[E00-S05-T01] Implement CI quality baseline (required PR stages) #405

Merged

kpcto merged 7 commits from feature/187 into main 2026-08-31 00:07:03 +00:00

Conversation 4 Commits 7 Files Changed 5

+840 -297

7 Commits

Author	SHA1	Message	Date
implementer	10ea1ef3db	test: lock in the action SHA pins and workflow-level permissions with the ci-stages suite (E00-S05-T01) ... - assertHardening: every uses: ref is a full 40-char commit SHA equal to the committed PINNED_ACTIONS table (no floating tags) and the workflow declares a top-level permissions: contents: read block - mutation probes: reverting a pin to @v4, swapping a pinned SHA or removing the permissions block all fail	2026-08-30 06:29:43 +00:00
implementer	d0c3b6a83d	ci: pin third-party actions to full commit SHAs and declare minimal workflow permissions (E00-S05-T01) ... - actions/checkout pinned to 11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2) - actions/setup-node pinned to 1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a (v4.2.0) - workflow-level permissions: contents: read (the pipeline only reads the repo) - no floating @v4 tags remain anywhere in the workflow	2026-08-30 06:29:43 +00:00
implementer	13b1548df8	ci: build the config and database-postgres packages before the architecture suites (E00-S05-T01) ... The strict-tsconfig suite typechecks apps/server with tsc --noEmit, which resolves @personal-blog/config and @personal-blog/database-postgres through their compiled dist/ type declarations. On a fresh checkout dist/ does not exist, so the architecture stage must build those two packages first (the same prerequisite the unit and postgres-integration stages already declare).	2026-08-30 06:22:26 +00:00
implementer	f3cd70e45d	docs: document the lint command and the CI quality baseline stages (E00-S05-T01) ... The non-container guide now covers pnpm lint (the formatting/lint policy) in the Test and clean-clone smoke sections and describes the ordered PR CI stages locked in by tests/ci-stages.test.mjs.	2026-08-30 06:12:25 +00:00
implementer	89fe0b52e6	ci: run the required PR quality stages in order (E00-S05-T01) ... Restructure .gitea/workflows/ci.yml from a flat list of per-suite jobs into the ordered stage baseline: frozen install -> typecheck -> formatting/lint -> unit -> architecture -> PostgreSQL integration -> build of the admin and server applications. Each stage gates on its predecessor through needs, so the frozen install runs before every later stage and the pipeline halts on the first failing stage. The docker-gated real-stack probes in the postgres-integration (and container) suites keep running where a Docker daemon is available and skipping cleanly otherwise.	2026-08-30 06:12:25 +00:00
implementer	d9b493498e	test: lock in the CI quality baseline stage order with the ci-stages suite (E00-S05-T01) ... tests/ci-stages.test.mjs asserts that .gitea/workflows/ci.yml declares the seven required PR stages (frozen-install, typecheck, formatting-lint, unit, architecture, postgres-integration, build-apps) in order, that every later stage gates on its predecessor through needs, that each stage runs its expected command (frozen install, pnpm typecheck, pnpm lint, the unit / architecture / postgres-integration node --test runs, the apps-group build with the server artifact check), and that every committed test suite is wired into exactly one stage. Mutation probes prove the assertions are non-vacuous.	2026-08-30 06:12:25 +00:00
implementer	e6d28f94f0	feat: add dependency-free formatting/lint policy suite and root lint script (E00-S05-T01) ... The formatting-policy suite (tests/formatting-policy.test.mjs) locks in the workspace formatting and lint policy: LF line endings, no BOM, no trailing whitespace, no tab indentation, exactly one final newline, and valid JSON with 2-space indentation and no duplicate keys. Every rule has a mutation probe. The root `lint` script runs the suite; the CI formatting-lint stage executes it.	2026-08-30 06:12:25 +00:00