Carlos Florêncio
55 lines
1.8 KiB
Markdown
55 lines
1.8 KiB
Markdown
---
|
|
status: active
|
|
system: ci
|
|
specification_version: 1
|
|
migration: in_progress
|
|
owners:
|
|
- kandev
|
|
---
|
|
|
|
# CI automation system
|
|
|
|
## Purpose
|
|
|
|
The CI automation system defines base-controlled GitHub Actions behavior for
|
|
contributor pull requests. It owns the trust gates for AI review, preview
|
|
deployment, and pull request walkthrough generation.
|
|
|
|
## Ownership
|
|
|
|
- Maintainer approval labels and their persistence rules.
|
|
- Direct contributor allowlist gates and their fail-closed behavior.
|
|
- Workflow event filters and job-level authorization expressions.
|
|
- Permissions and credential boundaries for review, preview, walkthrough, and
|
|
publication jobs.
|
|
- Workflow contract tests for these boundaries.
|
|
|
|
## Exclusions
|
|
|
|
- The review provider prompts and provider-specific agent behavior.
|
|
- The preview deployment command and its infrastructure.
|
|
- The walkthrough skill, renderer, and artifact format.
|
|
- Kandev application state or user-interface behavior.
|
|
|
|
## Specification map
|
|
|
|
### Requirements
|
|
|
|
- [Unified contributor PR automation](requirements/unified-contributor-pr-automation.md)
|
|
- [Contributor merge approval revocation](requirements/contributor-merge-approval-revocation.md)
|
|
- [Pull request size labels](requirements/pull-request-size-labels.md)
|
|
|
|
### System design
|
|
|
|
- [Unified contributor PR automation](system-design/unified-contributor-pr-automation.md)
|
|
- [Contributor merge approval revocation](system-design/contributor-merge-approval-revocation.md)
|
|
- [Pull request size labels](system-design/pull-request-size-labels.md)
|
|
|
|
## Migration
|
|
|
|
The new shared trust contract replaces the label portions of the
|
|
[Claude fork review allowlist requirement](../integrations/requirements/claude-fork-review-allowlist.md)
|
|
and the
|
|
[PR walkthrough requirement](../ui/requirements/pr-walkthrough.md). Provider
|
|
and walkthrough behavior remains in those canonical owning systems.
|