Skip to content

ci-and-quality-gates.md

Latest commit

 

History

History
61 lines (47 loc) · 2.55 KB

ci-and-quality-gates.md

File metadata and controls

61 lines (47 loc) · 2.55 KB
Raw

CI and Quality Gates

The repository ships with a small set of automated quality gates. They run locally and on CI via .github/workflows/audit.yml.

What the gates check

Gate Tool Pass condition
Secret scan tools/audit_workflows.py summary.possibleSecretFindings == 0
JSON sanity tools/audit_workflows.py summary.invalidJsonFiles == 0
Generated pack structural validity tools/validate_generated_pack.py All checks pass; ≥ 400 valid workflows
Unified catalog builds tools/build_unified_catalog.py Exits 0; outputs catalog/unified-workflows.index.json
Schema + catalog validation tools/validate_schemas.py All schemas parse; catalog entries and IR sample validate

The CI job runs each tool in order and fails the build if any of them exits non-zero or if the audit summary contains a non-zero possibleSecretFindings or invalidJsonFiles value.

What the gates do not do

  • They do not import any workflow into n8n.
  • They do not execute any workflow.
  • They do not modify workflow files.
  • They do not auto-apply repair proposals — proposals are emitted to reports/repair-proposals.json for human review and stop there.

These constraints are deliberate. Behavioural validation requires a sandbox environment with non-production credentials; it lives outside the CI gates.

How to run locally

python tools/audit_workflows.py
python tools/validate_generated_pack.py
python tools/build_unified_catalog.py
python tools/validate_schemas.py
python tools/analyze_duplicates.py
python tools/propose_repairs.py
python tools/build_wiki_seed.py

The five remaining tools (search_workflows.py, prompt_to_ir.py, sanitize_secrets.py, triage_secrets.py, generate_expansion_pack.py) are maintainer utilities and are not part of the CI gate set.

Dependencies

All tools use only the Python standard library. tools/validate_schemas.py will use the third-party jsonschema library if it is installed, and falls back to a lightweight required-field / enum check otherwise. The CI job does not install jsonschema; the gates pass in lightweight mode.

Why this gate set

The aim is to make every PR boring. A PR that passes the gates does not have an embedded secret, does not introduce invalid JSON, does not break the generated pack, and does not silently rewrite catalog or schema files. It can still contain workflows that fail when imported — that is a different question, addressed by the manual review process in docs/generated-workflows.md.