Refactor CI configuration for improved testing

Refactor CI configuration to improve test reliability and coverage reporting. Added steps for React installation, pytest_randomly plugin assertion, and coverage gate checks, while ensuring proper handling of Capella paths verification.

Author: celticht32

.github/workflows/ci.yml

@@ -160,154 +160,3 @@ jobs:
             exit 0
           fi
           uv run python scripts/verify_capella_paths.py
-What I changed and why
-
-1. React install in the test job. This one would have broken your first CI run, not just left a gap. I made test_gui_frontend.py fail instead of skip when CI is set — and GitHub Actions sets CI=true. Without this step, that test now fails in CI. The step is what makes the change safe.
-
-2. import pytest_randomly assertion. The plugin is now in [dev], so uv sync installs it and your existing "randomised order" step becomes real. The one-line import check means a future dependency change fails loudly rather than silently reverting the step to file order — which is how it came to be a no-op in the first place.
-
-3. Coverage gate step. fail_under = 89 is in pyproject.toml; measured 90.5%.
-
-4. capella-paths — visible skip, still exit 0. I kept your reasoning: your comment is right that a job failing for everyone without credentials gets disabled. So the skip stays, but it now emits a ::warning and a job-summary line, so a green tick can't be mistaken for a verified one. Note your if: already excludes pull_request, so the fork case is handled by that condition — if you'd rather a missing secret fail on push to main, change exit 0 to exit 1; that's a one-word edit and I've deliberately left the decision with you.
-
-Two things I did not change: the mutation job needs no React (I checked — no mutation round runs test_gui_frontend.py), and I left the job order and permissions: contents: read alone.
-
-Separately, while checking that: mutation_round_4.py and mutation_round_5.py had the same timeout-as-caught bug I'd only fixed in rounds_1_3 — a pytest timeout returned "caught" with no assertion having failed, in the one tool whose job is to say which controls are untested. Both now raise. Fixed, lint clean, 3061 tests still passing, and both files are on your disk.
-
-Mutation round 4
-PY 
-Mutation round 5
-PY 
-
-name: CI
-# Nothing ran automatically before this. 641 tests and 45 mutation entries existed and
-# were only ever verified by hand, which makes them a snapshot rather than a guarantee.
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv sync --extra dev
-      - name: ruff check
-        run: uv run ruff check .
-      - name: ruff format
-        run: uv run ruff format --check .
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # The floor and the current release. requires-python is >=3.10,<3.15, and the
-        # floor matters: this code uses X | None annotations behind
-        # from __future__ import annotations, which is easy to break on 3.10 only.
-        # 3.14 is included because requires-python claims <3.15 and it was never built.
-        python-version: ["3.10", "3.13", "3.14"]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-      - run: uv sync --extra dev
-      # Node is only needed by the console's compile-and-render tests. They skip cleanly
-      # without it, and a skipped frontend test is how the console came to render a blank
-      # page unnoticed — so CI installs it.
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - name: Tests, in randomised order
-        run: uv run pytest -q
-      - name: Tests, in file order
-        # Both orders, because several modules read environment variables at import time
-        # and order-dependent tests have hidden real bugs here before.
-        run: uv run pytest -q -p no:randomly
-  mutation:
-    # The tests that prove the tests. A control whose mutation SURVIVES has no test
-    # behind it, however green the suite looks.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv sync --extra dev
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - name: Mutations, rounds 1-3
-        run: uv run python scripts/mutation_rounds_1_3.py
-      - name: Mutations, round 4
-        run: uv run python scripts/mutation_round_4.py
-      - name: Mutations, round 5
-        # The session-cookie and mcp-version-compat guards, plus the cross-handler
-        # contract harness. Round 5 also mutates a TEST fixture: if the fixture goes
-        # back to short-circuiting the SQL++ handlers, the routing checks for three
-        # modules silently stop proving anything, and that is only detectable this way.
-        run: uv run python scripts/mutation_round_5.py
-  package:
-    # The image and the wheel both listed their top-level modules by hand and both once
-    # omitted three, so import server failed at startup with none of the security
-    # controls present. A green test suite said nothing, because it runs from the source
-    # tree where every file exists.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv sync --extra dev
-      - name: Build the wheel and import from the INSTALLED copy
-        run: |
-          uv build --wheel
-          python -m venv /tmp/fresh
-          /tmp/fresh/bin/pip install --quiet dist/*.whl
-          CB_ADMIN_PROFILE=workstation /tmp/fresh/bin/python -c "import server; print(f'{len(server._TOOLS)} tools')"
-      - name: Build the image and import from inside it
-        run: |
-          docker build -t couchbase-admin-mcp:ci .
-          docker run --rm -e CB_ADMIN_PROFILE=workstation couchbase-admin-mcp:ci \
-            python -c "import server; from gui import gui_server; print(f'{len(server._TOOLS)} tools')"
-  capella-paths:
-    # Verifies the Capella v4 paths against a live organization. Skipped unless the
-    # secret is configured, because a fork's PR cannot have it — and a job that fails for
-    # everyone without credentials gets disabled, taking the check with it.
-    #
-    # Exit status is 0 only when nothing is MISSING. Read-only: GETs run for real, writes
-    # are probed with OPTIONS.
-    runs-on: ubuntu-latest
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
-        with:
-          enable-cache: true
-      - run: uv sync --extra dev
-      - name: Verify v4 paths
-        env:
-          CB_CAPELLA_API_KEY: ${{ secrets.CB_CAPELLA_API_KEY }}
-        run: |
-          if [ -z "$CB_CAPELLA_API_KEY" ]; then
-            echo "CB_CAPELLA_API_KEY is not configured; skipping the live path check."
-            echo "Set it to a read-only Capella API key SECRET to enable this job."
-            exit 0
-          fi
-          uv run python scripts/verify_capella_paths.py
-
-this is my ci.yml file.... edit and give me back what it needs to change to
-
-Working on it… · 50s