DongHyeonkaandClaude Opus 5
3ea3397691
Three boundaries the layer contract declares had no executable rule behind them, so the code drifted across all three while every gate stayed green. `src/contracts` reached back up into `src/application` for the shared `Result` carrier and the compatibility predicate. Neither package owned the shared vocabulary and the dependency pointed both ways. Both now live in contracts — the lower package — and application re-exports them, so no caller moves. A concrete adapter was not supposed to depend on another concrete adapter, but only adapter-to-presentation was enforced, and `diagnostics` imported a guard out of `telemetry`. The guard belongs to neither, so it moved to the adapter kernel. Stating the rule needed the checker to resolve `$1` in a `to` pattern against the importing module's own directory; the alternative is one rule per adapter group, which silently stops covering a group the moment one is added. Product assembly leaks out of bootstrap: generic presentation reads the installed-feature registries. That is a real refactor, so the rule freezes the exact set of modules doing it today rather than pretending it is fixed — a new edge fails. The two remaining open edges are named in the config, not silent. Each rule was verified by introducing the violation it forbids and confirming the gate rejects it. The documentation drifted the same way. README and the manual accessibility checklist both said six routes while ten were registered, which left the platform overview and three reference-resource screens outside the declared manual review scope without anyone deciding they should be. The scope is now derived from the route registry by `verify:documentation`, so the sentence cannot outlive the registry again. The review ledger also named a canonical path that does not exist in this tree; it is upstream provenance, and it now says so instead of looking like a broken repository reference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
466 lines
22 KiB
Plaintext
466 lines
22 KiB
Plaintext
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
|
|
|
|
exports[`CI workflow generation > renders the complete workflow deterministically with one final LF 1`] = `
|
|
"# GENERATED FILE — edit config/ci/gates.json and run \`corepack pnpm generate:ci-workflow\`.
|
|
name: frontend-quality-gates
|
|
|
|
on:
|
|
push:
|
|
branches: [develop]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
stage:
|
|
description: Highest promotion tier to evaluate
|
|
required: true
|
|
default: merge
|
|
type: choice
|
|
options:
|
|
- merge
|
|
- release
|
|
- production
|
|
- field
|
|
- documentation
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CI: "true"
|
|
VITE_BUILD_ID: "gitea-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
VITE_COMMIT_SHA: "\${{ gitea.sha }}"
|
|
RELEASE_ID: "\${{ gitea.ref }}-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
CI_RUNNER_IMAGE: "\${{ vars.RUNNER_IMAGE_DIGEST }}"
|
|
|
|
jobs:
|
|
merge_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
if: \${{ gitea.event_name != 'workflow_dispatch' || inputs.stage != 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-001, name: manifest-lockfile, browser: false }
|
|
- { gate: FE-GATE-002, name: lint, browser: false }
|
|
- { gate: FE-GATE-003, name: typecheck, browser: false }
|
|
- { gate: FE-GATE-004, name: runtime-schema, browser: false }
|
|
- { gate: FE-GATE-005, name: unit, browser: false }
|
|
- { gate: FE-GATE-006, name: component, browser: false }
|
|
- { gate: FE-GATE-007, name: integration, browser: false }
|
|
- { gate: FE-GATE-008, name: e2e, browser: true }
|
|
- { gate: FE-GATE-009, name: accessibility, browser: true }
|
|
- { gate: FE-GATE-010, name: architecture, browser: false }
|
|
- { gate: FE-GATE-011, name: build, browser: false }
|
|
- { gate: FE-GATE-013, name: security, browser: false }
|
|
- { gate: FE-GATE-020, name: removability, browser: false }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload merge gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
release_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: merge_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
HOSTING_BASE_URL: "\${{ vars.HOSTING_BASE_URL }}"
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-012, name: bundle, browser: false }
|
|
- { gate: FE-GATE-014, name: config-compatibility, browser: false }
|
|
- { gate: FE-GATE-019, name: hosting-header, browser: false }
