feat(init): prune reports by API with a retention and size-budget sweep by BenSheridanEdwards · Pull Request #329 · BenSheridanEdwards/StyleProof

BenSheridanEdwards · 2026-07-21T14:09:53Z

Stacked on #328 (the API publisher); this PR is the pruning half of the same problem.

Why does this feature exist?

So the report branch stays bounded without the consumer ever thinking about it. The scaffolded prune job cloned the branch bloblessly and used git rm + git push; that looks cheap but is not, because git push re-fetches the retained blobs to build its pack, so pruning cost the size of the whole branch — the same failure mode #328 removes from publish.

Close-triggered pruning alone also cannot bound the branch. A missed close event (Actions outage, workflow not yet on the default branch, repos scaffolded before the prune job existed) leaks a folder forever. And retention cannot hold a size ceiling: one PR can publish hundreds of megabytes of crops, so the folders that blow the budget are routinely younger than any reasonable retention window.

What changed?

New src/report-prune.ts and bin/styleproof-prune-reports.mjs (registered in package.json bin), with two modes: --pull-request <n> deletes one folder on close; --retention-days <d> --budget-bytes <b> sweeps by the retention window, then keeps deleting oldest-closed first while the branch is over budget. Reports for open PRs are never touched; if open PRs alone exceed the budget it warns instead of deleting them. Deletion is a server-side subtree removal in one commit; a lost fast-forward race re-reads the tip, re-selects, and retries; a truncated tree listing refuses to prune rather than select on partial size data.
bin/styleproof-init.mjs scaffold: the close-prune job now calls the packaged command instead of cloning; a daily report-sweep job is added (defaults: 14 days, 1.5 GB, editable as two plain flags in the generated workflow); the report job is guarded to pull_request events so the schedule cannot trigger it.
Not in this PR: the map-store prune job in the same scaffold has the same clone-to-delete shape (sparse checkout narrows the checkout, not the push). Map bundles are far smaller, so it is left as a follow-up.

Behavioural Proof (with video and screenshots)

Not applicable: CI plumbing with no rendered surface. Behavioural proof is deterministic instead. test/report-prune.test.mjs covers the selection policy (retention window, over-budget oldest-closed-first with the newest reports surviving, open PRs never selected even over budget, under-budget no-op) and the API deletion path (single-commit subtree removals on the current tip, clean no-ops for absent folders and a missing branch, the ref-race re-read/re-select/retry cycle, truncated-listing refusal, and closed-PR timestamp pagination keyed pr-<n>). test/init.test.mjs validates the generated workflow against a real styleproof-init run for every package manager: schedule trigger present, event guards correct, the packaged command in both jobs, and no git rm against the report branch.

Verification Summary

npm test (build + full suite): 630 pass, 0 fail on this branch.
npm run format:check: clean.
The generated .github/workflows/styleproof.yml from a real init run parses as YAML with jobs styleproof, prune, report-sweep and on: [pull_request, schedule].
Action dogfood and Map store dogfood workflows: green on this PR.

github-actions · 2026-07-21T14:10:30Z

Fallow audit report

Found 2 findings.

Details

Severity	Rule	Location	Description
minor	`fallow/code-duplication`	`bin/styleproof-prune-reports.mjs`:21	Code clone group 1 (10 lines, 2 instances)
minor	`fallow/code-duplication`	`src/report-prune.ts`:100	Code clone group 2 (12 lines, 2 instances)

Generated by fallow.

github-actions · 2026-07-21T14:10:31Z

🗺️ StyleProof report

📊 View the side-by-side visual report →

A navigable affordance was removed without acknowledgement — repair or acknowledge it; visual approval cannot clear this failure.

github-actions

Fallow audit report

Quality gate failed

3 inline findings selected for GitHub review.

github-actions · 2026-07-21T14:10:32Z

+  selectReportFoldersToPrune,
+} from '../dist/report-prune.js';
+
+const argv = process.argv.slice(2);


warn fallow/code-duplication: Code clone group 1 (10 lines, 2 instances)

Fix intent: Extract the repeated block or centralize shared logic.

github-actions · 2026-07-21T14:10:33Z

@@ -0,0 +1,38 @@
+import { defineConfig, devices } from '@playwright/test';


error fallow/unused-file: File is not reachable from any entry point

Fix intent: Delete the file or add a real entry-point reference.

Run fallow fix --files or delete this file.

Resolved in 823e84f.

Resolved in 4857906.

github-actions · 2026-07-21T14:10:33Z

+    const response = await fetchImplementation(`${repositoryUrl}${apiPath}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${options.token}`,


warn fallow/code-duplication: Code clone group 2 (12 lines, 2 instances)

Fix intent: Extract the repeated block or centralize shared logic.

BenSheridanEdwards · 2026-07-21T16:54:28Z

Heads up: #328 (publish reports through the git-data API) is now merged to main, and this PR conflicts with it non-trivially — so I've left it for you rather than force-resolve it.

The conflict is a real semantic overlap, not a mechanical one:

feat(action): publish reports through the git-data API #328 refactored src/report-publish.ts from the old inline publish flow into extracted helpers (readBranchTipCommitSha, uploadBlob, uploadReportFileEntries, readmeEntry, buildTreePayloadOnTip, advanceBranchToCommit, measureBranchSizeBytes). This branch is still based on the pre-refactor inline version, so all five conflict regions there are the same logic in two different shapes.
Functional overlap worth reconciling deliberately: feat(action): publish reports through the git-data API #328 already added measureBranchSizeBytes (report-branch size measurement), which is exactly the primitive this PR's size-budget sweep needs. The right rebase reuses feat(action): publish reports through the git-data API #328's helper rather than re-implementing it, so the retention + size-budget prune sits on top of feat(action): publish reports through the git-data API #328's structure.
test/action.test.mjs also conflicts (one region) for the same reason.

