> ## Documentation Index
> Fetch the complete documentation index at: https://docs.theroyalglow.in/llms.txt
> Use this file to discover all available pages before exploring further.

# CI/CD

> Required checks, promotion workflows, and deployment boundaries.

## Fast-forward promotions

Run **Promote validated commit** from `dev`. It validates one immutable commit, advances `test` and `pprd` in sequence, and requires explicit production confirmation by katbose before advancing `prod`. The same SHA and commit messages reach every branch. CI, CodeQL, Integration, and Load/Security are reusable workflows; they also validate PRs into dev. Direct force-pushes and promotion merge commits are prohibited.

The Payload advisory exception is restricted to GHSA-jg8r-5jh2-v2xj on version 3.88.0; all other findings fail CI. Missing integration/load prerequisites still produce explicit skips.

## Workflow map

| Workflow                | Trigger                                         | Purpose                                                                           |
| ----------------------- | ----------------------------------------------- | --------------------------------------------------------------------------------- |
| `CI`                    | PRs to all long-lived branches; pushes to `dev` | Path-aware app builds, lint, typecheck, tests, audit, Lighthouse, and drift gates |
| `Integration & E2E`     | PRs to `test`, `pprd`, `prod`                   | Database integration and Playwright validation                                    |
| `Load & Security`       | PRs to `pprd`, `prod`                           | Trivy plus optional k6 and ZAP against pre-production                             |
| `CodeQL`                | All PRs, pushes to `prod`, weekly               | JavaScript/TypeScript security analysis                                           |
| `Mergify Config`        | Mergify config changes                          | Validate `.mergify.yml` with the official CLI                                     |
| `Release Please`        | Pushes to `dev` and `prod`; explicit dispatch   | Prepare release PR on dev; publish after production promotion                     |
| `Deploy AWS Production` | Pushes to `prod`                                | Production deployment through AWS OIDC                                            |

## Stable required checks

Rulesets require aggregate jobs rather than every conditional job:

* `CI Success`
* `Integration Success` on promotion branches
* `Load & Security Success` on `pprd` and `prod`

Each aggregate accepts only `success` or an intentional `skipped` result. A failure
or cancellation fails the aggregate. External required checks are CodeQL, Socket,
Codecov project and patch coverage, and Mergify Merge Protections.

Integration/E2E needs `DATABASE_URL_TEST`. k6 and ZAP need `PPRD_URL`. Their
preflight jobs emit an explicit notice when infrastructure is not configured;
Trivy remains a hard gate regardless.

## Local verification

```bash theme={"theme":{"light":"gruvbox-light-medium","dark":"gruvbox-dark-medium"}}
bun install --frozen-lockfile
bun run lint
bun run typecheck
bun run test:coverage
bun run mcp:doctor
mergify config validate
```


## Related topics

- [Git Workflow](/content/docs/git-workflow.md)
- [Deployment](/content/docs/deployment.md)
- [Engineering Workflow](/engineering/index.md)
- [Mergify](/github/mergify.md)
- [Testing](/content/docs/testing.md)