ci(visual): R2 Phase B - screenshot tests on the pinned rendering stack + report-only PR gate

[pftg]

Summary

Second PR of DevX Round 2: brings visual regression back to CI — the thing PR #386 had to remove — now that the rendering stack is pinned and glibc everywhere.

Why it's viable now

The old blocker was Alpine/musl-recorded baselines vs Ubuntu/glibc runners (3–28% text-rendering divergence). Since Phase 4, the canonical stack is Debian/glibc with pinned Chrome for Testing (.dev/cft-version), a deterministic fontconfig (.dev/fonts.conf), and pinned fonts — and bin/setup-test-env installs that exact stack on any glibc host, including GitHub's runners. A CI job provisioned that way renders the same pixels as the linux/ baselines.

What changed in .github/workflows/test.yml

• Both modes now run on the pinned stack: bin/setup-test-env + eval --print-env exports CHROME_BIN/CHROMEDRIVER_PATH; the CfT download is cached keyed on .dev/cft-version. Previously the workflow used whatever Chrome ubuntu-latest shipped that week — compare runs diffed unpinned pixels against pinned baselines, and record mode would have silently overwritten the canonical linux/ baselines with unpinned renders.
• New pull_request trigger, paths-filtered to visual surfaces (themes/**, config/**, postcss.config.js, test/system/**, fixtures, the stack pins) — runs rake test:critical as a report-only gate (continue-on-error: true): failures upload the snap_diff report and comment on the PR without blocking the merge. After a clean soak week, flipping that one flag makes it blocking.
• Record mode is now workflow_dispatch-only and sets ALLOW_DIRTY_SCREENSHOTS=1 explicitly (the one place a dirty fixtures tree is intended, given the Phase 3 guard).
• Floating snap-diff/...@master composite refs pinned to the SHA Gemfile.lock already locks.

Follow-through after merge

Dispatch Screenshot Tests with update-baselines: true once — that re-records the linux/ baselines on the pinned stack in CI, which also closes Round 1's pending re-baseline without needing a Docker-capable machine.

.okf/build/ci-gates.md updated to record the decision reversal + soak plan.

Verification

• YAML validated; job conditions traced per event: PR → report-only compare; dispatch compare → full rake test; dispatch record → record + commit, never on PRs.
• bin/setup-test-env handles non-root fontconfig (~/.config/fontconfig) and GitHub runners have passwordless sudo for the font packages; the CfT bucket (storage.googleapis.com) is reachable from runners.
• This PR itself touches no visual surface, so the new PR trigger won't fire here; the first real exercise is the post-merge baseline dispatch.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01PXHeUErqoiyH9xN1mjC8cH

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@pftg, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 47f51f5b-3291-4abe-91db-8405cffec5fa

📥 Commits

Reviewing files that changed from the base of the PR and between fd57bef and d5df5da.

📒 Files selected for processing (3)

• .github/workflows/test.yml
• .okf/build/ci-gates.md
• .okf/log.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}