tech-debt-ci-review

Run a structured audit that inventories CI workflows, test configurations, and dependency manifests, then validates each candidate finding with exact file and line evidence. Findings are classified as confirmed, disproved, unverified, or pre-existing before reporting.

Test theater is tests that assert only existence, truthiness, or snapshots without behavioral meaning, or that validate mocks instead of real behavior. Detect it with mutation thinking: ask whether the test would fail if the implementation returned early, inverted a boolean, or swallowed an error.

Look for timing-sensitive assertions, fixed sleeps, unseeded random data, order-dependent tests, hidden shared state, and reliance on wall clock, network, or filesystem. Runtime validation with retries can separate flaky from deterministic failures but is not a fix.

Yes, the audit checks workflow YAML validity, job dependency graphs, matrix values, cache behavior, and whether CI commands match the repo's actual tooling such as npm ci, ruff, and pytest. It flags drift between declared checks and real verification.

Use the deep audit when a lightweight compatibility pass finds structural risk or when you need a broad review of test quality, flaky-test risk, and toolchain brittleness. Quick checks suit routine PR validation; deep audits suit systemic CI distrust.