Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

chore: harden repository guardrails
CI / verify (push) Has been cancelled
Details
CI / infrastructure-smoke (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ekklesia
2026-07-12 21:20:58 -05:00
parent 192a6514cf
commit d9489384c1
100 changed files with 1303 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/development/repository-workflow.md
+18 -3
View File
@@ -24,7 +24,12 @@ pnpm build # Turborepo package build graph
pnpm verify # every code gate above
```
CI runs `pnpm ci`, which adds Compose configuration validation to `pnpm verify`.
The lint, typecheck, and test commands run both repository-root checks and every matching
package-level Turborepo task. New packages add their own `lint`, `typecheck`, and `test` scripts;
the root verification command discovers them automatically.
CI runs `pnpm ci`, which adds Compose configuration validation to `pnpm verify`. A separate CI job
runs the live infrastructure smoke test so code-only local verification does not require Docker.
## Development infrastructure
@@ -42,6 +47,16 @@ pnpm infrastructure:down
pnpm infrastructure:logs
```
Exercise both services with isolated, throwaway credentials and Docker-assigned host ports:
```bash
pnpm infrastructure:smoke
```
The smoke test verifies PostgreSQL password authentication and authenticated S3 list, put, get,
head, and delete operations. It also proves invalid database passwords, anonymous object access,
and invalid S3 signatures are rejected. Its containers, network, and volumes are removed on exit.
PostgreSQL and the S3 endpoint bind to `127.0.0.1` only. Compose uses persistent named volumes;
`infrastructure:down` preserves data. The S3 service creates the configured development bucket
idempotently at startup.
@@ -49,5 +64,5 @@ idempotently at startup.
The checked-in credentials are safe only for local development. Deployed secrets must come from
an environment-appropriate secret provider and must not be committed.
Docker is not installed in every contributor environment. `pnpm infrastructure:config` and live
service health therefore run separately from the code-only `pnpm verify` gate.
Docker is not installed in every contributor environment. Compose validation and live service
health therefore run separately from the code-only `pnpm verify` gate.