Quality Gates

Ironloom preserves strict validation through Cargo formatting, Clippy, tests, dependency policy, vulnerability audit, schemas, documentation build, Docker build, Helm render, and SonarCloud analysis.

Local Gates

cargo fmt --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-features
cargo run -p ironloom-schemas -- --check
cargo deny check
cargo audit
just scripts-test
npm run docs:build
helm lint deploy/helm/ironloom
helm template ironloom deploy/helm/ironloom

Recipe Shortcuts

just proof builds the runtime image, starts the local container, submits setup values, and generates a complete proof app.
just k3s-acceptance starts a disposable k3s container, installs the Helm chart, verifies signed Discord intake, and proves the PVC-backed artifact index survives a pod restart.
just discord-endpoint-acceptance uses a real Discord application to validate a public Interactions Endpoint URL through Discord's signed validation PING.
just external-probe uses real bound runtime credentials to read GitHub source-of-truth repository state and poll SonarCloud quality and issue state.
just gates runs the common local gates for format, Clippy, tests, schemas, SonarCloud bootstrap script behavior, docs, Helm, dependency policy, and vulnerability audit.
just setup-url prints the local setup URL and installer token for manual browser validation.

Publishing Gates

Docker Buildx builds docker/ironloom-runtime/Dockerfile.
Helm publishes deploy/helm/ironloom as an OCI chart.
GitHub Pages publishes the VitePress public site.
SonarCloud receives Rust LCOV coverage from cargo llvm-cov and a generated Clippy JSON report from the same lint command enforced by CI.
Docs-site files are analyzed by SonarCloud but excluded from coverage accounting so Rust LCOV remains the quality gate signal.
After the SonarCloud scan, CI waits for the scanner compute-engine task and prints the authenticated quality gate status and each condition to the workflow log.
CI verifies the vannadii_ironloom SonarCloud project before scanning, creates it when SonarCloud returns 404, and aligns the SonarCloud main branch with the GitHub default branch. If a stale non-main branch with the target name already exists, CI deletes that branch before renaming the SonarCloud main branch and verifies the result.
If SonarCloud returns NONE because no project quality gate is associated, CI enforces the organization default gate against authenticated project measures and fails closed on missing or violating measures.
The runtime external probe uses the same organization default gate fallback when SonarCloud returns NONE, so live probes report passed or failed instead of leaving the quality gate pending.
The SONAR_TOKEN secret must be able to create/read the project, manage the main branch, submit analysis, read the quality gate, read organization quality gates, and read project measures; it does not need permission to modify quality gates.

Contributors

Vanna DiCatania

Changelog

Last edited 1 day ago

View full history

Quality Gates ​

Local Gates ​

Recipe Shortcuts ​

Publishing Gates ​