fix(ci): remove WASM auto-commit step — blocked by branch protection

[ajitpratap0]

Problem

PR #423 introduced an auto-commit step in website.yml that rebuilds and pushes gosqlx.wasm back to main when the source changes. This step fails immediately with:

remote: error: GH013: Repository rule violations found for refs/heads/main.
error: failed to push some refs to 'https://github.com/ajitpratap0/GoSQLX'

Branch protection requires all changes to main go through PRs — even from CI bots. The push is blocked, which aborts the entire deploy pipeline before Vercel runs, meaning the playground is still broken.

Fix

• Remove the auto-commit step entirely
• Revert permissions: contents back to read
• The WASM binary is now committed to git (from PR fix(wasm): commit gosqlx.wasm to git — fixes production playground 404 #423), so both Vercel auto-deploy and CI deploy will include it without any special step

When wasm/ source changes in future

Rebuild manually: cd wasm && make build && cp playground/gosqlx.wasm ../website/public/wasm/ && git add website/public/wasm/gosqlx.wasm && git commit -m "chore(wasm): rebuild" — then open a PR as normal.

Test plan

• website.yml deploy completes successfully
• https://gosqlx.dev/wasm/gosqlx.wasm returns HTTP 200
• Playground parses SQL without errors

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gosqlx-website	Ready	Preview, Comment	Mar 22, 2026 5:37am

[github-actions]

Claude finished @ajitpratap0's task —— View job

---

Code Review for WASM CI Fix

Todo List

• Read and analyze the workflow file changes
• Review the problem context and solution approach
• Evaluate code quality and CI/CD best practices
• Check for security implications
• Assess potential bugs or edge cases
• Provide comprehensive feedback

Analysis

Changes Made:

• Removed auto-commit step that rebuilt and pushed WASM files back to main
• Reverted permissions: contents from write back to read
• Kept the WASM build step but removed the git commit/push logic
• The WASM files (gosqlx.wasm, wasm_exec.js) are now properly committed in git from PR fix(wasm): commit gosqlx.wasm to git — fixes production playground 404 #423

Problem Context:
The auto-commit step was failing with GH013: Repository rule violations because branch protection rules prevent direct pushes to main, even from CI bots. This was blocking the entire deployment pipeline.

Code Review Feedback

✅ Excellent Solution & Code Quality

1. Problem Diagnosis: Correctly identified that branch protection rules block even CI bot pushes to main
2. Clean Fix: The solution properly removes the problematic auto-commit while preserving functionality
3. Minimal Changes: Only removes what's necessary (-13 lines, +1 line)
4. Clear Documentation: PR description provides excellent context and future workflow instructions

✅ Security - Improved

1. Principle of Least Privilege: Correctly reverts from contents: write back to contents: read
2. Removes Automated Pushes: Eliminates potential attack vector of automated commits bypassing review
3. Forces PR Review: WASM updates now require manual PR process, ensuring human oversight

✅ CI/CD Best Practices

1. Fail-Fast Removal: Eliminates step that was causing pipeline failures
2. Preserves Build: Still builds WASM for deployment without unnecessary commits
3. Environment Consistency: Same WASM will be used across all environments since it's version-controlled

✅ No Performance Issues

1. Reduces Build Time: Removes git operations from CI pipeline
2. Network Efficiency: No unnecessary pushes during deployment
3. Idempotent Builds: WASM rebuild in CI is now purely for deployment consistency

📝 Minor Considerations

1. Documentation Update: Consider updating any docs that reference the old auto-commit behavior
2. Future WASM Changes: The manual rebuild process is well-documented in the PR description
3. No Test Coverage Impact: This is purely CI configuration - no application logic tests affected

🎯 Edge Cases Addressed

1. WASM Staleness: Since WASM is committed in git, deployments will always use the version that matches the triggering commit
2. Build Consistency: The build step ensures fresh WASM for Vercel deployment without modifying git state
3. Rollback Safety: If WASM issues arise, they can be fixed via normal PR process

Recommendation: ✅ APPROVE

This is a clean, well-reasoned fix that:

• Solves the immediate CI failure
• Improves security posture
• Maintains deployment functionality
• Follows proper CI/CD practices
• Includes clear documentation for future maintenance

The approach of committing WASM files to git (from PR #423) combined with removing auto-commit (this PR) is the correct architectural decision for a repository with branch protection.

---

Job Run