DongHyeonkaandClaude Opus 5
7d1ccccbcd
Integrates the frontend template sync (a0fbafb → 5434760) into the TechLog UI migration. Merged in this direction so every conflict is resolved and proved in the worktree; main is only fast-forwarded afterwards and never holds a state that was not verified here. 15 conflicts. The rule throughout: keep the template's mechanism, keep the product's content, and never invent a third state neither branch would accept. The template's product manifest and its runtime feature kill switch are adopted. The route registry is deliberately not composed from contract.routes: the reference feature still declares screens this product deleted, and reducing over them would register paths with no component behind them. ROUTE_FEATURE_OWNER is narrowed to registered routes for the same reason. The first resolution did compose from contract.routes and was rejected by product-features.test.ts. Three files pinned counts and a digest describing the gate contract. Neither side's numbers describe the merged config/ci/gates.json, so they were recomputed from it rather than chosen: 27 gates, 82 commands, 94 command references, 107 evidence references, 128 artifacts, shape sha256 5063586d. README.md and docs/accessibility/manual-checklist.md now enumerate this product's 27 routes, which the template's own verify:documentation requires. product-feature-switch.test.tsx was rewritten around the invariant that still applies here — no registered route without a component — rather than deleted with the screens it used to exercise. docs/operations/template-merge-2026-08-17.md records every decision, the gate results, and the three follow-ups this merge deliberately did not decide. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
467 lines
22 KiB
Plaintext
467 lines
22 KiB
Plaintext
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
|
|
|
|
exports[`CI workflow generation > renders the complete workflow deterministically with one final LF 1`] = `
|
|
"# GENERATED FILE — edit config/ci/gates.json and run \`corepack pnpm generate:ci-workflow\`.
|
|
name: frontend-quality-gates
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
stage:
|
|
description: Highest promotion tier to evaluate
|
|
required: true
|
|
default: merge
|
|
type: choice
|
|
options:
|
|
- merge
|
|
- release
|
|
- production
|
|
- field
|
|
- documentation
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CI: "true"
|
|
VITE_BUILD_ID: "gitea-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
VITE_COMMIT_SHA: "\${{ gitea.sha }}"
|
|
RELEASE_ID: "\${{ gitea.ref }}-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
CI_RUNNER_IMAGE: "\${{ vars.RUNNER_IMAGE_DIGEST }}"
|
|
|
|
jobs:
|
|
merge_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
if: \${{ gitea.event_name != 'workflow_dispatch' || inputs.stage != 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-001, name: manifest-lockfile, browser: false }
|
|
- { gate: FE-GATE-002, name: lint, browser: false }
|
|
- { gate: FE-GATE-003, name: typecheck, browser: false }
|
|
- { gate: FE-GATE-004, name: runtime-schema, browser: false }
|
|
- { gate: FE-GATE-005, name: unit, browser: false }
|
|
- { gate: FE-GATE-006, name: component, browser: false }
|
|
- { gate: FE-GATE-007, name: integration, browser: false }
|
|
- { gate: FE-GATE-008, name: e2e, browser: true }
|
|
- { gate: FE-GATE-009, name: accessibility, browser: true }
|
|
- { gate: FE-GATE-010, name: architecture, browser: false }
|
|
- { gate: FE-GATE-011, name: build, browser: false }
|
|
- { gate: FE-GATE-013, name: security, browser: false }
|
|
- { gate: FE-GATE-020, name: removability, browser: false }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload merge gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
release_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: merge_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
HOSTING_BASE_URL: "\${{ vars.HOSTING_BASE_URL }}"
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-012, name: bundle, browser: false }
|
|
- { gate: FE-GATE-014, name: config-compatibility, browser: false }
|
|
- { gate: FE-GATE-019, name: hosting-header, browser: false }
|
|
- { gate: FE-GATE-026, name: lab-performance, browser: true }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload release gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
