ci: add Graphite CI Optimizer to lint + playwright workflows

[Dhravya]

Adds the Graphite CI Optimizer to both workflows so CI is skipped when Graphite determines it isn't needed, cutting runs/costs (the Playwright job is a 30-min GitHub-hosted run, so this saves the most here).

What changed

• New optimize_ci job in lint.yml and playwright.yml outputs skip via withgraphite/graphite-ci-action@main.
• The build (lint) and test (playwright) jobs now depend on optimize_ci and only run when skip == 'false'.

Note: token is inline per Graphite's default snippet (repo is private). Can move to ${{ secrets.GRAPHITE_CI_TOKEN }} if desired.

---

Session Details

• Session: View Session
• Requested by: Unknown
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
infinite-chat	Error		Jul 1, 2026 5:32pm

[vorflux]

Summary

Reviewed — found 2 issue(s). This PR adds withgraphite/graphite-ci-action to the lint and playwright GitHub Actions workflows. The review focused on workflow correctness and CI/security risks in the changed files.

Findings

.github/workflows/lint.yml

1. Hardcoded graphite_token exposes a credential in workflow history and should be replaced with a GitHub Actions secret.

.github/workflows/playwright.yml

1. Hardcoded graphite_token exposes a credential in workflow history and should be replaced with a GitHub Actions secret.

Verdict

⚠️ Changes requested. The committed token should be treated as compromised, rotated/revoked, and removed from the workflows before merging.

---

Review with Vorflux

[vorflux]

graphite_token is hardcoded directly in the workflow. Because workflow files and PR diffs are visible in repository history, this exposes the credential to anyone with repo access and the token should be treated as compromised. Please revoke/rotate it and read the value from a GitHub Actions secret instead, for example:

graphite_token: ${{ secrets.GRAPHITE_CI_OPTIMIZER_TOKEN }}

[vorflux]

graphite_token is hardcoded directly in the workflow. Because workflow files and PR diffs are visible in repository history, this exposes the credential to anyone with repo access and the token should be treated as compromised. Please revoke/rotate it and read the value from a GitHub Actions secret instead, for example:

graphite_token: ${{ secrets.GRAPHITE_CI_OPTIMIZER_TOKEN }}

[vorflux]

Testing

The testing subagent classified this as a CI/workflow-only change affecting .github/workflows/lint.yml and .github/workflows/playwright.yml. It performed read-only static validation only; no automated tests, CI pipelines, Playwright runs, lint runs, screenshots, recordings, branch mutations, commits, or pushes were performed.

Commands run:

# Read-only validation performed by the testing subagent
# - Inspected the diff for origin/main...origin/ci/graphite-ci-optimizer
# - Read changed workflow files with line numbers
# - Compared the added Graphite CI Optimizer usage against public withgraphite/graphite-ci-action documentation

Result:

Static validation found blocking issues:
- .github/workflows/lint.yml:15 hardcodes graphite_token and should use a GitHub Actions secret.
- .github/workflows/playwright.yml:18 hardcodes graphite_token and should use a GitHub Actions secret.
- The Graphite CI action docs show github_token as an input alongside graphite_token; the PR only supplies graphite_token, so optimize_ci may fail and block dependent jobs.
- Both workflows use withgraphite/graphite-ci-action@main, which is not deterministic if reproducible CI is required.

Verdict

⚠️ Issues found. Read-only validation identified workflow security/correctness concerns; the exposed token should be rotated and the workflow inputs should be corrected before merging.