Repository navigation
ci: the single pipeline run by the Claude bot (bootstrap, ADR-1115) - #781
Merged
Merged
Conversation
Adds .github/workflows/pipeline.yml, the one pipeline every pull request goes through: contract (validates ci.json), unit (the SQLite-backed pytest suite under uv, Cobertura coverage.xml, 90 % of lines), regression (tests_py/integration), e2e (scripts/docker_smoke.sh, image built in the job), environment (cortex-doctor after `pip install .` into a fresh venv on ubuntu, macOS and Windows, bare runner plus the pinned Claude Code CLI 2.1.296), install (scripts/install_e2e/run.py on the three OS, the Windows leg new), the bot's review (code-review plugin) and fix steps, the squash auto-merge, and the release tag on push to main, which keeps ADR-0802's gate: canonical_version from pyproject.toml and check_version_surfaces. The commands live in ci.json (version_file: pyproject.toml). No mutation run is part of the pipeline (owner rule 2026-10-22: scoped to a PR's files, never a whole tree). merge runs on every same-repo, non-draft pull request and its first step fails, naming the job, when a test job is not a success or review failed; only then is the squash auto-merge armed, with no checkout (measured on claude-mods #38 and session-optimizer #73: a skipped required check counts as satisfied). claude-review.yml is deleted, replaced by the pipeline's review job; claude.yml stays. ci.yml and the other workflows are untouched. Red cells on day one: line coverage 82 % (ci.yml --cov-fail-under=82) under the 90 % floor; the Windows install leg. Measured 2026-10-22 on this checkout: uv sync --locked and tests_py/integration on SQLite (see the pull request for the figures); actionlint 1.7.12 passes. source: ADR-1115 Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01BxsVCVscNG2Vb7fafCgqYR
1 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The single CI pipeline (bootstrap, ADR-1115)
Adds
.github/workflows/pipeline.yml("Pipeline"),ci.jsonand ADR-1115 (wiki/adr/cortex/1115-...md, written with the Cortexwiki_adrtool). Deletes.github/workflows/claude-review.yml(the pipeline's review job replaces it;claude.yml, the @claude mention, stays).ci.ymland every other workflow are untouched. Branched fromorigin/main; PR #780 (fix/claude-ci-runtime, a centralised CI by another session) is not touched. Design: zetetic-team-subagentsdocs/superpowers/specs/2026-10-22-single-ci-design.md, decisions 1 to 9 binding; plan Phase 2.Pipeline
contract(validatesci.json) ->unit(reads Coberturacoverage.xml, fails under 90 % of lines) ->regression->e2e->environment(ubuntu, macOS, Windows; bare runner plus@anthropic-ai/[email protected]) ->install(same matrix, freshHOMEandCLAUDE_CONFIG_DIR) ->review(the bot: documented/code-review:code-review --comment, then a fix step whose prompt carries the failed-job URLs; skipped when the head commit is the bot's, the PR is a draft or a fork, the actor is Dependabot, or the diff touchespipeline.yml) ->merge->tagon push to main (this repository's own release-gate block, ADR-0802:canonical_versionfrompyproject.toml,check_version_surfaces.py, tag pushed overRELEASE_TAG_SSH_KEY). Actions pinned by SHA;actionlint1.7.12 passes.# source: ADR-1115cited inpipeline.yml.mergeruns on every same-repo, non-draft pull request and its first step fails explicitly, naming the job, when unit, regression, e2e, environment or install is not a success or review failed; only then does it armgh pr merge --auto --squash(no checkout). Measured on claude-mods #38 and session-optimizer #73: amergejob whoseif:is not met is skipped, and GitHub treats a skipped required check as satisfied. The bot cannot edit.github/workflowsfiles (its App token lacks theworkflowsscope), so a workflow change is never a bot commit.ci.json
pipx install uv==0.11.3when absent,uv sync --locked --extra dev --extra sqlite --extra codebase,CORTEX_MEMORY_STORE_BACKEND=sqlite CORTEX_RERANKER_OFFLINE=1 uv run --locked pytest --tb=short -q -p no:randomly --cov=mcp_server --cov-report=xmluv run --locked pytest ... tests_py/integrationbash scripts/docker_smoke.sh(the image is built in the job: a bare runner has none to skip)python3 -m venv "$CI_WORK/venv",pip install .,python -c "from mcp_server.doctor import run; raise SystemExit(run())"(cortex-doctor after install)python3 scripts/install_e2e/run.py --marketplace "$PWD" --work "$CI_WORK/install-e2e" --settle-seconds 1500on the three OSpyproject.tomlNo mutation run is referenced (owner rule 2026-10-22: mutation testing is scoped to the PR's files, never a whole-tree pass;
scripts/mutation_check.shstays out of the pipeline).Red cells on day one
unit: line coverage is 82 % (ci.ymlenforces--cov-fail-under=82), under the 90 % floor.installon Windows: the leg is new;scripts/install_e2ewas measured on linux and macOS only (ADR-1104).environmenton a bare runner installs the project's full dependency set with pip; the three legs have not run locally.pipeline.yml, so it gets no bot review (decision 2); it merges on green tests.Three pillars
Research pillar, done. Baseline reproduced locally on macOS arm64, 2026-10-22:
uv sync --lockedwith the dev, sqlite and codebase extras (uv 0.11.3, CPython 3.12 arm64,uv.lockunchanged);tests_py/integrationon SQLite: 29 passed, 4 skipped (PostgreSQL), 57.68 s. The full unit suite, the docker smoke (no docker on this host) and the install legs are left to this PR's own run.SSDLC pillar, done. Threat model: the review and fix jobs run only on same-repo, non-draft, non-Dependabot PRs; the fix step's tools are an explicit allowlist;
taguses the write-enabled deploy key; actions pinned by commit SHA; the contract step refuses an empty or unknown key;mergefails closed. SAST:actionlint. Cortex declares no local gate.Operations pillar, not applicable: no data is processed; the only secrets are the existing
CLAUDE_CODE_OAUTH_TOKENandRELEASE_TAG_SSH_KEY, read by the jobs that need them and no other.🤖 Generated with Claude Code
https://claude.ai/code/session_01BxsVCVscNG2Vb7fafCgqYR