[leowilkin]

why

bundle exec rspec on main: 657 examples, 74 failures. CI only runs brakeman and rubocop, never rspec, so nobody saw them pile up. many of the failing examples are persona/verification specs, so that code had very little real coverage.

after this: 658 examples, 0 failures, stable across random-order runs. no app code changes, only specs and factories.

what was wrong

cause	failures
sidebar_spec.rb reopened Components::Base and stubbed self.include and the helper macros as no-ops so it could load without rails. that leaked into the whole process: every phlex component loaded afterwards lost its includes. these specs failed only in a full run and passed on their own.	~30
the persona_verification factory's :pending / :approved / :rejected / :fatal_rejection traits built a persona record with a different inquiry id (and identity), which fails persona_record_matches_inquiry. persona_inquiry_id now follows the record.	~29
persona_lifecycle_spec: the identity's create-time before_commit leaves the in-memory record dirty, and the stubbed current_identity carried that into with_lock. the identity is now reloaded, as prod does on every request.	10
step_up_spec was written before require_pending_step_up. it now opens the step-up page first, like the real flow.	6
four one-offs: identity_spec predates the india persona flag; authorized_applications_spec counted the app name, which also appears in the revoke confirmation; persona_verification_spec expected approve! to send the approved mail, but callers send it; manual_verification_call_spec read the never-cleared enqueued_jobs list.	4

found along the way, not changed here

• Identity#copy_legal_name_if_needed never persists anything. it's a before_commit that runs after the INSERT, so the legal names it copies only ever exist in memory. code that reads them falls back to first/last name, so nothing visibly breaks. making it actually save (before_create) would change signup data, so that's a separate decision.
• CI should run rspec. that needs a postgres service in ci.yml. happy to add it in a follow-up once this lands.

also in this PR

4003fb9 is the CI-fix commit from #342/#343 (lint offense, brakeman 8.1.0 bump, email typo _html key), cherry-picked because main's lint and scan_ruby are red. whichever merges first, the others rebase over it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​brakeman@​8.0.6 ⏵ 8.1.0	+1

View full report