# CI/CD

Workflow inventory for `dominicusin.github.io`. All checks must pass on `main`.

## Required (branch protection)

- **🧪 Build, validate, test, link-check** (`quality.yml`) — the only
  *required* status check. Lint + Hugo build + Jest + Playwright + link check.

## Security

| Workflow | Purpose | Blocking? |
|----------|---------|-----------|
| `security.yml` | npm audit + Trivy + Semgrep | no |
| `security-scan.yml` | CodeQL + Gitleaks | no |
| `dependency-review.yml` | block PRs with new vulns | PR-only |
| `sbom.yml` | generate SBOM + attest | no |
| `scorecard.yml` | OpenSSF Scorecard | no (continue-on-error) |
| `license-check.yml` | license allowlist | no |

## Housekeeping / PR mgmt

- `stale.yml` — auto-close stale issues/PRs
- `lock-threads.yml` — lock old threads
- `labeler.yml` + `labeler.yml` config — auto-label by path
- `pr-title-check.yml` — Conventional Commits reminder
- `size-label.yml` — PR size label

## Deploy

- `hugo.yml` — build + deploy to GitHub Pages (artifact attestation via
  `actions/attest@v4.2.2`).
- `deploy-dao.yml` — DAO contract **tests** always run; **deploy** job
  *skips* when `DEPLOY_PRIVATE_KEY` / `SEPOLIA_RPC_URL` secrets are absent.
- `fortify.yml` — Fortify AST scan, *skips* without credentials.

## Known external (not repo-owned)

- **Vercel**, **Snyk** — third-party GitHub Apps failing on rate/test limits.
  Not fixable from this repo; disable in repo Settings → Integrations if unwanted.
- **CircleCI** — fixed via `.circleci/config.yml`.