|
|
- { gate: FE-GATE-026, name: lab-performance, browser: true }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload release gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
immutable_build:
|
|
name: "FE-GATE-015 / immutable-release-candidate"
|
|
needs: release_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
dist_sha256: \${{ steps.candidate.outputs.dist_sha256 }}
|
|
archive_sha256: \${{ steps.candidate.outputs.archive_sha256 }}
|
|
env:
|
|
APP_PROFILE: "\${{ vars.APP_PROFILE }}"
|
|
RELEASE_TARGET: "\${{ vars.RELEASE_TARGET }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Build candidate once and verify local evidence
|
|
run: corepack pnpm ci:gate -- FE-GATE-015
|
|
- name: Archive and validate the exact candidate file set
|
|
id: candidate
|
|
run: |
|
|
mkdir -p .release
|
|
tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" \\
|
|
dist \\
|
|
pnpm-lock.yaml \\
|
|
artifacts/performance/bundle.json \\
|
|
artifacts/quality/vite-module-inventory.json \\
|
|
artifacts/release/build-manifest.json \\
|
|
artifacts/release/checksums.txt \\
|
|
artifacts/release/dependency-inventory.json \\
|
|
artifacts/release/provenance.json \\
|
|
artifacts/release/verification.json \\
|
|
artifacts/release/sbom.cdx.json \\
|
|
artifacts/security/dependency-diff.json \\
|
|
artifacts/security/license-report.json \\
|
|
artifacts/security/local-evidence-assessment.json \\
|
|
artifacts/security/scan.sarif \\
|
|
artifacts/security/supply-chain-coherence.json \\
|
|
artifacts/security/supply-chain-verification.json \\
|
|
artifacts/security/vulnerability-report.json \\
|
|
config/security/dependency-baseline.approval.json \\
|
|
config/security/dependency-baseline.json \\
|
|
config/security/dependency-change-evidence.json \\
|
|
config/security/dependency-policy.json \\
|
|
config/security/secret-scan-policy.json \\
|
|
config/security/vulnerability-exceptions.json \\
|
|
config/security/vulnerability-policy.json \\
|
|
schemas/artifacts/build-manifest.schema.json \\
|
|
schemas/artifacts/dependency-inventory.schema.json \\
|
|
schemas/artifacts/supply-chain-verification.schema.json \\
|
|
scripts/contracts/release-artifacts.ts \\
|
|
scripts/create-release-candidate.ts \\
|
|
scripts/generate-supply-chain.ts \\
|
|
scripts/lib/build-manifest-outputs.ts \\
|
|
scripts/lib/json-schema.ts \\
|
|
scripts/lib/local-policy-evidence.ts \\
|
|
scripts/lib/local-release-evidence.ts \\
|
|
scripts/lib/release-candidate.ts \\
|
|
scripts/lib/release-input-evidence.ts \\
|
|
scripts/lib/release-runtime-coherence.ts \\
|
|
scripts/lib/repository-file-inventory.ts \\
|
|
scripts/lib/secret-scan-evaluator.ts \\
|
|
scripts/lib/secret-scan-policy.ts \\
|
|
scripts/lib/secret-scan.ts \\
|
|
scripts/lib/supply-chain.ts \\
|
|
scripts/lib/validated-json-artifact.ts \\
|
|
src/contracts/release-artifacts.ts \\
|
|
src/features/installed-contract-contributions.ts \\
|
|
src/features/installed-feature-contracts.ts \\
|
|
artifacts/release/release-candidate.json
|
|
node scripts/verify-ci-candidate-archive.ts --archive ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" --github-output "$GITHUB_OUTPUT"
|
|
- name: Upload release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
if-no-files-found: error
|
|
|
|
vulnerability_provider:
|
|
name: external-vulnerability-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_vulnerability.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/vulnerability-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
VULNERABILITY_PROVIDER_COMMAND: "\${{ vars.VULNERABILITY_PROVIDER_COMMAND }}"
|
|
VULNERABILITY_REPORT_PATH: provider-evidence/untrusted/vulnerability-report.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/vulnerability-report.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability-candidate
|
|
- name: Run and validate external vulnerability provider in one trusted supervisor
|
|
id: supervise_vulnerability
|
|
run: node scripts/run-and-validate-provider.ts --kind vulnerability
|
|
- name: Confirm sealed vulnerability provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/vulnerability-report.json
|
|
if-no-files-found: error
|
|
|
|
provenance_provider:
|
|
name: external-provenance-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_provenance.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/provenance-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