immutable_build:
|
|
name: "FE-GATE-015 / immutable-release-candidate"
|
|
needs: release_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
dist_sha256: \${{ steps.candidate.outputs.dist_sha256 }}
|
|
archive_sha256: \${{ steps.candidate.outputs.archive_sha256 }}
|
|
env:
|
|
APP_PROFILE: "\${{ vars.APP_PROFILE }}"
|
|
RELEASE_TARGET: "\${{ vars.RELEASE_TARGET }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Build candidate once and verify local evidence
|
|
run: corepack pnpm ci:gate -- FE-GATE-015
|
|
- name: Archive and validate the exact candidate file set
|
|
id: candidate
|
|
run: |
|
|
mkdir -p .release
|
|
tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" \\
|
|
dist \\
|
|
pnpm-lock.yaml \\
|
|
artifacts/performance/bundle.json \\
|
|
artifacts/quality/vite-module-inventory.json \\
|
|
artifacts/release/build-manifest.json \\
|
|
artifacts/release/checksums.txt \\
|
|
artifacts/release/dependency-inventory.json \\
|
|
artifacts/release/provenance.json \\
|
|
artifacts/release/verification.json \\
|
|
artifacts/release/sbom.cdx.json \\
|
|
artifacts/security/dependency-diff.json \\
|
|
artifacts/security/license-report.json \\
|
|
artifacts/security/local-evidence-assessment.json \\
|
|
artifacts/security/scan.sarif \\
|
|
artifacts/security/supply-chain-coherence.json \\
|
|
artifacts/security/supply-chain-verification.json \\
|
|
artifacts/security/vulnerability-report.json \\
|
|
config/security/dependency-baseline.approval.json \\
|
|
config/security/dependency-baseline.json \\
|
|
config/security/dependency-change-evidence.json \\
|
|
config/security/dependency-policy.json \\
|
|
config/security/secret-scan-policy.json \\
|
|
config/security/vulnerability-exceptions.json \\
|
|
config/security/vulnerability-policy.json \\
|
|
schemas/artifacts/build-manifest.schema.json \\
|
|
schemas/artifacts/dependency-inventory.schema.json \\
|
|
schemas/artifacts/supply-chain-verification.schema.json \\
|
|
scripts/contracts/release-artifacts.ts \\
|
|
scripts/create-release-candidate.ts \\
|
|
scripts/generate-supply-chain.ts \\
|
|
scripts/lib/build-manifest-outputs.ts \\
|
|
scripts/lib/json-schema.ts \\
|
|
scripts/lib/local-policy-evidence.ts \\
|
|
scripts/lib/local-release-evidence.ts \\
|
|
scripts/lib/release-candidate.ts \\
|
|
scripts/lib/release-input-evidence.ts \\
|
|
scripts/lib/release-runtime-coherence.ts \\
|
|
scripts/lib/repository-file-inventory.ts \\
|
|
scripts/lib/secret-scan-evaluator.ts \\
|
|
scripts/lib/secret-scan-policy.ts \\
|
|
scripts/lib/secret-scan.ts \\
|
|
scripts/lib/supply-chain.ts \\
|
|
scripts/lib/validated-json-artifact.ts \\
|
|
scripts/lib/vite-route-chunks.ts \\
|
|
src/contracts/release-artifacts.ts \\
|
|
src/features/installed-contract-contributions.ts \\
|
|
src/features/installed-feature-contracts.ts \\
|
|
artifacts/release/release-candidate.json
|
|
node scripts/verify-ci-candidate-archive.ts --archive ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" --github-output "$GITHUB_OUTPUT"
|
|
- name: Upload release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
if-no-files-found: error
|
|
|
|
vulnerability_provider:
|
|
name: external-vulnerability-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_vulnerability.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/vulnerability-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
VULNERABILITY_PROVIDER_COMMAND: "\${{ vars.VULNERABILITY_PROVIDER_COMMAND }}"
|
|
VULNERABILITY_REPORT_PATH: provider-evidence/untrusted/vulnerability-report.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/vulnerability-report.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability-candidate
|
|
- name: Run and validate external vulnerability provider in one trusted supervisor
|
|
id: supervise_vulnerability
|
|
run: node scripts/run-and-validate-provider.ts --kind vulnerability
|
|
- name: Confirm sealed vulnerability provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/vulnerability-report.json
|
|
if-no-files-found: error
|
|
|
|
provenance_provider:
|
|
name: external-provenance-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_provenance.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/provenance-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
PROVENANCE_PROVIDER_COMMAND: "\${{ vars.PROVENANCE_PROVIDER_COMMAND }}"
|
|
