CI/CD

Fast-forward promotions

Run Promote validated commit from dev. It validates one immutable commit, advances test and pprd in sequence, and requires explicit production confirmation by katbose before advancing prod. The same SHA and commit messages reach every branch. CI, CodeQL, Integration, and Load/Security are reusable workflows; they also validate PRs into dev. Direct force-pushes and promotion merge commits are prohibited. The Payload advisory exception is restricted to GHSA-jg8r-5jh2-v2xj on version 3.88.0; all other findings fail CI. Missing integration/load prerequisites still produce explicit skips.

Workflow map

Workflow	Trigger	Purpose
`CI`	PRs to all long-lived branches; pushes to `dev`	Path-aware app builds, lint, typecheck, tests, audit, Lighthouse, and drift gates
`Integration & E2E`	PRs to `test`, `pprd`, `prod`	Database integration and Playwright validation
`Load & Security`	PRs to `pprd`, `prod`	Trivy plus optional k6 and ZAP against pre-production
`CodeQL`	All PRs, pushes to `prod`, weekly	JavaScript/TypeScript security analysis
`Mergify Config`	Mergify config changes	Validate `.mergify.yml` with the official CLI
`Release Please`	Pushes to `dev` and `prod`; explicit dispatch	Prepare release PR on dev; publish after production promotion
`Deploy AWS Production`	Pushes to `prod`	Production deployment through AWS OIDC

Stable required checks

Rulesets require aggregate jobs rather than every conditional job:

CI Success
Integration Success on promotion branches
Load & Security Success on pprd and prod

Each aggregate accepts only success or an intentional skipped result. A failure or cancellation fails the aggregate. External required checks are CodeQL, Socket, Codecov project and patch coverage, and Mergify Merge Protections. Integration/E2E needs DATABASE_URL_TEST. k6 and ZAP need PPRD_URL. Their preflight jobs emit an explicit notice when infrastructure is not configured; Trivy remains a hard gate regardless.

Local verification

bun install --frozen-lockfile
bun run lint
bun run typecheck
bun run test:coverage
bun run mcp:doctor
mergify config validate

Getting started

System design

Standards

Application surface

Platform

Quality & security

Operations

Delivery workflow

Fast-forward promotions

Workflow map

Stable required checks

Local verification

​Fast-forward promotions

​Workflow map

​Stable required checks

​Local verification

Fast-forward promotions

Workflow map

Stable required checks

Local verification