PROVENANCE_PROVIDER_COMMAND: "\${{ vars.PROVENANCE_PROVIDER_COMMAND }}"
|
|
PROVENANCE_ATTESTATION_PATH: provider-evidence/untrusted/provenance-attestation.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/provenance-attestation.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance-candidate
|
|
- name: Run and validate external provenance provider in one trusted supervisor
|
|
id: supervise_provenance
|
|
run: node scripts/run-and-validate-provider.ts --kind provenance
|
|
- name: Confirm sealed provenance provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/provenance-attestation.json
|
|
if-no-files-found: error
|
|
|
|
promotion:
|
|
name: promote-verified-immutable-candidate
|
|
needs: [immutable_build, vulnerability_provider, provenance_provider]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
VULNERABILITY_REPORT_PATH: "\${{ gitea.workspace }}/.release/vulnerability/vulnerability-report.json"
|
|
PROVENANCE_ATTESTATION_PATH: "\${{ gitea.workspace }}/.release/provenance/provenance-attestation.json"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
VULNERABILITY_INVOCATION_NONCE: "\${{ needs.vulnerability_provider.outputs.invocation_nonce }}"
|
|
PROVENANCE_INVOCATION_NONCE: "\${{ needs.provenance_provider.outputs.invocation_nonce }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/candidate
|
|
- name: Download vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability
|
|
- name: Download provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance
|
|
- name: Finalize verified promotion from inode-bound captured inputs
|
|
id: finalize
|
|
run: node scripts/stage-verified-promotion.ts
|
|
- name: Upload promoted release
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "promoted-release-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: |
|
|
\${{ steps.finalize.outputs.staging_root }}/release-candidate.tar.gz
|
|
\${{ steps.finalize.outputs.staging_root }}/vulnerability-report.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provenance-attestation.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provider-verification.json
|
|
\${{ steps.finalize.outputs.staging_root }}/promotion-verification.json
|
|
if-no-files-found: error
|
|
- name: Always remove private promotion staging
|
|
if: always()
|
|
env:
|
|
PROMOTION_STAGING_ROOT: \${{ steps.finalize.outputs.staging_root }}
|
|
PROMOTION_CLEANUP_TOKEN: \${{ steps.finalize.outputs.cleanup_token }}
|
|
PROMOTION_RUNNER_TEMP_DEV: \${{ steps.finalize.outputs.runner_temp_dev }}
|
|
PROMOTION_RUNNER_TEMP_INO: \${{ steps.finalize.outputs.runner_temp_ino }}
|
|
PROMOTION_STAGING_DEV: \${{ steps.finalize.outputs.staging_dev }}
|
|
PROMOTION_STAGING_INO: \${{ steps.finalize.outputs.staging_ino }}
|
|
run: |
|
|
if [ -n "$PROMOTION_STAGING_ROOT" ] && [ -n "$PROMOTION_CLEANUP_TOKEN" ] && [ -n "$PROMOTION_RUNNER_TEMP_DEV" ] && [ -n "$PROMOTION_RUNNER_TEMP_INO" ] && [ -n "$PROMOTION_STAGING_DEV" ] && [ -n "$PROMOTION_STAGING_INO" ]; then
|
|
node scripts/cleanup-verified-promotion.ts
|
|
fi
|
|
|
|
production_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: promotion
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-016, name: rollback-drill }
|
|
- { gate: FE-GATE-021, name: runbook-boot-config }
|
|
- { gate: FE-GATE-022, name: runbook-chunk-mismatch }
|
|
- { gate: FE-GATE-023, name: runbook-api-degradation }
|
|
- { gate: FE-GATE-024, name: runbook-telemetry }
|
|
- { gate: FE-GATE-025, name: runbook-release-rollback }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload production gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
field_gate:
|
|
name: "FE-GATE-018 / field-web-vitals"
|
|
needs: production_gate
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'field' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
FIELD_WEB_VITALS_INPUT: "\${{ vars.FIELD_WEB_VITALS_INPUT }}"
|
|
MIN_ELIGIBLE_SAMPLES: "\${{ vars.MIN_ELIGIBLE_SAMPLES }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-018
|
|
- name: Upload field gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-018-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
documentation_gate:
|
|
name: "FE-GATE-017 / diagram-review"
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run documentation gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-017
|
|
- name: Upload documentation gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-017-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
"
|
|
`;
|