include (packages/loopover-miner/bin/*, packages/loopover-mcp/{lib,bin}/*) to confirm the new globs instrument correctly and the subprocess-only entrypoints report a clean 0% instead of crashing the coverage collector. This PR itself also touches .github/workflows/**, which is already inside the backend filter, so this PR's own CI run exercises the full validate-tests job regardless of the fix.
• npm run test:workers — not run; this PR does not touch test/workers/** or Worker-runtime code.
• npm run build:mcp — not run; no packages/loopover-mcp source changed, only its Codecov wiring.
• npm run test:mcp-pack — not run, same reason.
• npm run ui:openapi:check — not run; no OpenAPI-affecting change.
• npm run ui:lint / ui:typecheck / ui:build — not run; no apps/loopover-ui/** change.
• npm audit --audit-level=moderate — not run; no dependency change.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — N/A, this PR changes only .github/workflows/ci.yml, vitest.config.ts, and codecov.yml (CI/coverage configuration, not src/**), so it carries no Codecov patch-coverage obligation itself; its effect is validated by the scoped vitest --coverage run above plus this PR's own CI run.

If any required check was skipped, explain why:

• See the unchecked boxes above — this is a CI/Codecov configuration change with no application source touched, so the UI/MCP/worker/dependency toolchains are unaffected and weren't exercised locally. The change is validated by actionlint + typecheck (both clean) and a targeted vitest --coverage smoke test against the exact new include/exclude entries (see Summary), plus this PR's own live CI run.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — N/A, no such change.
• API/OpenAPI/MCP behavior is updated and tested where needed — N/A, no API/MCP behavior changed, only its coverage wiring.
• UI changes use live API data or real empty/error/loading states — N/A, no UI change.
• Visible UI changes include a UI Evidence section — N/A, no visible/UI change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs (none touched here).

Notes

• This is a CI-config/guarded-path change (.github/workflows/ci.yml), so per the gate's own rules it will be held for manual owner review/merge rather than auto-merged, which is expected and appropriate here.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.03%. Comparing base (eae7286) to head (6a8de2c).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7326      +/-   ##
==========================================
- Coverage   93.80%   91.03%   -2.78%     
==========================================
  Files         706      714       +8     
  Lines       69629    72102    +2473     
  Branches    19098    19163      +65     
==========================================
+ Hits        65316    65635     +319     
- Misses       3302     5427    +2125     
- Partials     1011     1040      +29     

Flag	Coverage Δ
rees	88.56% <ø> (ø)
shard-1	41.73% <ø> (-1.69%)	⬇️
shard-2	35.72% <ø> (-1.73%)	⬇️
shard-3	31.63% <ø> (-1.29%)	⬇️
shard-4	32.59% <ø> (-1.60%)	⬇️
shard-5	30.56% <ø> (-1.47%)	⬇️
shard-6	43.56% <ø> (-2.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 8 files with indirect coverage changes

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-19 17:05:33 UTC}

3 files · 1 AI reviewer · 2 blockers · CI failing · blocked

🛑 Suggested Action - Manual Review

Review summary
This is a config-only CI/coverage-wiring change: it extends the `validate-tests`/`validate-tests-merge` trigger conditions to fire on mcp/engine/miner/discoveryIndex path changes (not just backend/rees), adds a new `discoveryIndex` path filter, closes `coverage.include` gaps for `loopover-miner/bin/**` and `loopover-mcp/{lib,bin}/**`, and exempts the two subprocess-only CLI entrypoints from patch grading in codecov.yml. The changes are internally consistent — the new `discoveryIndex` filter output is properly wired into both `validate-code`'s and `validate-tests`'/`validate-tests-merge`'s trigger conditions, and the codecov.yml ignore entries match the new vitest.config.ts include globs for the two named dispatcher files. CI shows `validate` and one `validate-tests` shard as failed, which given the described history (skipped coverage jobs / vacuous passes) plausibly reflects the new gate actually catching something for the first time rather than a defect in this diff itself.

Nits — 4 non-blocking

• The PR fixes a CI/coverage-config gap with no config-testing harness available in this repo, so the 0.00 test-to-code ratio flagged by the external brief isn't actionable here — there's no reasonable way to unit-test GitHub Actions trigger conditions or vitest coverage globs in this codebase.
• vitest.config.ts:39-40 adds both `**/*.js` and `**/*.ts` globs for `loopover-miner/bin/**` and `loopover-mcp/{lib,bin}/**` — worth double-checking none of these dirs contain build output or generated `.js` files that would double-count already-compiled artifacts as source.
• Since `validate` and `validate-tests (3)` are currently failing on this commit, it'd help to note in the PR whether that's the coverage gate now correctly catching a previously-invisible gap (e.g. one of the newly-included packages lacking sufficient patch coverage) versus an unrelated flake, so reviewers don't have to guess.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Why this is blocked

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

2. Maintainer requires a linked issue — Link the relevant issue (for example `Closes #123`) before opening the PR.

CI checks failing

• validate
• validate-tests (3)

Decision drivers

• ❌ Code review — 2 blockers (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 28 registered-repo PR(s), 21 merged, 280 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 28 PR(s), 280 issue(s).
Improvement	ℹ️ None detected	risk: low · value: none · LLM: moderate

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 28 PR(s), 280 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review