[VikramChennai]

Summary

• Adds .github/workflows/ardent-branch.yml to validate the CI flow end-to-end
• On PR: installs ardent-cli, logs in with token, creates a branch, extracts DATABASE_URL, verifies it, deletes the branch
• Once this passes, we copy the tested YAML into the CI/CD docs page

Prereq

ARDENT_TOKEN must be set as a repo secret.

Made with Cursor

---

Note

Low Risk
Changes are limited to CI, dev test dependencies, and documentation; no production app or auth logic changes.

Overview
Adds a PR GitHub Actions workflow (.github/workflows/ardent-branch.yml) that exercises the documented Ardent branch CI pattern: install ardent-cli@0.0.44, log in with ARDENT_TOKEN, create a per-PR branch, validate and mask the Postgres DATABASE_URL, run npm test, and delete the branch only when creation succeeded (ARDENT_BRANCH_CREATED).

Introduces a minimal Node test harness (package.json, package-lock.json, tests/branch-moles/migration.test.js with Vitest + pg) to run a full migration lifecycle against the branch URL from CI.

Updates CI/CD docs (workflows/ci-cd.mdx) to match the hardened workflow (explicit login, token scoped to CLI steps, URL scheme check, ::add-mask::, job timeout, pinned CLI version). Regression testing (workflows/regression-testing.mdx) now points readers to the CI/CD page instead of duplicating inline CI notes.

^{Reviewed by Cursor Bugbot for commit 0e1eaf7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d894d50. Configure here.}

[greptile-apps]

Greptile Summary

This PR introduces a GitHub Actions workflow that provisions an Ardent database branch per PR, runs a Vitest/pg migration lifecycle test against it, and tears the branch down — along with matching docs and a minimal Node test harness. Previous review rounds addressed credential masking, CLI pinning, URL validation, and test structure; this iteration resolves all of those.

• .github/workflows/ardent-branch.yml: Correctly pins ardent-cli@0.0.46, validates the URL prefix with a case block before masking and exporting, guards cleanup with ARDENT_BRANCH_CREATED, and sets a 15-minute job timeout — but the Delete database branch step has no continue-on-error: true, so a transient deletion failure silently marks a passing job as failed and orphans the branch indefinitely.
• tests/branch-migration.test.js: Consolidated into a single it() block with parameterized information_schema queries and a 60 s per-test timeout; afterAll swallows all cleanup errors without logging, making leaked-table diagnosis difficult.
• workflows/ci-cd.mdx: Accurately mirrors the hardened workflow; the "Other CI providers" bash snippet exports DATABASE_URL without a note about platform-specific secret masking.

Confidence Score: 4/5

The workflow is safe to merge for the stated CI-validation goal, but the cleanup step will incorrectly fail the job on transient network errors and orphan branches with no recovery path.

The delete step has no continue-on-error: true. Any transient Ardent API or network error during branch deletion marks the entire job as failed, even when every migration test passed. Over time this trains developers to ignore red CI and leaves orphaned database branches with no audit trail — directly contrary to the team's stated durability and paper-trail requirements. The test harness and documentation are otherwise sound.

.github/workflows/ardent-branch.yml — specifically the Delete database branch step and its interaction with job-level status reporting.

Important Files Changed

Filename	Overview
.github/workflows/ardent-branch.yml	New end-to-end CI workflow; correctly pins CLI version, validates URL format, masks credentials, and uses ARDENT_BRANCH_CREATED guard — but the delete step lacks continue-on-error, so transient cleanup failures will mark a passing job as failed and silently orphan branches.
tests/branch-migration.test.js	Single consolidated test covering full DDL lifecycle (create, insert, alter, drop) with parameterized queries and 60 s timeout; afterAll silently swallows cleanup errors, making orphaned-table diagnostics harder in CI.
workflows/ci-cd.mdx	Documentation mirrors the hardened workflow accurately — pinned CLI version, explicit login step, URL masking, ARDENT_BRANCH_CREATED guard, 15-minute timeout all reflected; "Other CI providers" bash snippet still exports DATABASE_URL without a platform-specific masking note.
workflows/regression-testing.mdx	Regression testing doc updated to point readers to ci-cd.mdx for CI steps instead of duplicating them; no issues.
package.json	Adds pg and vitest as devDependencies; vitest run script is correctly defined; no issues.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant CLI as ardent-cli@0.0.46
    participant Ardent as Ardent Service
    participant DB as Branch Database
    participant Test as Vitest / pg

    GH->>CLI: "npm install -g ardent-cli@0.0.46"
    GH->>CLI: ardent login --token $ARDENT_TOKEN
    CLI->>Ardent: authenticate
    Ardent-->>CLI: session established
    GH->>CLI: ardent project switch + connector switch
    GH->>CLI: "ardent branch create pr-{N}-{run_id} --print-url"
    CLI->>Ardent: provision branch
    Ardent->>DB: clone from source
    DB-->>Ardent: branch ready
    Ardent-->>CLI: DATABASE_URL
    CLI-->>GH: stdout captured into shell var
    Note over GH: validate postgres:// prefix, mask, write to GITHUB_ENV
    GH->>Test: npm test (DATABASE_URL in env)
    Test->>DB: connect, CREATE TABLE, INSERT, ALTER, DROP
    DB-->>Test: results
    Test-->>GH: pass / fail
    alt "always() and ARDENT_BRANCH_CREATED == true"
        GH->>CLI: "ardent branch delete pr-{N}-{run_id}"
        CLI->>Ardent: delete branch
        Note over GH: no continue-on-error — failure here marks job failed
    end

Loading

Comments Outside Diff (1)

1. .github/workflows/ardent-branch.yml, line 61-65 (link)

   Cleanup failure marks a passing job as failed and silently orphans the branch

   ardent branch delete runs with no continue-on-error: true. Any transient network error, CLI timeout, or API hiccup during deletion flips the job status to "failure" — even when every migration test passed. Developers will see a red check on a green test run, eroding trust in CI signal over time. More critically from a resource standpoint, the orphaned branch is never retried or logged, so it stays alive indefinitely with no paper trail. Adding continue-on-error: true decouples cleanup reliability from test-result reporting; the branch name is already in ARDENT_BRANCH so a failed deletion can be investigated and retried manually.

_{Reviews (3): Last reviewed commit: "test: fix migration lifecycle syntax" | Re-trigger Greptile}