ci: gate main-targeted PRs on human authorship too

[innolope-dev]

Why

human-authors was added on dev and has not reached main yet, so every PR based on main runs without it. That is not a theoretical gap — it is exactly how the current mess happened:

• fix(ci): bake NEXT_PUBLIC_* into Capgo OTA bundles (native QR scan/paste dead on ota-1.0.54/1.0.55) #2823 (base main) carried aa6db97 — chore: retrigger OTA build, an empty commit authored by chip-peanut-bot[bot]. Ungated, so it merged.
• aa6db97 is now an ancestor of main and can never be rewritten (non_fast_forward + required_signatures on refs/heads/**, zero bypass actors).
• Every back-merge lists it, so #2830 is red and unmergeable. #2839 fixes that end (stop re-judging commits that already landed); this PR closes the door it came through.

What

The same job, with the same script as dev has after #2839 — byte-identical text in the same position, so the next dev → main release merges it as the same change rather than a conflict. Added to ci-success.needs so it actually gates.

Effect on open main PRs

I checked every one. Only #2829 fails: its single commit 4d393a7 is authored by chip-peanut-bot[bot]. That is the gate doing its job — the fix is to re-commit that one-line change from a human account. Everything else (#2833, #2835, #2836) is human-authored and unaffected.

The content pipeline is unaffected: update-content.yml commits as Hugo Montenegro <h@hugomontenegro.com>, a real account, so content-publish PRs pass and merge-on-green keeps working.

Depends on nothing — but merge #2839 first if you want the two files to converge cleanly.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview	Aug 26, 2026 8:18pm

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 25 days. After that, they cost $0.25 per reviewed file.}

Or wait 11 minutes for your next included review.

View limit details

Limit details: You’ve used the included review currently available. Your 60 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 980a31ab-6c19-4697-ae67-b60b46381d1d

📥 Commits

Reviewing files that changed from the base of the PR and between eb3e114 and a0644a5.

📒 Files selected for processing (1)

• .github/workflows/tests.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[innolope-dev]

Same Dependabot caveat as peanut-api-ts#1436: there is no .github/dependabot.yml here either, so GitHub's automatic security-update PRs target main and are authored by dependabot[bot]. None are open right now, but the next one will fail this gate. If the team wants those to keep flowing, the fix is one line — an ALLOWED_BOTS set checked before the [bot] rejection — and it should land in the same shape in both repos and on both main and dev.

[github-actions]

Code-analysis diff

Painscore total: 7349.95 → 7349.95 (0)
Findings: 0 net (+0 new, -0 resolved)

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 3525 ran, 0 failed, 0 skipped, 47.4s

📊 Coverage (unit)

metric	%
statements	68.3%
branches	52.4%
functions	58.1%
lines	69.1%

⏱ 10 slowest test cases

time	test
3.0s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.0s	src/hooks/query/__tests__/user.test.tsx › does NOT clear a token that rotated mid-request (stale 401 racing a fresh login)
0.6s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.5s	src/utils/__tests__/crisp.test.ts › settles, and hands back a usable plugin, against a real-shaped plugin proxy
0.4s	src/utils/__tests__/sentry.utils.test.ts › defaults to the client budget under a browser global
0.3s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	src/hooks/__tests__/useCrispTokenId.test.ts › retries then stays undefined when the endpoint keeps failing (no fallback token)
0.3s	src/utils/__tests__/sentry.utils.test.ts › still lets a per-call timeoutMs win over the default
0.3s	src/utils/__tests__/crisp.test.ts › configures once across repeated support opens

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}