Release: staging -> main (2026-04-13)

[is0692vs]

Summary

Promotes staging into main.

• Source branch: staging
• Target branch: main
• Generated by npm run pr:promote

Included PRs

• fix(api): bound R2 delete batch concurrency #417: fix(api): bound R2 delete batch concurrency (@is0692vs)
• fix(api): add cleanup chunk context for paper rollback #416: fix(api): add cleanup chunk context for paper rollback (@is0692vs)
• chore: sync main into staging #410: chore: sync main into staging (@app/github-actions)
• fix: address PR 414 review feedback #415: fix: address PR 414 review feedback (@is0692vs)
• ⚡ perf: use sequential bounded batching for R2 bucket deletions #397: ⚡ perf: use sequential bounded batching for R2 bucket deletions (@is0692vs)
• ⚡ [Performance] Optimize file upload concurrency with p-map #405: ⚡ [Performance] Optimize file upload concurrency with p-map (@is0692vs)
• test(e2e): strengthen backend auth and real session coverage #407: test(e2e): strengthen backend auth and real session coverage (@is0692vs)
• ci: automate staging to main PR creation #411: ci: automate staging to main PR creation (@is0692vs)

Compare

• https://github.com/Hiroki-org/OpenShelf/compare/main...staging?expand=1

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
open-shelf	Ignored		Apr 13, 2026 3:33am

[coderabbitai]

Warning

Rate limit exceeded

@is0692vs has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 13 minutes and 50 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 50 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 63ddb621-ffa1-46b2-8ff3-513505d1dd01

📥 Commits

Reviewing files that changed from the base of the PR and between 28ef2e2 and f4a712a.

📒 Files selected for processing (2)

• apps/api/src/routes/__tests__/papers.test.ts
• apps/api/src/routes/papers.ts

📝 Walkthrough

Walkthrough

ステージング→メイン昇格用のGitHub Actionsワークフローを追加し、APIの並列アップロードをp-mapで制御するように変更、E2E向けの認証ヘルパーと複数のPlaywrightテストを追加・拡張しました。

Changes

Cohort / File(s)	Summary
GitHub Actions ワークフロー .github/workflows/promote-staging-to-main.yml	stagingブランチへのpushおよび手動workflow_dispatchでトリガーされる「Promote Staging To Main」ワークフローを追加。単一のconcurrencyグループと権限設定、create-staging-to-main-pr.shを実行するジョブを定義。
API 依存関係 apps/api/package.json	ランタイム依存にp-map (^4.0.0) を追加（並列アップロード制御に使用）。
Papers ルート（ロジック変更 & テスト） apps/api/src/routes/papers.ts, apps/api/src/routes/__tests__/papers.test.ts	アップロードの並列制御を手動チャンク+Promise.allSettled→p-map(..., { concurrency })に置換。アップロード結果を成功鍵とエラーに集約。クリーンアップ処理をチャンクごとのPromise配列に変更し、個別に失敗をログ化して無視する実装へ。テストはバケット削除のモックを失敗させるケースとconsole.errorのアサートを追加。
E2E 認証ヘルパー apps/e2e/helpers/auth.ts	apiURL/testAuthSecret/testOriginを定数としてエクスポート。新しいissueTestToken(request, user?)を追加し、loginAsTestUserはこれを利用するようリファクタ。型と戻り値を明確化。
E2E テストシナリオ apps/e2e/tests/scenarios/auth-flow.spec.ts, apps/e2e/tests/scenarios/backend-auth-e2e.spec.ts	ログイン後のGET /api/users/me検証、ログアウト時の401検証などの新規テストを追加。/api/test-auth/test-tokenおよび/api/test-auth/test-orgの認可・入力検証・正常系を網羅するE2Eケースを追加。
ユーティリティ最適化（小変更） patch.diff	inviteeIds生成をmap+filter+Setから単一走査のreduceベースへ置換（重複除去ロジックの実装変更）。

Sequence Diagram(s)

