ci: run coco-dev-versions and import-specifiers drift checks in CI

[jeffrey701]

What

Two checks wired into package.json's test:ci are run by no GitHub Actions job, so they can only
fail locally — the same "local-only-until-now" gap the many drift-check steps already in
.github/workflows/ci.yml were each added to close:

1. coco-dev-versions:check — reconciles k8s/coco-dev/versions.json with the KBS kustomization's
   recorded version. Nothing in .github/workflows/ references k8s, so no job or path filter ran it.
2. import-specifiers:check (scripts: unify relative-import specifiers with src/** (extensionless) and add a drift guard #9221) — enforces the per-zone relative-import specifier convention over
   src, scripts, test and every packages/* workspace. Not run by any job, and its test was
   entirely injection-based — #9240 and #9249 are two real drifts that reached main while the guard was
   local-only.

Change

• .github/workflows/ci.yml: a new cocoDev path-filter output (matching k8s/coco-dev/** and
  scripts/check-coco-dev-versions*.ts) plus a Coco-dev versions check step gated on it; and an
  Import specifiers check step gated on push || backend || mcp || engine || miner || discoveryIndex
  (every filter covering one of the checker's BUNDLER_ROOTS/NODENEXT_ROOTS). Each step carries a
  comment naming the gap it closes, in the surrounding steps' style.
• test/unit/check-import-specifiers-script.test.ts: a real-tree regression test that calls
  findImportSpecifierViolations() with no injected listSourceFiles/readFile and asserts [] —
  mirroring the same real-tree guard check-coverage-bolt-on-filenames-script.test.ts and
  validate-no-hand-written-js.test.ts already have, with a comment naming chore(imports): packages/loopover-ui-kit drifted from #9221's extension convention (introduced by #9239) #9240/chore(imports): test/unit/engine-coverage-script.test.ts drifted from #9221's extension convention (introduced by #9245) #9249.

Validation

• npm run actionlint and npm run lint:composite-actions pass on the edited workflow.
• Confirmed the real tree has zero import-specifier violations from real source: every entry the
  checker reports comes from a source the checker excludes on CI — node_modules/** (via
  EXCLUDED_SEGMENT) and the two fixture-bearing files in ALLOWED_FILENAMES
  (check-import-specifiers-script.test.ts, check-dead-source-files-script.test.ts) — so
  findImportSpecifierViolations() returns [], and the new test passes.
• .github/workflows/** and scripts/** are outside Codecov's coverage.include, so no patch-coverage
  obligation applies to the workflow edit.

Closes #9649

[superagent-security]

Superagent Supply Chain Scan

Superagent flagged 1 dependency introduced by this pull request.

High risk: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9

• Change: added 55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• Dependency path: .github/workflows/ci.yml → jobs → validate-code → steps → 24 → actions/cache/restore
• Correlated risks: 3
• Why flagged: Detects keylogging and input capture patterns. Location: cache-55cc8345863c7cc4c66a329aec7e433d2d1c52a9/dist/restore-only/index.js. Rules: threat-runtime-keylogging
• Risk score: 4.9

View Superagent Supply Chain Scan

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-30 16:02:22 UTC}

2 files · 1 AI reviewer · no blockers · CI failing · unstable

🛑 Suggested Action - Fix Blockers

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): .github/workflows/ci.yml (matched .github/workflows/**).

Review summary
This PR wires two existing `test:ci` checks — `coco-dev-versions:check` and `import-specifiers:check` — into `.github/workflows/ci.yml` via new/existing path filters, closing a real local-only-until-now gap explicitly tied to issue #9649. It also adds a real-tree regression test for `findImportSpecifierViolations()` mirroring the existing pattern used by sibling checkers. The change is narrow, well-justified with inline comments, and the gating conditions (cocoDev filter; backend/mcp/engine/miner/discoveryIndex union for import-specifiers) look correctly scoped to the checkers' actual root coverage as described.

Nits — 6 non-blocking

• The new real-tree test in test/unit/check-import-specifiers-script.test.ts:141-143 depends on the current state of the repo tree passing with zero violations — if that assumption ever becomes false for a legitimate reason (e.g. a new file added under an excluded root), this test could produce a confusing failure disconnected from the actual PR causing it; worth a comment noting how to add exclusions if that happens.
• The Import specifiers check step (ci.yml:462) is not gated on `ui`, `rees`, `controlPlane`, or `observability` filters — confirm those areas fall genuinely outside `BUNDLER_ROOTS`/`NODENEXT_ROOTS` as claimed, since a silent gap there would be exactly the kind of issue this PR is trying to close.
• `.github/workflows/ci.yml` is now ~466 lines per the size-smell note; this PR only adds 23 lines to an already-large file, so it's not this PR's problem to fix, but worth flagging for a future workflow-splitting effort.
• Consider adding a one-line note near the cocoDev filter (ci.yml:205) cross-referencing the coco-dev-versions:check script's own root list, so future contributors adding files to k8s/coco-dev/** know to check the filter stays in sync.
• For the Import specifiers check, consider verifying (via a comment or explicit filter) that no root outside the listed unions (ui/rees/controlPlane/observability) can contain relative-import specifiers the checker would flag.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

CI checks failing

• Superagent Supply Chain Scan — Supply chain risks detected

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9649
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 84 registered-repo PR(s), 40 merged, 20 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jeffrey701; Gittensor profile; 84 PR(s), 20 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal

Linked issue satisfaction

Addressed
The diff adds the cocoDev path-filter output and gated step for coco-dev-versions:check, a gated Import specifiers check step with the exact condition specified, and a real-tree regression test in check-import-specifiers-script.test.ts asserting zero violations with the required #9240/#9249 comment, matching all four listed deliverables.

Review context

• Author: jeffrey701
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Rust, TypeScript, Clojure, JavaScript
• Official Gittensor activity: 84 PR(s), 20 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: guardrail_hold
• config: fbbe94db0cafd52515c6f720e74fb4a76f82f85c3394c98ccdc376b8d68b78c8 · pack: oss-anti-slop · ci: failed
• note: diverted by the randomized close-audit holdout (calibration: randomized ε-holdout on would-close PRs with propensity logging #8831) — the deterministic pipeline would otherwise have closed this PR
• record: a5dd91b2a89bb6cc7aade5b58b3730d62811d8c91290ff06b4477148c956b1d4 (schema v5, head 538add2)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.86%. Comparing base (f051cd2) to head (538add2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9928   +/-   ##
=======================================
  Coverage   91.86%   91.86%           
=======================================
  Files         921      921           
  Lines      113270   113270           
  Branches    27301    27301           
=======================================
  Hits       104053   104053           
  Misses       7929     7929           
  Partials     1288     1288           

Flag	Coverage Δ
backend	95.68% <ø> (ø)
control-plane	100.00% <ø> (ø)
rees	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[JSONbored]

Risks detected in failing CI, closing.