CI and Releases

CI, merge gate and releases

Executable truth is .github/workflows/ci.yml. Settings that live outside Git (rulesets, security features) are recorded in the GitHub setup runbook. The dated topology and test counts are in current-status.md.

One required check: gate

main is protected by a ruleset. Every change arrives through a pull request, squash-merged only, up to date with main, with all conversations resolved, and with a green gate. gate needs every other job and fails if a job failed, was cancelled, or was skipped when the run owed it. Never add a path-conditional job as a required check. A skipped required check blocks merging forever.

What a run owes

Run	Owes
Pull request touching code	The guards plus every suite whose paths changed (.github/ci-paths.yml), and dependency-review
Docs-only pull request (docs/**, root *.md)	The guards plus docs-tests and dependency-review
Push to main (post-merge)	The guards, migrations and security backstops
v* tag, manual run, weekly schedule	All applicable suites; only a tag adds release-gate, and dependency-review is PR-only

Guards on every run: contracts (authority, site-data, contract lint and lock), compose-images-lock, and workflow-and-secrets (actionlint, zizmor, full-history gitleaks).

Merge evidence is the pull request's final check run on its head SHA. The post-merge main run is a backstop.

Security coverage at a glance

• npm high/critical advisories: gated.
• Built API and web images: HIGH/CRITICAL findings with an available fix are gated. Findings without a fix are tracked in RES-CONTAINER-SECURITY-TRIAGE.
• pip-audit and the Trivy filesystem scan: advisory.
• Secrets: gitleaks over the whole history, gated. GitHub secret scanning and push protection are also on.
• Dependency review on pull requests: gated at high.
• CodeQL default setup: advisory, results under Security → Code scanning.
• Every action is pinned to a commit SHA; no checkout persists the token.

Dependabot

Weekly grouped minor/patch updates with a seven-day cooldown; majors come as individual PRs. Security updates are immediate. Manual follow-ups that Dependabot cannot do (infra/images.lock via just images-update, Dockerfile uv==/npm@ pins, workflow-step images) are listed in the runbook.

Releases

There is no release pipeline yet. A v* tag (creation restricted to administrators) runs all applicable suites plus release-gate, which asserts that every image in infra/images.lock is digest-pinned. Other CI jobs build images for testing and scanning, but nothing publishes assets or deploys a site. Images and the air-gap bundle are built with just airgap / scripts/airgap-bundle.sh. A tag is not release acceptance: follow the operator runbooks.

Coverage limits

The runbook explains both tested boundaries and advisory checks. Known follow-ups include real Tika OCR (#592), live Celery/Beat and long-lived SSE (#598), integration order dependence (#567), and the browser harness race (#595). Their closure contracts stay in the ledger.

A required PR does not imply a required independent approval; consult the runbook and live ruleset for reviewer requirements. CI success alone does not certify production recovery or deployment.