luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(08): create phase plan — 4 plans (runner-probe, PR jobs, harness, publish)

Browse Source
This commit is contained in:
Lucas Berger
2026-06-11 09:26:48 -04:00
parent 92acf02989
commit 4e474cdd9c
6 changed files with 702 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/phases/08-gitea-ci/08-VALIDATION.md
+19 -12
View File
@@ -1,8 +1,8 @@
---
phase: 8
slug: gitea-ci
status: draft
nyquist_compliant: false
status: planned
nyquist_compliant: true
wave_0_complete: false
created: 2026-06-11
---
@@ -40,10 +40,17 @@ created: 2026-06-11
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| _planner-fills_ | — | 0 | CI-01 | — | runner-probe surfaces runner mode / Docker / action resolution | workflow run | observe `.gitea/workflows/runner-probe.yml` in Gitea Actions | ❌ W0 | ⬜ pending |
| _planner-fills_ | — | 1 | CI-01 | — | lint/typecheck/unit/integration gate the PR | workflow run | `pnpm lint`, `pnpm typecheck`, `pnpm test`, `pnpm --filter @familysync/api test` | ✅ (scripts exist) | ⬜ pending |
| _planner-fills_ | — | 2 | CI-01 | — | harness runs against CI dev stack, failure blocks merge | workflow run | `pnpm test:e2e` with `CI=true`, `DEV_AUTH_BYPASS=true` | ✅ (Phase 7 specs) | ⬜ pending |
| _planner-fills_ | — | 2 | CI-02 | T-PAT | image published, PAT never in logs | workflow run | `docker pull <registry>/<repo>:latest` | ❌ W2 | ⬜ pending |
| P01-T1 register runner + PAT | 08-01 | 1 | CI-01/CI-02 | T-08-PAT | runner online; PAT secret stored, never in repo | operator/manual | Gitea Actions runner list + repo secret present | ❌ operator | ⬜ pending |
| P01-T2 author runner-probe.yml | 08-01 | 1 | CI-01 | T-08-01 | probe is non-destructive; touches no secret | grep gate | `grep` healthcheck.sh + gitea-upload fork; `! grep` mysqladmin/upload-artifact@v4 | ❌ W0 | ⬜ pending |
| P01-T3 run probe, record forks | 08-01 | 1 | CI-01 | T-08-01 | runner mode / cache / WebKit / artifact answers captured | workflow run | observe runner-probe run in Gitea Actions | ❌ W0 | ⬜ pending |
| P02-T1 fast-checks job | 08-02 | 2 | CI-01 | — | lint+typecheck+PWA-unit gate the PR | grep gate + workflow run | `grep` node-pin/typecheck/pwa test; PR run green | ✅ scripts | ⬜ pending |
| P02-T2 api job (MariaDB+migrate) | 08-02 | 2 | CI-01 | T-08-03/04/05 | DB-backed API tests pass cold; migrate-not-push; throwaway creds | grep gate + workflow run | `grep` healthcheck.sh+db:migrate; `! grep` mysqladmin/db:push; cold PR run green | ✅ scripts | ⬜ pending |
| P02-T3 verify PR jobs | 08-02 | 2 | CI-01 | — | both jobs run parallel, api green cold | workflow run | observe fast-checks ∥ api on a PR | ❌ W1 | ⬜ pending |
| P03-T1 harness stack bring-up | 08-03 | 3 | CI-01 | T-08-06/07/08 | API bg w/ inline DEV_AUTH_BYPASS; :3000 readiness before Playwright | grep gate + workflow run | `grep` inline-bypass+:3000/health+db:migrate; `! grep` db:push | ✅ Phase 7 specs | ⬜ pending |
| P03-T2 playwright run + artifacts | 08-03 | 3 | CI-01 | T-08-06 | both profiles run; traces upload on failure; no spec edits | grep gate + workflow run | `grep` webkit+chromium+base-url+gitea-upload; `git diff --quiet` harness files | ✅ Phase 7 specs | ⬜ pending |
| P03-T3 verify harness on PR | 08-03 | 3 | CI-01 | — | iphone+pixel green vs CI dev stack; artifact confirmed | workflow run | observe harness job on a PR | ❌ W2 | ⬜ pending |
| P04-T1 publish job | 08-04 | 4 | CI-02 | T-08-PAT/09/10 | --password-stdin only; both tags; production target from root; no bypass | grep gate | `grep` --password-stdin+target production+both tags; `! grep` -p/--password/DEV_AUTH_BYPASS-in-publish | ❌ W2 | ⬜ pending |
| P04-T2 merge, audit log, verify tags | 08-04 | 4 | CI-02 | T-08-PAT | no plaintext PAT in log; :latest + :v1.1-<sha> in registry | workflow run + log audit | merge → audit publish log + check Packages | ❌ W2 | ⬜ pending |
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky — planner expands one row per task.*
@@ -70,10 +77,10 @@ created: 2026-06-11
## Validation Sign-Off
- [ ] All tasks have an observable CI-run verification or Wave 0 dependency
- [ ] Sampling continuity: every wave has a green-gate before the next
- [ ] Wave 0 covers all MISSING references (runner-probe answers all unknowns)
- [ ] No watch-mode flags
- [ ] `nyquist_compliant: true` set in frontmatter (after planner expands the map)
- [x] All tasks have an observable CI-run verification or Wave 0 dependency
- [x] Sampling continuity: every wave has a green-gate before the next (W0 probe → W1 PR jobs → W2 harness → W3 publish, each gated by a checkpoint)
- [x] Wave 0 covers all MISSING references (runner-probe answers all unknowns)
- [x] No watch-mode flags
- [x] `nyquist_compliant: true` set in frontmatter (after planner expands the map)
**Approval:** pending
**Approval:** planned 2026-06-11 — map expanded, nyquist_compliant=true