Skip to content

I0928 — A pull request cannot merge a deployment that would not work

Extend the existing verification workflow so that a pull request runs the deployment validation, the projection drift check, the production image build, the container smoke run, the resource policy assertions and the security checks.

BLOCKED wave 6 · p0 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Blocked. This issue cannot start until I0919, I0921, I0930 are done. The status is derived from that, not declared.

Objective

Extend the existing verification workflow so that a pull request runs the deployment validation, the projection drift check, the production image build, the container smoke run, the resource policy assertions and the security checks.

Why

The gate is where these checks stop being optional. Adding a separate workflow for deployment would fragment a verification story the repository has already unified once.

Current state

Two workflows exist: validation and pages. Neither knows anything about a deployment.

Desired state

One gate covers the deployment checks alongside everything else, uses the existing caching, and never deploys from a pull request.

Scope

  • .github/workflows/validate.yml

Out of scope

  • A second overlapping workflow file
  • Deploying to production from a pull request

Dependencies

What waits on this

Acceptance criteria

  • The pull request gate runs the tests, the deployment model validation, the projection drift check, the site build, the production image build, the container smoke run, the resource policy assertions and the security checks
  • No pull request path can deploy to production
  • Caching is used so the added checks do not make the gate unusable
  • The added checks belong to the existing verification hierarchy rather than an unconnected script

Validation

  • bash test/run.sh

Evidence required

  • pr_gate
  • gate_green

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A gate that takes an hour is a gate people bypass. The container build has to be cached well enough that the added time is proportionate.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0928.yaml. Read it back with majordomus plan show I0928.