Vorfall 2026-08-16…18: 37 h Ausfall, weil die Reservierung größer war… #100
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # The verification chain from docs/PROZESS.md §4, enforced somewhere the agent | |
| # does not control. Deliberately limited to three checks — anything flaky gets | |
| # removed rather than retried, because a red badge nobody trusts is worse than | |
| # no badge. | |
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| go: | |
| name: Go — vet & test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| # //go:embed all:dist needs the directory to be non-empty, which dist/.gitkeep | |
| # guarantees on every checkout. The built assets are generated, not committed | |
| # (etappe 50), so this job compiles against the placeholder — that is intended, | |
| # and `frontendBuilt()` makes such a binary announce itself rather than serve a | |
| # stale UI. | |
| # | |
| # This guard used to be `test -d cmd/matrixctrl/dist`, which asked whether a | |
| # directory existed while the question was whether the embedded UI was current. | |
| # It passed truthfully for sixteen days over assets that predated a third of the | |
| # app's screens (§4.49). | |
| - name: Check the embed placeholder is present | |
| run: test -f cmd/matrixctrl/dist/.gitkeep || { echo "cmd/matrixctrl/dist/.gitkeep missing — //go:embed needs a non-empty dist"; exit 1; } | |
| # The committed tree must never contain built frontend assets again. | |
| - name: No built frontend assets committed | |
| run: | | |
| tracked=$(git ls-files cmd/matrixctrl/dist | grep -v '^cmd/matrixctrl/dist/.gitkeep$' || true) | |
| test -z "$tracked" || { echo "built assets are committed again:"; echo "$tracked"; exit 1; } | |
| # P0-1c: a plan document explaining why the cluster hostname must never be | |
| # published contained it, and was pushed. Every control in place pointed at | |
| # screenshots; none looked at prose. Skips when the secret is absent, so | |
| # outside PRs are not failed by a check they cannot satisfy. | |
| - name: No sensitive strings | |
| env: | |
| SENSITIVE_PATTERNS: ${{ secrets.SENSITIVE_PATTERNS }} | |
| run: ./scripts/check-sensitive.sh | |
| # Ten files had drifted out of gofmt before this gate existed. Formatting | |
| # is not worth an opinion, only a check. | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l ./cmd ./internal) | |
| test -z "$unformatted" || { echo "gofmt needed:"; echo "$unformatted"; exit 1; } | |
| - run: go vet ./... | |
| # TestDiscoverLive self-skips unless RUN_LIVE=1, so no cluster is needed. | |
| - run: go test ./... -count=1 | |
| web: | |
| name: Frontend — typecheck, test & build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - run: npm ci | |
| # `-b` is load-bearing: web/tsconfig.json is `"files": []` plus project | |
| # references, so plain `tsc --noEmit` checks zero files and always passes. | |
| # The Build step below caught what this one missed, eleven minutes later | |
| # and a hundred lines of output further down (§4.40). | |
| - name: Typecheck | |
| run: npx tsc -b --noEmit | |
| - name: Unit tests | |
| run: npm run test -- --run | |
| - name: Build | |
| run: npm run build |