ci-cd-and-automation

Files (1)

• SKILL.md

SKILL.md (first lines)

# CI/CD and Automation

## Overview

Automate quality gates so that no change reaches `main` without passing the resolver-selected gates for every toolchain it touched. CI/CD is the enforcement mechanism for every other skill — it catches what humans and agents miss, and it does so consistently on every single change.

This is a **polyglot** repo (`mezon-bot-ai`, consumed as the `platform/` git submodule). A single change can touch Python (`uv` workspace), Go (standalone modules, go 1.24), and TypeScript (`apps/portal`, pnpm). The gate resolver (`.claude/workflows/lib/gate-resolver.js`) maps each touched path to its owning package (nearest enclosing manifest) and runs that toolchain's gates — there is no single `make vet`/`make test`.

**Shift Left:** Catch problems as early in the pipeline as possible. A bug caught in `ruff check` or `pyright` costs seconds; the same bug caught after merge costs hours. Move checks upstream — lint/typecheck before tests, tests before merge, merge before deploy. `/opsx:ship` runs these same resolver gates *before* it opens the PR, so failures are caught on your machine, not in review.

**Faster is Safer:** Smaller batches and more frequent releases reduce risk, not increase it. One OpenSpec change per PR is easier to debug than a quarter's worth of work. Frequent, small ships build confidence in the release process itself.

## When to Use

- Setting up or modifying the CI pipeline (`.github/workflows/rag-engine.yml`)
- Adding or modifying automated checks
- Configuring the pgvector service container for DB-backed tests
- When a change should trigger automated verification
- Debugging CI failures

## The Quality Gate Pipeline

Every change goes through its toolchain's gates before merge. The resolver runs only the gates for the toolchains a change actually touches:

```
Pull Request Opened
    │
    ▼
┌──────────────────────────────────────────────────────────┐
│  Python (uv dir D)                                         │
│    uv --directory D run ruff check .                       │
│    uv --directory D run ruff format --check .              │
│    uv --directory D run pyright                            │
│    uv --directory D run python -m pytest -q                │
│      ▲ DB-dependent tests need pgvector + TEST_DATABASE_URL│
│  Go (module dir M, go 1.24)                                │
│    go build ./...  →  go vet ./...  →  go test -race ./...  │
│  TS (apps/portal)                                          │
│    pnpm typecheck → pnpm lint → pnpm test                  │
│    pnpm test:e2e   (gated tier — not every micro-change)   │
│  Bench:  bash benchmarks/ci-free-gates.sh                  │
│  Always: openspec validate "<change>" --strict             │
└──────────────────────────────────────────────────────────┘
    │
    ▼
  Ready for review
```

**No gate can be skipped.** If `ruff`/`pyright`/`go vet` fails, fix the code — don't suppress the diagnostic. If a test fails, fix the code — don't add a skip marker. DB-dependent tests **skip themselves** when `TEST_DATABASE_URL` / pgvector is unavailable, so CI *must* provide them or the most important coverage silently disappears.

## GitHub Actions Configuration

### CI Pipeline — `.github/workflows/rag-engine.yml`

The platform's CI workflow has **four jobs**. The workflow file itself is maintained separately; this is its shape and intent.

```yaml
# .github/workflows/rag-engine.yml
name: rag-engine

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  # 1) Python test matrix with a pgvector service + migrations
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_DB: meknow_test
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/meknow_test
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive   # repo is the platform/ submodule of funix-mezon-bot
      - uses: astral-sh/setup-uv@v5
      - run: uv --directory apps/backend run alembic upgrade head
      - run: uv --directory <member> run python -m pytest -q   # per touched member

  # 2) Go worker module gates (go 1.24)
  go-worker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { submodules: recursive }
      - uses: actions/setup-go@v5
        with: { go-version: '1.24', cache: true }
      - run: go vet ./...
      - run: go test -race ./...

  # 3) Free benchmark ladder on every PR (deterministic, ~2min)
  benchmark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { submodules: recursive }
      - run: bash benchmarks/ci-free-gates.sh

  # 4) LLM-tier judge gates — nightly / on main / workflow_dispatch, NOT per-PR
  judge-gates:
    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:

From minhlucvan/emdesign, Apache-2.0.

More from minhlucvan/emdesign