DongHyeonkaandClaude Opus 5
bdee07a93b
Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.
Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.
What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.
Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
466 lines
22 KiB
Plaintext
466 lines
22 KiB
Plaintext
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
|
|
|
|
exports[`CI workflow generation > renders the complete workflow deterministically with one final LF 1`] = `
|
|
"# GENERATED FILE — edit config/ci/gates.json and run \`corepack pnpm generate:ci-workflow\`.
|
|
name: frontend-quality-gates
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
stage:
|
|
description: Highest promotion tier to evaluate
|
|
required: true
|
|
default: merge
|
|
type: choice
|
|
options:
|
|
- merge
|
|
- release
|
|
- production
|
|
- field
|
|
- documentation
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CI: "true"
|
|
VITE_BUILD_ID: "gitea-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
VITE_COMMIT_SHA: "\${{ gitea.sha }}"
|
|
RELEASE_ID: "\${{ gitea.ref }}-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
CI_RUNNER_IMAGE: "\${{ vars.RUNNER_IMAGE_DIGEST }}"
|
|
|
|
jobs:
|
|
merge_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
if: \${{ gitea.event_name != 'workflow_dispatch' || inputs.stage != 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-001, name: manifest-lockfile, browser: false }
|
|
- { gate: FE-GATE-002, name: lint, browser: false }
|
|
- { gate: FE-GATE-003, name: typecheck, browser: false }
|
|
- { gate: FE-GATE-004, name: runtime-schema, browser: false }
|
|
- { gate: FE-GATE-005, name: unit, browser: false }
|
|
- { gate: FE-GATE-006, name: component, browser: false }
|
|
- { gate: FE-GATE-007, name: integration, browser: false }
|
|
- { gate: FE-GATE-008, name: e2e, browser: true }
|
|
- { gate: FE-GATE-009, name: accessibility, browser: true }
|
|
- { gate: FE-GATE-010, name: architecture, browser: false }
|
|
- { gate: FE-GATE-011, name: build, browser: false }
|
|
- { gate: FE-GATE-013, name: security, browser: false }
|
|
- { gate: FE-GATE-020, name: removability, browser: false }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload merge gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
release_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: merge_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
HOSTING_BASE_URL: "\${{ vars.HOSTING_BASE_URL }}"
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-012, name: bundle, browser: false }
|
|
- { gate: FE-GATE-014, name: config-compatibility, browser: false }
|
|
- { gate: FE-GATE-019, name: hosting-header, browser: false }
|
|
- { gate: FE-GATE-026, name: lab-performance, browser: true }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: \${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload release gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
immutable_build:
|
|
name: "FE-GATE-015 / immutable-release-candidate"
|
|
needs: release_gate
|
|
if: \${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
dist_sha256: \${{ steps.candidate.outputs.dist_sha256 }}
|
|
archive_sha256: \${{ steps.candidate.outputs.archive_sha256 }}
|
|
env:
|
|
APP_PROFILE: "\${{ vars.APP_PROFILE }}"
|
|
RELEASE_TARGET: "\${{ vars.RELEASE_TARGET }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Build candidate once and verify local evidence
|
|
run: corepack pnpm ci:gate -- FE-GATE-015
|
|
- name: Archive and validate the exact candidate file set
|
|
id: candidate
|
|
run: |
|
|
mkdir -p .release
|
|
tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" \\
|
|
dist \\
|
|
pnpm-lock.yaml \\
|
|
artifacts/performance/bundle.json \\
|
|
artifacts/quality/vite-module-inventory.json \\
|
|
artifacts/release/build-manifest.json \\
|
|
artifacts/release/checksums.txt \\
|
|
artifacts/release/dependency-inventory.json \\
|
|
artifacts/release/provenance.json \\
|
|
artifacts/release/verification.json \\
|
|
artifacts/release/sbom.cdx.json \\
|
|
artifacts/security/dependency-diff.json \\
|
|
artifacts/security/license-report.json \\
|
|
artifacts/security/local-evidence-assessment.json \\
|
|
