From a pull request to an image in a cluster

From a pull request to an image in a cluster A workflow diagram generated by Archify. 01 / Developer 02 / ci.yml · job check 03 / Makefile 04 / main · repository owner → release.yml → the private application · deploy Pull request · or push to main · Developer · platformkit Pull request or push to main platformkit fix and push · a push re-runs ci.yml · Developer fix and push a push re-runs ci.yml ci.yml check · Postgres · NATS · ci.yml · job check · platformkit_app role ci.yml check Postgres · NATS platformkit_app role Budgets · only ratchet down · ci.yml · job check · gate Budgets only ratchet down gate govulncheck · Go vuln database · ci.yml · job check · gate govulncheck Go vuln database gate Native design · conformance: npm test · ci.yml · job check · designexport/openpencil Native design conformance: npm test designexport/openpencil make check · build · vet · fmt-check · test · Makefile · check-loc · check-packages · check-gucs make check build · vet · fmt-check · test check-loc · check-packages · check-gucs make e2e · scripts/e2e.sh · Makefile · Playwright journeys make e2e scripts/e2e.sh Playwright journeys merge → tag v* · locbudget --write first · main · repository owner → release.yml → the private application · deploy · ceilings re-ratcheted merge → tag v* locbudget --write first ceilings re-ratcheted job check · the tag is on main · main · repository owner → release.yml → the private application · deploy · same gates, tagged tree job check the tag is on main same gates, tagged tree job release · ghcr.io/septagon-oss/platformkit · main · repository owner → release.yml → the private application · deploy · SBOM · GitHub release job release ghcr.io/septagon-oss/platformkit SBOM · GitHub release private app · image · chart · deploy · main · repository owner → release.yml → the private application · deploy · cluster state: environments private app image · chart · deploy cluster state: environments triggers all green needs: check go.mod pin a gate fails new push Legend User UI Agent logic Policy Cloud service

A build is not a deployment

  • • A successful build is not a deployed service: the image digest and the receiving environment are verified separately.
  • • latest moves only for a non-prerelease; the private application pins the published version and deploys its chart from cluster state

What a check proves

  • • A type check proves types, a test its cases, a journey its observed outcome; none alone proves production readiness.
  • • make check: real Postgres + NATS with JetStream; make e2e: e2e/admin-tasks.spec.ts; locbudget --write --round 100 before a tag