（条件を満たさないため、シーケンス図は省略します）

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• ⚡ [Performance] Optimize file upload concurrency with p-map #405: apps/api/src/routes/papers.tsでのアップロード処理をp-mapベースに置き換える変更と依存追加が重複。
• test(e2e): strengthen backend auth and real session coverage #407: E2E認証ヘルパーの拡張と認証フロー関連テストの追加／修正が重複。
• feat: add staging to main promotion PR command #375: ステージング→メイン昇格のワークフロー／スクリプト追加に関わる変更が重複。

Poem

🐰 ぴょん、ステージから本番へ跳ねるよ、
並列の波を軽やかに越えて、
テストが合図を送り、トークンは踊る、
ワークフローは自動で扉を開き、
ころころ、デプロイの道を進む。

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	プルリクエストのタイトル「Release: staging -> main (2026-04-13)」は、stagingをmainにプロモートするという変更セットの主要な目的を明確に要約している。
Description check	✅ Passed	プルリクエストの説明は、stagingをmainにプロモートするという目的に完全に関連しており、含まれるPRの詳細なリストと比較リンクも提供されている。

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch staging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces the p-map library to handle concurrent file uploads more efficiently in the papers route. It also refactors E2E authentication helpers and adds comprehensive tests for backend authentication flows. Review feedback highlights performance regressions in file deletion logic, where previously parallel operations were changed to sequential ones in both the POST and DELETE routes. Furthermore, it is recommended to update API test assertions to use toEqual for stricter and more robust validation of response bodies.

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks
⏩ 15 skipped benchmarks¹

---

_{Comparing staging (f4a712a) with main (9ef24d9)}

Footnotes

1. 15 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[codecov]

Codecov Report

❌ Patch coverage is 86.79245% with 7 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
apps/api/src/routes/papers.ts	86.79%	7 Missing ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/api/src/routes/papers.ts`:
- Around line 699-703: The cleanup error log in the block pushing to
cleanupPromises (where c.env.BUCKET.delete(uploadedKeys.slice(i, i + 1000)) is
called) lacks context about which chunk failed; update the catch handler for
that promise to include the chunk identifiers (e.g., the slice range i..i+1000
and/or a sample or count from uploadedKeys.slice(i, i + 1000)) along with the
error details when calling console.error so you can trace which keys caused the
cleanup failure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e1c5e258-67a6-404c-b1a9-d561a914a2cb

📥 Commits

Reviewing files that changed from the base of the PR and between 9ef24d9 and f85d39e.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• .github/workflows/promote-staging-to-main.yml
• apps/api/package.json
• apps/api/src/routes/__tests__/papers.test.ts
• apps/api/src/routes/papers.ts
• apps/e2e/helpers/auth.ts
• apps/e2e/tests/scenarios/auth-flow.spec.ts
• apps/e2e/tests/scenarios/backend-auth-e2e.spec.ts
• patch.diff

💤 Files with no reviewable changes (1)

• patch.diff

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/api/src/routes/papers.ts`:
- Around line 697-713: The current rollback cleanup builds cleanupPromises by
calling c.env.BUCKET.delete(chunk) for every 1000-key chunk and then awaits
Promise.all, which fires all deletes concurrently; change this to use a shared
helper (e.g., ensureSequentialOrBoundedDeletes) that accepts uploadedKeys and a
concurrency limit, and performs deletion either sequentially or with a bounded
worker pool (N parallel tasks) to avoid mass parallel requests; replace the
inline loops that build cleanupPromises (the block using uploadedKeys,
cleanupPromises, and c.env.BUCKET.delete) and the similar code at the other
occurrence with calls to this helper so R2 deletes are rate-limited and
backpressure-safe.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0b914181-ccb8-45fa-8f8f-ac4a8ab9be37

📥 Commits

Reviewing files that changed from the base of the PR and between f85d39e and 28ef2e2.

📒 Files selected for processing (2)

• apps/api/src/routes/__tests__/papers.test.ts
• apps/api/src/routes/papers.ts