artifacts/security/scan.sarif \\
|
|
artifacts/security/supply-chain-coherence.json \\
|
|
artifacts/security/supply-chain-verification.json \\
|
|
artifacts/security/vulnerability-report.json \\
|
|
config/security/dependency-baseline.approval.json \\
|
|
config/security/dependency-baseline.json \\
|
|
config/security/dependency-change-evidence.json \\
|
|
config/security/dependency-policy.json \\
|
|
config/security/secret-scan-policy.json \\
|
|
config/security/vulnerability-exceptions.json \\
|
|
config/security/vulnerability-policy.json \\
|
|
schemas/artifacts/build-manifest.schema.json \\
|
|
schemas/artifacts/dependency-inventory.schema.json \\
|
|
schemas/artifacts/supply-chain-verification.schema.json \\
|
|
scripts/contracts/release-artifacts.ts \\
|
|
scripts/create-release-candidate.ts \\
|
|
scripts/generate-supply-chain.ts \\
|
|
scripts/lib/build-manifest-outputs.ts \\
|
|
scripts/lib/json-schema.ts \\
|
|
scripts/lib/local-policy-evidence.ts \\
|
|
scripts/lib/local-release-evidence.ts \\
|
|
scripts/lib/release-candidate.ts \\
|
|
scripts/lib/release-input-evidence.ts \\
|
|
scripts/lib/release-runtime-coherence.ts \\
|
|
scripts/lib/repository-file-inventory.ts \\
|
|
scripts/lib/secret-scan-evaluator.ts \\
|
|
scripts/lib/secret-scan-policy.ts \\
|
|
scripts/lib/secret-scan.ts \\
|
|
scripts/lib/supply-chain.ts \\
|
|
scripts/lib/validated-json-artifact.ts \\
|
|
src/contracts/release-artifacts.ts \\
|
|
src/features/installed-contract-contributions.ts \\
|
|
src/features/installed-feature-contracts.ts \\
|
|
artifacts/release/release-candidate.json
|
|
node scripts/verify-ci-candidate-archive.ts --archive ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz" --github-output "$GITHUB_OUTPUT"
|
|
- name: Upload release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: ".release/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
if-no-files-found: error
|
|
|
|
vulnerability_provider:
|
|
name: external-vulnerability-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_vulnerability.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/vulnerability-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
VULNERABILITY_PROVIDER_COMMAND: "\${{ vars.VULNERABILITY_PROVIDER_COMMAND }}"
|
|
VULNERABILITY_REPORT_PATH: provider-evidence/untrusted/vulnerability-report.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/vulnerability-report.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability-candidate
|
|
- name: Run and validate external vulnerability provider in one trusted supervisor
|
|
id: supervise_vulnerability
|
|
run: node scripts/run-and-validate-provider.ts --kind vulnerability
|
|
- name: Confirm sealed vulnerability provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/vulnerability-report.json
|
|
if-no-files-found: error
|
|
|
|
provenance_provider:
|
|
name: external-provenance-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: \${{ steps.supervise_provenance.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/provenance-candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "\${{ gitea.sha }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
PROVENANCE_PROVIDER_COMMAND: "\${{ vars.PROVENANCE_PROVIDER_COMMAND }}"
|
|
PROVENANCE_ATTESTATION_PATH: provider-evidence/untrusted/provenance-attestation.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/provenance-attestation.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance-candidate
|
|
- name: Run and validate external provenance provider in one trusted supervisor
|
|
id: supervise_provenance
|
|
run: node scripts/run-and-validate-provider.ts --kind provenance
|
|
- name: Confirm sealed provenance provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: provider-evidence/provenance-attestation.json
|
|
if-no-files-found: error
|
|
|
|
promotion:
|
|
name: promote-verified-immutable-candidate
|
|
needs: [immutable_build, vulnerability_provider, provenance_provider]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "\${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/candidate/release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "\${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "\${{ gitea.run_attempt }}"