Recommend rebasing onto current main and re-applying the prune-sweep on the new helper surface — you own the intended final shape of both features, so this reconciliation is safer in your hands than a mechanical resolve. Everything else in the StyleProof PR queue is merged (#330, #312, #327, #328); this and the broken dev-deps bump (#313, an ERESOLVE on typescript@7 vs typescript-eslint@8.64) are all that's left.

The scaffolded prune job cloned the report branch to delete one folder. A blobless clone does not make that cheap: git push re-fetches the retained blobs to build its pack, so pruning cost the size of the whole branch — the exact failure mode the API publisher removed from publish. Pruning now goes through the packaged styleproof-prune-reports command, which deletes folders as server-side subtree removals and retries the fast-forward race by re-reading and re-selecting against the fresh tip. Close-triggered pruning alone also cannot bound the branch: a missed close event leaks a folder forever, and one PR can publish hundreds of megabytes of crops, so the folders that blow the budget are routinely younger than any reasonable retention window. The scaffold therefore adds a daily report-sweep job: delete reports whose PR closed more than 14 days ago, then, while the branch is still over 1.5 GB, keep deleting oldest-closed first. Reports for open PRs are never touched, and a truncated tree listing refuses to prune rather than guess.

`npm audit --audit-level=high` (ci.yml) began failing on every commit once GHSA-v2hh-gcrm-f6hx was published against fast-uri 3.0.0–3.1.3 (host confusion via a literal backslash authority delimiter). It is a transitive dependency, so the advisory turned main red independently of any code change — the #329 build was simply the first to run after it dropped. `npm audit fix` bumps fast-uri 3.1.3 → 3.1.4 (lockfile only, no manifest change) and clears the advisory: `npm audit --audit-level=high` now reports 0 vulnerabilities. Build is clean and the full suite stays 630/630. Co-authored-by: StyleProof Test <styleproof@example.test> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Cut 4.7.0 from the six commits merged since 4.6.3. Two are feature work, so this is a minor bump; the version bump is the Release workflow's signal to tag, publish to npm, and cut the GitHub Release on merge. Added - Reports publish through the git-data API (#328). - styleproof-init prunes reports by API with a retention + size-budget sweep (#329). - CERTIFICATION_FAILED dogfooded end-to-end (#327). Security - Cleared two high-severity transitive advisories: brace-expansion 5.0.6→5.0.7 (#330) and fast-uri 3.1.3→3.1.4, GHSA-v2hh-gcrm-f6hx (#331). Verified locally: build, typecheck, lint, format:check, privacy:check all clean; full node --test suite 630/630 with a complete install. Co-authored-by: StyleProof Test <styleproof@example.test> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

github-actions Bot reviewed Jul 21, 2026

View reviewed changes

BenSheridanEdwards force-pushed the feat/report-prune-sweep branch 2 times, most recently from 350be6c to b190ba6 Compare July 21, 2026 14:19

BenSheridanEdwards force-pushed the feat/api-report-publish branch from 9548d79 to 7318616 Compare July 21, 2026 16:40

BenSheridanEdwards force-pushed the feat/report-prune-sweep branch from b190ba6 to 1a6e2c8 Compare July 21, 2026 16:41

BenSheridanEdwards force-pushed the feat/api-report-publish branch from 7318616 to 2e167fd Compare July 21, 2026 16:45

BenSheridanEdwards force-pushed the feat/report-prune-sweep branch from 1a6e2c8 to 783379c Compare July 21, 2026 16:45

BenSheridanEdwards force-pushed the feat/report-prune-sweep branch from 783379c to ba338c4 Compare July 22, 2026 06:52

BenSheridanEdwards changed the base branch from feat/api-report-publish to main July 22, 2026 06:57

BenSheridanEdwards merged commit 4f8ae3b into main Jul 22, 2026
1 check passed

BenSheridanEdwards mentioned this pull request Jul 22, 2026

fix(deps): resolve the fast-uri high-severity audit advisory #331

Merged

BenSheridanEdwards mentioned this pull request Jul 22, 2026

chore(release): prepare 4.7.0 #332

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(init): prune reports by API with a retention and size-budget sweep - #329

feat(init): prune reports by API with a retention and size-budget sweep#329
BenSheridanEdwards merged 1 commit into
mainfrom
feat/report-prune-sweep

BenSheridanEdwards commented Jul 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Jul 21, 2026

Uh oh!

github-actions Bot Jul 21, 2026

Uh oh!

github-actions Bot Jul 21, 2026

Uh oh!

github-actions Bot Jul 21, 2026

Uh oh!

github-actions Bot Jul 21, 2026

Uh oh!

BenSheridanEdwards commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		@@ -0,0 +1,38 @@
		import { defineConfig, devices } from '@playwright/test';

Conversation

BenSheridanEdwards commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why does this feature exist?

What changed?

Behavioural Proof (with video and screenshots)

Verification Summary

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fallow audit report

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗺️ StyleProof report

📊 View the side-by-side visual report →

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Fallow audit report

Uh oh!

github-actions Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

BenSheridanEdwards commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BenSheridanEdwards commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading