---
phase: 8
slug: gitea-ci
status: planned
nyquist_compliant: true
wave_0_complete: false
created: 2026-06-11
---

# Phase 8 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

---

## Test Infrastructure

| Property               | Value                                                                |
| ---------------------- | -------------------------------------------------------------------- |
| **Framework**          | Vitest 4.1.x (API + PWA unit), @playwright/test 1.60.0 (E2E harness) |
| **Config file**        | `apps/api/vitest.config.ts`, `apps/pwa/playwright.config.ts`         |
| **Quick run command**  | `pnpm lint && pnpm typecheck`                                        |
| **Full suite command** | `pnpm test` then `pnpm test:e2e` (CI=true, dev stack up)             |
| **Estimated runtime**  | unit ~tens of seconds; harness several minutes (2 device profiles)   |

**Note:** Phase 8 delivers CI plumbing (`.gitea/workflows/*.yml`). The "tests" for this phase are the CI workflow runs themselves — validation is observed by triggering the workflow on a branch/PR and reading Gitea Actions logs, not by a local unit-test file per task.

---

## Sampling Rate

- **After every task commit:** YAML lint / `act_runner` dry-validate where possible; push branch and observe the probe/CI run in Gitea Actions
- **After every plan wave:** Confirm all jobs in that wave pass on a test PR (W0 probe green → W1 fast-checks + integration green → W2 harness + publish green)
- **Before `/gsd-verify-work`:** Full CI green on a real PR targeting `main`
- **Max feedback latency:** one CI run (minutes), bounded by the harness job

---

## Per-Task Verification Map

| Task ID                              | Plan  | Wave | Requirement | Threat Ref     | Secure Behavior                                                          | Test Type                | Automated Command                                                                                      | File Exists      | Status     |
| ------------------------------------ | ----- | ---- | ----------- | -------------- | ------------------------------------------------------------------------ | ------------------------ | ------------------------------------------------------------------------------------------------------ | ---------------- | ---------- |
| P01-T1 register runner + PAT         | 08-01 | 1    | CI-01/CI-02 | T-08-PAT       | runner online; PAT secret stored, never in repo                          | operator/manual          | Gitea Actions runner list + repo secret present                                                        | ❌ operator      | ⬜ pending |
| P01-T2 author runner-probe.yml       | 08-01 | 1    | CI-01       | T-08-01        | probe is non-destructive; touches no secret                              | grep gate                | `grep` healthcheck.sh + gitea-upload fork; `! grep` mysqladmin/upload-artifact@v4                      | ❌ W0            | ⬜ pending |
| P01-T3 run probe, record forks       | 08-01 | 1    | CI-01       | T-08-01        | runner mode / cache / WebKit / artifact answers captured                 | workflow run             | observe runner-probe run in Gitea Actions                                                              | ❌ W0            | ⬜ pending |
| P02-T1 fast-checks job               | 08-02 | 2    | CI-01       | —              | lint+typecheck+PWA-unit gate the PR                                      | grep gate + workflow run | `grep` node-pin/typecheck/pwa test; PR run green                                                       | ✅ scripts       | ⬜ pending |
| P02-T2 api job (MariaDB+migrate)     | 08-02 | 2    | CI-01       | T-08-03/04/05  | DB-backed API tests pass cold; migrate-not-push; throwaway creds         | grep gate + workflow run | `grep` healthcheck.sh+db:migrate; `! grep` mysqladmin/db:push; cold PR run green                       | ✅ scripts       | ⬜ pending |
| P02-T3 verify PR jobs                | 08-02 | 2    | CI-01       | —              | both jobs run parallel, api green cold                                   | workflow run             | observe fast-checks ∥ api on a PR                                                                      | ❌ W1            | ⬜ pending |
| P03-T1 harness stack bring-up        | 08-03 | 3    | CI-01       | T-08-06/07/08  | API bg w/ inline DEV_AUTH_BYPASS; :3000 readiness before Playwright      | grep gate + workflow run | `grep` inline-bypass+:3000/health+db:migrate; `! grep` db:push                                         | ✅ Phase 7 specs | ⬜ pending |
| P03-T2 playwright run + artifacts    | 08-03 | 3    | CI-01       | T-08-06        | both profiles run; traces upload on failure; no spec edits               | grep gate + workflow run | `grep` webkit+chromium+base-url+gitea-upload; `git diff --quiet` harness files                         | ✅ Phase 7 specs | ⬜ pending |
| P03-T3 verify harness on PR          | 08-03 | 3    | CI-01       | —              | iphone+pixel green vs CI dev stack; artifact confirmed                   | workflow run             | observe harness job on a PR                                                                            | ❌ W2            | ⬜ pending |
| P04-T1 publish job                   | 08-04 | 4    | CI-02       | T-08-PAT/09/10 | --password-stdin only; both tags; production target from root; no bypass | grep gate                | `grep` --password-stdin+target production+both tags; `! grep` -p/--password/DEV_AUTH_BYPASS-in-publish | ❌ W2            | ⬜ pending |
| P04-T2 merge, audit log, verify tags | 08-04 | 4    | CI-02       | T-08-PAT       | no plaintext PAT in log; :latest + :v1.1-<sha> in registry               | workflow run + log audit | merge → audit publish log + check Packages                                                             | ❌ W2            | ⬜ pending |

_Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky — planner expands one row per task._

---

## Wave 0 Requirements

- [ ] `.gitea/workflows/runner-probe.yml` — runner-probe workflow (new file; Wave 0 task). Must answer: runner mode (Docker vs host), Docker socket access, `actions/*` resolution, Node 22 / pnpm availability, internet access, WebKit dep installability.
- [ ] `.gitea/workflows/ci.yml` — main CI workflow scaffolding (new file; Waves 1–2).

_Existing unit/integration/E2E infrastructure (Vitest + Playwright) is reused unchanged; no new local test framework is installed._

---

## Manual-Only Verifications

| Behavior                             | Requirement | Why Manual                                                             | Test Instructions                                                                                                       |
| ------------------------------------ | ----------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Runner registered on Unraid          | CI-01/CI-02 | Operator infra action outside the repo; 0 runners currently registered | Install/register `act_runner` on Unraid against `git.bergerhouse.net`; confirm it appears in Gitea Actions runners list |
| Gitea registry PAT created           | CI-02       | Secret creation is an operator action; cannot be scripted in-repo      | Create PAT with `write:package`; store as repo secret (e.g. `GITEA_REGISTRY_PAT`); confirm publish job authenticates    |
| PR merge actually blocked on failure | CI-01       | Requires branch-protection "required status checks" config in Gitea    | Configure required checks on `main`; open a failing PR; confirm merge button is blocked                                 |

---

## Validation Sign-Off

- [x] All tasks have an observable CI-run verification or Wave 0 dependency
- [x] Sampling continuity: every wave has a green-gate before the next (W0 probe → W1 PR jobs → W2 harness → W3 publish, each gated by a checkpoint)
- [x] Wave 0 covers all MISSING references (runner-probe answers all unknowns)
- [x] No watch-mode flags
- [x] `nyquist_compliant: true` set in frontmatter (after planner expands the map)

**Approval:** planned 2026-06-11 — map expanded, nyquist_compliant=true
