feat: add isolated release gates and CI checks

2026-09-19 10:01:23 -04:00
parent 0ff3e67568
commit 92272d4e9a
20 changed files with 442 additions and 10 deletions
@@ -0,0 +1,28 @@
+name: isolated-ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  verify:
+    # Runner labels/capabilities must be confirmed by the operator before this
+    # workflow is considered release evidence. No deployment or secret access is
+    # performed by this job.
+    runs-on: ubuntu-latest
+    container: oven/bun:1.3.14
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install frozen dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Unit and integration tests
+        run: bun test
+      - name: Typecheck
+        run: bun run check
+      - name: Build fixture application
+        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run build
+      - name: Release safety checks
+        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run release:check
+      - name: Isolated fixture smoke
+        run: APP_MODE=demo APP_RELEASE_ID=fixture bun run test:fixture