Repository navigation

CI CD

Jump to bottom

Domini Montessori edited this page Aug 20, 2026 · 1 revision

CI/CD

Workflow inventory for dominicusin.github.io. All checks must pass on main.

Required (branch protection)

🧪 Build, validate, test, link-check (quality.yml) — the only required status check. Lint + Hugo build + Jest + Playwright + link check.

Security

Workflow	Purpose	Blocking?
`security.yml`	npm audit + Trivy + Semgrep	no
`security-scan.yml`	CodeQL + Gitleaks	no
`dependency-review.yml`	block PRs with new vulns	PR-only
`sbom.yml`	generate SBOM + attest	no
`scorecard.yml`	OpenSSF Scorecard	no (continue-on-error)
`license-check.yml`	license allowlist	no

Housekeeping / PR mgmt

stale.yml — auto-close stale issues/PRs
lock-threads.yml — lock old threads
labeler.yml + labeler.yml config — auto-label by path
pr-title-check.yml — Conventional Commits reminder
size-label.yml — PR size label

Deploy

hugo.yml — build + deploy to GitHub Pages (artifact attestation via actions/attest@v4.2.2).
deploy-dao.yml — DAO contract tests always run; deploy job skips when DEPLOY_PRIVATE_KEY / SEPOLIA_RPC_URL secrets are absent.
fortify.yml — Fortify AST scan, skips without credentials.

Known external (not repo-owned)

Vercel, Snyk — third-party GitHub Apps failing on rate/test limits. Not fixable from this repo; disable in repo Settings → Integrations if unwanted.
CircleCI — fixed via .circleci/config.yml.