# CI pipeline target

Codex must implement CI-equivalent commands locally even when no hosted CI is connected.

Recommended stages:

1. repository/planning validation;
2. formatting;
3. lint/static analysis;
4. generated contract drift;
5. wiring/reachability gate (`python tools/check_wiring.py`): every production package must have at least one non-test importer reachable from a binary (`cmd/api`, `cmd/worker`, `cmd/agent`, `cmd/migrate`), or be listed in `tools/wiring_allowlist.json` with a reason and a tracking task id; a task may not be marked done while its deliverable is unreachable;
6. frontend type/unit (`pnpm test` runs Vitest + Testing Library, including ADR-0008 status invariants);
7. Go unit/race where suitable;
8. integration with PostgreSQL/fake sources;
9. frontend build;
10. API/OpenAPI/schema compatibility;
11. Playwright smoke (`pnpm test:e2e`, desktop/mobile/wallboard Chromium projects);
12. accessibility (axe-core in the Playwright smoke; serious or critical violations fail);
13. dependency/license/secret scan;
14. container build and image scan;
15. compose/config validation;
16. evidence summary.

The executable Gitea Actions definition is `.gitea/workflows/ci.yml`. The local
equivalent is `scripts/verify.ps1`; install Chromium once with
`pnpm exec playwright install chromium` before its browser stage. Browser tests
mock only the versioned API boundary and exercise the real built React routes.

Release pipeline additionally:
- clean checkout;
- full E2E;
- performance subset;
- migration/backup/restore;
- SBOM/provenance where feasible;
- immutable image digest record;
- deployment smoke and rollback proof.