# 0.6 — CI pipeline (GREEN)

Phase: 0 — Foundations
Stage: GREEN
Depends on: [0.4](0.4-local-dev-harness.md)

- [ ] CI builds the binary on every push and pull request
- [ ] CI runs `go vet` over all packages and fails on any finding
- [ ] CI runs the full test suite, including the local harness tests, with the race detector on
- [ ] CI runs `govulncheck` and fails the job on any HIGH or CRITICAL severity finding
- [ ] CI needs no cluster, no kubeconfig and no credentials to pass
- [ ] A deliberately broken commit — failing test, vet finding, or known-vulnerable dependency — fails CI rather than passing silently
- [ ] Job status is visible on the commit or pull request

CI is the outer loop for the same closed verification loop the harness gives locally.
It must not depend on cluster access, or it stops running the moment the cluster is
unavailable.

## Verify

```bash
go vet ./... && go test -race ./... && govulncheck ./...
# expected: all three exit 0 locally; pushing a branch with a failing test shows a
# failed CI run on that commit
```