* feat(action): add scope input to opt into full-project scans on PRs
On pull_request events the action scopes the scan to the PR's changed files
(baseline/diff mode), with no way to scan the whole project. A PR that only
adds config/workflow files therefore reports 0 issues even when the project
has obvious problems in untouched files.
Add a 'scope' input: 'changed' (default, unchanged baseline/diff behavior) or
'full'. When full, skip the pr-files and base steps and pass '--diff false' —
the documented full-scan escape hatch, which disables baseline/diff and
overrides any diff value in the project config. The scope value is lowercased
before the bash test so it matches the case-insensitive comparison the GHA
'inputs.scope != full' expressions use.
Co-authored-by: Ray Arayilakath <me@rayhanadev.com>
* style(action): simplify the --diff false comment to plain language
Co-authored-by: Ray Arayilakath <me@rayhanadev.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Enrich the per-scan Sentry run span with the full run/CI/project/outcome
context (scan mode, score, diagnostics by severity/category, top rule,
lint/dead-code state, and in CI the GitHub event, official-action marker,
forwarded action inputs, and the pull-request gate) so usage and CI behavior
are queryable as spans instead of pre-aggregated counters.
Mint a random per-run runId on the Sentry run context (never a tag or metric
dimension) to correlate the spans of a single run; a workspace invocation's
project scans share one id and per-project span attributes disambiguate. The
wide event's wouldBlock/outcome/exitCode mirror the CLI's real fail-on gate
(ciFailure surface, and no gate in score-only mode). The official GitHub
Action forwards its inputs so action configuration is visible in telemetry.
Telemetry stays anonymized — no repo, owner, username, branch, or path is
sent to Sentry — and --no-score / --no-telemetry opts out.
Co-authored-by: Cursor <cursoragent@cursor.com>
The composite Action is versioned independently from the npm packages via
v-prefixed semver tags (vX.Y.Z) plus a floating major (vN), distinct from
the Changesets `<pkg>@X.Y.Z` tags. Documents the bump rules, the signed-tag
gotcha, and the release/floating-major commands.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the mutable `millionco/react-doctor@main` reference in the GitHub
Actions example with the `@v1` floating release tag, and add a note on
pinning to a full commit SHA for hardened CI (the example grants
`pull-requests: write`). Avoids running whatever `main` points at runtime.
Co-authored-by: Cursor <cursoragent@cursor.com>
`canAnimateOnboarding` only excluded CI, so a git hook invoked by an
interactive `git commit` (real inherited TTY, `GIT_DIR` set) would play
the score-bar count-up and onboarding pacing, emitting cursor escapes
into hook output (issue #293). Add `isGitHookEnvironment()` and gate it
out, while keeping the deliberate coding-agent real-TTY animation.
`--diff` now accepts git's own range syntax: two-dot `A..B` (diff A
directly against B) and three-dot `A...B` (diff from the merge-base of A
and B to B). Each endpoint is individually validated against the
anti-injection guard, so a range can't smuggle a `--upload-pack=`-style
option past it, and an empty endpoint defaults to HEAD (`main..` means
`main..HEAD`).
An invalid `--diff` value (a malformed ref/range, or a base branch that
hasn't been fetched) is now rendered as a clean, single-line message and
exits non-zero. It no longer prints the generic "Something went wrong,
open a prefilled issue" block or reports the expected user error to
Sentry: getDiffInfo now propagates the tagged ReactDoctorError so the CLI
dispatches on reason._tag via the new isUserInputError classifier.
Fixes REACT-DOCTOR-9
Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions[bot]