26 lines
1.0 KiB
Markdown
26 lines
1.0 KiB
Markdown
|
# 0.6 — CI pipeline (GREEN)
|
||
|
|
|
||
|
|
Phase: 0 — Foundations
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [0.4](0.4-local-dev-harness.md)
|
||
|
|
|
||
|
|
- [ ] CI builds the binary on every push and pull request
|
||
|
|
- [ ] CI runs `go vet` over all packages and fails on any finding
|
||
|
|
- [ ] CI runs the full test suite, including the local harness tests, with the race detector on
|
||
|
|
- [ ] CI runs `govulncheck` and fails the job on any HIGH or CRITICAL severity finding
|
||
|
|
- [ ] CI needs no cluster, no kubeconfig and no credentials to pass
|
||
|
|
- [ ] A deliberately broken commit — failing test, vet finding, or known-vulnerable dependency — fails CI rather than passing silently
|
||
|
|
- [ ] Job status is visible on the commit or pull request
|
||
|
|
|
||
|
|
CI is the outer loop for the same closed verification loop the harness gives locally.
|
||
|
|
It must not depend on cluster access, or it stops running the moment the cluster is
|
||
|
|
unavailable.
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
go vet ./... && go test -race ./... && govulncheck ./...
|
||
|
|
# expected: all three exit 0 locally; pushing a branch with a failing test shows a
|
||
|
|
# failed CI run on that commit
|
||
|
|
```
|