Lucas BergerandClaude Opus 4.8
c7955a46b9
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
8.2 KiB
8.2 KiB
phase, slug, status, nyquist_compliant, wave_0_complete, created
| phase | slug | status | nyquist_compliant | wave_0_complete | created |
|---|---|---|---|---|---|
| 8 | gitea-ci | planned | true | false | 2026-06-11 |
Phase 8 — Validation Strategy
Per-phase validation contract for feedback sampling during execution.
Test Infrastructure
| Property | Value |
|---|---|
| Framework | Vitest 4.1.x (API + PWA unit), @playwright/test 1.60.0 (E2E harness) |
| Config file | apps/api/vitest.config.ts, apps/pwa/playwright.config.ts |
| Quick run command | pnpm lint && pnpm typecheck |
| Full suite command | pnpm test then pnpm test:e2e (CI=true, dev stack up) |
| Estimated runtime | unit ~tens of seconds; harness several minutes (2 device profiles) |
Note: Phase 8 delivers CI plumbing (.gitea/workflows/*.yml). The "tests" for this phase are the CI workflow runs themselves — validation is observed by triggering the workflow on a branch/PR and reading Gitea Actions logs, not by a local unit-test file per task.
Sampling Rate
- After every task commit: YAML lint /
act_runnerdry-validate where possible; push branch and observe the probe/CI run in Gitea Actions - After every plan wave: Confirm all jobs in that wave pass on a test PR (W0 probe green → W1 fast-checks + integration green → W2 harness + publish green)
- Before
/gsd-verify-work: Full CI green on a real PR targetingmain - Max feedback latency: one CI run (minutes), bounded by the harness job
Per-Task Verification Map
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---|---|---|---|---|---|---|---|---|---|
| P01-T1 register runner + PAT | 08-01 | 1 | CI-01/CI-02 | T-08-PAT | runner online; PAT secret stored, never in repo | operator/manual | Gitea Actions runner list + repo secret present | ❌ operator | ⬜ pending |
| P01-T2 author runner-probe.yml | 08-01 | 1 | CI-01 | T-08-01 | probe is non-destructive; touches no secret | grep gate | grep healthcheck.sh + gitea-upload fork; ! grep mysqladmin/upload-artifact@v4 |
❌ W0 | ⬜ pending |
| P01-T3 run probe, record forks | 08-01 | 1 | CI-01 | T-08-01 | runner mode / cache / WebKit / artifact answers captured | workflow run | observe runner-probe run in Gitea Actions | ❌ W0 | ⬜ pending |
| P02-T1 fast-checks job | 08-02 | 2 | CI-01 | — | lint+typecheck+PWA-unit gate the PR | grep gate + workflow run | grep node-pin/typecheck/pwa test; PR run green |
✅ scripts | ⬜ pending |
| P02-T2 api job (MariaDB+migrate) | 08-02 | 2 | CI-01 | T-08-03/04/05 | DB-backed API tests pass cold; migrate-not-push; throwaway creds | grep gate + workflow run | grep healthcheck.sh+db:migrate; ! grep mysqladmin/db:push; cold PR run green |
✅ scripts | ⬜ pending |
| P02-T3 verify PR jobs | 08-02 | 2 | CI-01 | — | both jobs run parallel, api green cold | workflow run | observe fast-checks ∥ api on a PR | ❌ W1 | ⬜ pending |
| P03-T1 harness stack bring-up | 08-03 | 3 | CI-01 | T-08-06/07/08 | API bg w/ inline DEV_AUTH_BYPASS; :3000 readiness before Playwright | grep gate + workflow run | grep inline-bypass+:3000/health+db:migrate; ! grep db:push |
✅ Phase 7 specs | ⬜ pending |
| P03-T2 playwright run + artifacts | 08-03 | 3 | CI-01 | T-08-06 | both profiles run; traces upload on failure; no spec edits | grep gate + workflow run | grep webkit+chromium+base-url+gitea-upload; git diff --quiet harness files |
✅ Phase 7 specs | ⬜ pending |
| P03-T3 verify harness on PR | 08-03 | 3 | CI-01 | — | iphone+pixel green vs CI dev stack; artifact confirmed | workflow run | observe harness job on a PR | ❌ W2 | ⬜ pending |
| P04-T1 publish job | 08-04 | 4 | CI-02 | T-08-PAT/09/10 | --password-stdin only; both tags; production target from root; no bypass | grep gate | grep --password-stdin+target production+both tags; ! grep -p/--password/DEV_AUTH_BYPASS-in-publish |
❌ W2 | ⬜ pending |
| P04-T2 merge, audit log, verify tags | 08-04 | 4 | CI-02 | T-08-PAT | no plaintext PAT in log; :latest + :v1.1- in registry | workflow run + log audit | merge → audit publish log + check Packages | ❌ W2 | ⬜ pending |
Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky — planner expands one row per task.
Wave 0 Requirements
.gitea/workflows/runner-probe.yml— runner-probe workflow (new file; Wave 0 task). Must answer: runner mode (Docker vs host), Docker socket access,actions/*resolution, Node 22 / pnpm availability, internet access, WebKit dep installability..gitea/workflows/ci.yml— main CI workflow scaffolding (new file; Waves 1–2).
Existing unit/integration/E2E infrastructure (Vitest + Playwright) is reused unchanged; no new local test framework is installed.
Manual-Only Verifications
| Behavior | Requirement | Why Manual | Test Instructions |
|---|---|---|---|
| Runner registered on Unraid | CI-01/CI-02 | Operator infra action outside the repo; 0 runners currently registered | Install/register act_runner on Unraid against git.bergerhouse.net; confirm it appears in Gitea Actions runners list |
| Gitea registry PAT created | CI-02 | Secret creation is an operator action; cannot be scripted in-repo | Create PAT with write:package; store as repo secret (e.g. GITEA_REGISTRY_PAT); confirm publish job authenticates |
| PR merge actually blocked on failure | CI-01 | Requires branch-protection "required status checks" config in Gitea | Configure required checks on main; open a failing PR; confirm merge button is blocked |
Validation Sign-Off
- All tasks have an observable CI-run verification or Wave 0 dependency
- Sampling continuity: every wave has a green-gate before the next (W0 probe → W1 PR jobs → W2 harness → W3 publish, each gated by a checkpoint)
- Wave 0 covers all MISSING references (runner-probe answers all unknowns)
- No watch-mode flags
nyquist_compliant: trueset in frontmatter (after planner expands the map)
Approval: planned 2026-06-11 — map expanded, nyquist_compliant=true