CI/CD#
Workflow inventory for dominicusin.github.io. All checks must pass on main.
Required (branch protection)#
- 🧪 Build, validate, test, link-check (
quality.yml) — the only required status check. Lint + Hugo build + Jest + Playwright + link check.
Security#
| Workflow | Purpose | Blocking? |
|---|---|---|
security.yml | npm audit + Trivy + Semgrep | no |
security-scan.yml | CodeQL + Gitleaks | no |
dependency-review.yml | block PRs with new vulns | PR-only |
sbom.yml | generate SBOM + attest | no |
scorecard.yml | OpenSSF Scorecard | no (continue-on-error) |
license-check.yml | license allowlist | no |
Housekeeping / PR mgmt#
stale.yml— auto-close stale issues/PRslock-threads.yml— lock old threadslabeler.yml+labeler.ymlconfig — auto-label by pathpr-title-check.yml— Conventional Commits remindersize-label.yml— PR size label
Deploy#
hugo.yml— build + deploy to GitHub Pages (artifact attestation viaactions/attest@v4.2.2).deploy-dao.yml— DAO contract tests always run; deploy job skips whenDEPLOY_PRIVATE_KEY/SEPOLIA_RPC_URLsecrets are absent.fortify.yml— Fortify AST scan, skips without credentials.
Known external (not repo-owned)#
- Vercel, Snyk — third-party GitHub Apps failing on rate/test limits. Not fixable from this repo; disable in repo Settings → Integrations if unwanted.
- CircleCI — fixed via
.circleci/config.yml.