CI/CD and Quality Gates

The BitzOrcas pipeline is implemented; it is no longer a future plan. It has two independent evidence chains. Regular CI decides whether source code meets merge and release-candidate standards. Commercial GA decides whether one immutable commercial release batch is safe to deliver.

Critical path diagram

Follow the main path to identify responsibility handoffs, then use the prose to inspect failure branches and evidence.

Five regular CI job groups

Fast gate

The Fast gate catches frequent, reproducible failures first:

Gitleaks
  → restore
  → format --verify-no-changes + IDE0005 unused-usings zeroed
  → OpenAPI drift check (check-openapi-drift.sh)
  → Release build
  → non-Integration tests
  → local PackageReference Consumer Contract
  → XML file and XML documentation checks

The Consumer Contract runs separately because it packs candidate NuGet packages, creates a temporary feed and isolated caches, and then restores, builds, tests, and trim-publishes an external project. It proves that packages are consumable; it does not prove that they have been formally released.

Release candidate

This job verifies canonical template combinations and upgrade behavior, then runs Category!=Docker integration tests. It stays off pull requests to avoid repeating the heavier template matrix during every review. Main pushes, manual runs, and nightly runs provide this evidence.

Publish trim

The trim job restores assets and runs -p:PublishTrimmed=true publish across the linux-x64, win-x64, and osx-arm64 matrix.

Docker contracts

Real-infrastructure contracts are split into thirteen shards inside docker-integration-contracts.yml: shared-port-a/b/c/d, shared-repository, shared-readmodel-queryshape, shared-generic, website, webhooks, messaging, authorization-capacity, core, and workflow. The workflow is invoked by release flows or nightly schedules rather than on every main push.

What Commercial GA verifies

Commercial GA is manual-only. It checks out the commit recorded by provenance, downloads an immutable artifact from a trusted release workflow, and verifies that:

1. package IDs and versions match the commercial catalog;
2. package SHA-256 values, Git commit, and provenance agree;
3. dotnet nuget verify --all accepts signatures and trusted timestamps;
4. signer fingerprints exactly match the controlled set;
5. the SBOM covers release packages and dependencies;
6. vulnerability and third-party license policies pass;
7. an external Consumer restores from the authenticated HTTPS feed with short-lived read-only credentials, then builds, tests, and publishes with empty caches.

Missing inputs produce external prerequisite unavailable and fail the gate. The workflow never repacks vendor source and never substitutes a local feed for the production feed.

Reproduce locally

Quality-gate entrypoints live in scripts/build/. GitHub Actions workflows live in .github/workflows/. The systemd Jenkinsfiles used by customer hosts live at repo-root ci/ and must not be folded into scripts/. Those check scripts are bash-first and run on Linux CI or Git Bash / WSL; they have no PowerShell counterparts.

Run the full local merge gate with:

scripts/build/verify-all.sh

For workflow or build-script changes, start with the focused contract:

# ① Run from the repository root; each command is an independently verifiable step.
dotnet test tests/BitzOrcas.Architecture.Tests \
  --configuration Release \
  --filter "FullyQualifiedName~CiQualityGateTests"

git diff --check

Check whether Commercial GA inputs exist:

scripts/build/verify-commercial-ga.sh --check-prerequisites

Common failures

See also

• Testing strategy
• Commercial delivery overview
• Production checklist