|
|
VULNERABILITY_REPORT_PATH: "\${{ gitea.workspace }}/.release/vulnerability/vulnerability-report.json"
|
|
PROVENANCE_ATTESTATION_PATH: "\${{ gitea.workspace }}/.release/provenance/provenance-attestation.json"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "\${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "\${{ vars.VULNERABILITY_KEY_ID }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "\${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "\${{ vars.PROVENANCE_KEY_ID }}"
|
|
VULNERABILITY_INVOCATION_NONCE: "\${{ needs.vulnerability_provider.outputs.invocation_nonce }}"
|
|
PROVENANCE_INVOCATION_NONCE: "\${{ needs.provenance_provider.outputs.invocation_nonce }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/candidate
|
|
- name: Download vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "vulnerability-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability
|
|
- name: Download provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "provenance-provider-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: .release/provenance
|
|
- name: Finalize verified promotion from inode-bound captured inputs
|
|
id: finalize
|
|
run: node scripts/stage-verified-promotion.ts
|
|
- name: Upload promoted release
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "promoted-release-\${{ gitea.run_id }}-\${{ gitea.run_attempt }}"
|
|
path: |
|
|
\${{ steps.finalize.outputs.staging_root }}/release-candidate.tar.gz
|
|
\${{ steps.finalize.outputs.staging_root }}/vulnerability-report.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provenance-attestation.json
|
|
\${{ steps.finalize.outputs.staging_root }}/provider-verification.json
|
|
\${{ steps.finalize.outputs.staging_root }}/promotion-verification.json
|
|
if-no-files-found: error
|
|
- name: Always remove private promotion staging
|
|
if: always()
|
|
env:
|
|
PROMOTION_STAGING_ROOT: \${{ steps.finalize.outputs.staging_root }}
|
|
PROMOTION_CLEANUP_TOKEN: \${{ steps.finalize.outputs.cleanup_token }}
|
|
PROMOTION_RUNNER_TEMP_DEV: \${{ steps.finalize.outputs.runner_temp_dev }}
|
|
PROMOTION_RUNNER_TEMP_INO: \${{ steps.finalize.outputs.runner_temp_ino }}
|
|
PROMOTION_STAGING_DEV: \${{ steps.finalize.outputs.staging_dev }}
|
|
PROMOTION_STAGING_INO: \${{ steps.finalize.outputs.staging_ino }}
|
|
run: |
|
|
if [ -n "$PROMOTION_STAGING_ROOT" ] && [ -n "$PROMOTION_CLEANUP_TOKEN" ] && [ -n "$PROMOTION_RUNNER_TEMP_DEV" ] && [ -n "$PROMOTION_RUNNER_TEMP_INO" ] && [ -n "$PROMOTION_STAGING_DEV" ] && [ -n "$PROMOTION_STAGING_INO" ]; then
|
|
node scripts/cleanup-verified-promotion.ts
|
|
fi
|
|
|
|
production_gate:
|
|
name: "\${{ matrix.gate }} / \${{ matrix.name }}"
|
|
needs: promotion
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-016, name: rollback-drill }
|
|
- { gate: FE-GATE-021, name: runbook-boot-config }
|
|
- { gate: FE-GATE-022, name: runbook-chunk-mismatch }
|
|
- { gate: FE-GATE-023, name: runbook-api-degradation }
|
|
- { gate: FE-GATE-024, name: runbook-telemetry }
|
|
- { gate: FE-GATE-025, name: runbook-release-rollback }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- \${{ matrix.gate }}
|
|
- name: Upload production gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "\${{ matrix.gate }}-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
field_gate:
|
|
name: "FE-GATE-018 / field-web-vitals"
|
|
needs: production_gate
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'field' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
FIELD_WEB_VITALS_INPUT: "\${{ vars.FIELD_WEB_VITALS_INPUT }}"
|
|
MIN_ELIGIBLE_SAMPLES: "\${{ vars.MIN_ELIGIBLE_SAMPLES }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-018
|
|
- name: Upload field gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-018-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
documentation_gate:
|
|
name: "FE-GATE-017 / diagram-review"
|
|
if: \${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run documentation gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-017
|
|
- name: Upload documentation gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-017-\${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
"
|
|
`;
|