PROVENANCE_ATTESTATION_PATH: provider-evidence/untrusted/provenance-attestation.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/provenance-attestation.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance-candidate
|
|
- name: Run and validate external provenance provider in one trusted supervisor
|
|
id: supervise_provenance
|
|
run: node scripts/run-and-validate-provider.ts --kind provenance
|
|
- name: Confirm sealed provenance provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/provenance-attestation.json
|
|
if-no-files-found: error
|
|
|
|
promotion:
|
|
name: promote-verified-immutable-candidate
|
|
needs: [immutable_build, vulnerability_provider, provenance_provider]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
VULNERABILITY_REPORT_PATH: "\${{ gitea.workspace }}/.release/vulnerability/vulnerability-report.json"
|
|
PROVENANCE_ATTESTATION_PATH: "\${{ gitea.workspace }}/.release/provenance/provenance-attestation.json"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
VULNERABILITY_INVOCATION_NONCE: "\${{ needs.vulnerability_provider.outputs.invocation_nonce }}"
|
|
PROVENANCE_INVOCATION_NONCE: "\${{ needs.provenance_provider.outputs.invocation_nonce }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/candidate
|
|
- name: Download vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability
|
|
- name: Download provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance
|
|
- name: Finalize verified promotion from inode-bound captured inputs
|
|
id: finalize
|
|
run: node scripts/stage-verified-promotion.ts
|
|
- name: Upload promoted release
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "promoted-release-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: |
|
|
\${{ steps.finalize.outputs.staging_root }}/release-candidate.tar.gz
|
|
\${{ steps.finalize.outputs.staging_root }}/vulnerability-report.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provenance-attestation.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provider-verification.json
|
|
\${{ steps.finalize.outputs.staging_root }}/promotion-verification.json
|
|
if-no-files-found: error
|
|
- name: Always remove private promotion staging
|
|
if: always()
|
|
env:
|
|
PROMOTION_STAGING_ROOT: \${{ steps.finalize.outputs.staging_root }}
|
|
PROMOTION_CLEANUP_TOKEN: \${{ steps.finalize.outputs.cleanup_token }}
|
|
PROMOTION_RUNNER_TEMP_DEV: \${{ steps.finalize.outputs.runner_temp_dev }}
|
|
PROMOTION_RUNNER_TEMP_INO: \${{ steps.finalize.outputs.runner_temp_ino }}
|
|
PROMOTION_STAGING_DEV: \${{ steps.finalize.outputs.staging_dev }}
|
|
PROMOTION_STAGING_INO: \${{ steps.finalize.outputs.staging_ino }}
|
|
run: |
|
|
if [ -n "$PROMOTION_STAGING_ROOT" ] && [ -n "$PROMOTION_CLEANUP_TOKEN" ] && [ -n "$PROMOTION_RUNNER_TEMP_DEV" ] && [ -n "$PROMOTION_RUNNER_TEMP_INO" ] && [ -n "$PROMOTION_STAGING_DEV" ] && [ -n "$PROMOTION_STAGING_INO" ]; then
|
|
node scripts/cleanup-verified-promotion.ts
|
|
fi
|
|
|
|
production_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: promotion
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-016, name: rollback-drill }
|
|
- { gate: FE-GATE-021, name: runbook-boot-config }
|
|
- { gate: FE-GATE-022, name: runbook-chunk-mismatch }
|
|
- { gate: FE-GATE-023, name: runbook-api-degradation }
|
|
- { gate: FE-GATE-024, name: runbook-telemetry }
|
|
- { gate: FE-GATE-025, name: runbook-release-rollback }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload production gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
field_gate:
|
|
name: "FE-GATE-018 / field-web-vitals"
|
|
needs: production_gate
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'field' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
FIELD_WEB_VITALS_INPUT: "\${{ vars.FIELD_WEB_VITALS_INPUT }}"
|
|
MIN_ELIGIBLE_SAMPLES: "\${{ vars.MIN_ELIGIBLE_SAMPLES }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-018
|
|
- name: Upload field gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-018-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
documentation_gate:
|
|
name: "FE-GATE-017 / diagram-review"
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run documentation gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-017
|
|
- name: Upload documentation gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-017-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
"
|
|
`;
|