| 1 | # platform's CI on amadan |
| 2 | |
| 3 | `ci.d/` is this repo's gate, running on a self-hosted amadan runner. |
| 4 | **It is the only one.** `.github/workflows/ci.yml` was deleted on |
| 5 | 2026-08-24; nothing stands behind these three steps. A green run here |
| 6 | is the whole of what "green" means for this repo, and a red one is not |
| 7 | a discrepancy to reconcile against a more official run somewhere else. |
| 8 | |
| 9 | The workflow went for two reasons that arrived together. The steps here |
| 10 | had caught up with it and then gone past it — the last gap, `gofmt`, |
| 11 | closed by *widening*, so this gate is now strictly the tighter of the |
| 12 | two (see below). And GitHub Actions on the `carlosframework` account |
| 13 | had stopped starting jobs at all over billing, so the "required check" |
| 14 | had been gating nothing for some time before anyone removed it. The |
| 15 | evidence for the first half is the run on `cd47f38`, green on the real |
| 16 | arm64 worker with all four sections in the log: `=== gate ===` |
| 17 | including `gofmt -l .: clean`, `=== cross ===` with all five targets, |
| 18 | and `=== minio-contract ===` with `--- PASS: TestDeliveredContractMinio` |
| 19 | and its five subtests. |
| 20 | |
| 21 | ## Where each step came from |
| 22 | |
| 23 | This table is provenance, not a checklist against a live file. Every |
| 24 | step here is shaped the way it is because of the job it descends from, |
| 25 | and dropping that history makes the scripts read as arbitrary choices |
| 26 | rather than as ported ones. The left column names a job in a file that |
| 27 | no longer exists. |
| 28 | |
| 29 | | descended from | here | | |
| 30 | |---|---|---| |
| 31 | | `gate` | `10-gate` | build · vet · `go test ./... -count=1` | |
| 32 | | `cross` | `20-cross@5` | one target per shard, all five | |
| 33 | | `minio-contract` | `30-minio-contract` | MinIO on loopback, no container | |
| 34 | | `gofmt` | `10-gate` | repo-wide, via `make test` — see below | |
| 35 | |
| 36 | ## `gofmt`: ported by widening it, not by reproducing it |
| 37 | |
| 38 | This section is the reason it was safe to delete the workflow, so it is |
| 39 | worth keeping even now that the comparison is with a dead file. The |
| 40 | whole risk in a `ci.d/` that covers *less* than what it replaces is |
| 41 | that it invites people to read a green run as meaning more than it |
| 42 | does — and that risk did not end when the other gate did. It moved: |
| 43 | there is nothing left to compare against, so a gap here is now a gap |
| 44 | full stop. This file is the check on that, and it has to stay true. |
| 45 | |
| 46 | **`gofmt`** was the last gap, and it closed by widening rather than by |
| 47 | imitation. The workflow checked only the files a PR changed, because it |
| 48 | needed a **base SHA** — a GitHub concept. amadan CI hands a job its |
| 49 | commit and its branch and has no notion of what it is a pull request |
| 50 | against, so that job could not be reproduced faithfully here. |
| 51 | |
| 52 | It did not need to be. The scoping existed to protect three |
| 53 | pre-existing unformatted files, and those are gone: `gofmt -l .` over |
| 54 | the whole tree is clean today. So `10-gate` runs `make test`, whose |
| 55 | recipe already contains a **repo-wide** gofmt check — strictly stronger |
| 56 | than the job it replaced, and one definition shared with what a |
| 57 | developer runs locally rather than a second list that can drift. |
| 58 | |
| 59 | The rule that survives from the old scoping is the one worth keeping: |
| 60 | if a repo-wide check ever starts failing on arrival, fix the tree |
| 61 | rather than narrowing the check, because a gate people learn to ignore |
| 62 | is not a gate. |
| 63 | |
| 64 | ## `minio-contract`, and why it turned out to be portable |
| 65 | |
| 66 | It was listed here as impossible: it started MinIO in Docker, and amadan |
| 67 | jobs get no container runtime. That conflated the job with its |
| 68 | packaging. MinIO and `mc` are single static Go binaries, and |
| 69 | `TestDeliveredContractMinio` only wants an endpoint and credentials over |
| 70 | HTTP — it has no opinion about what is serving. So `30-minio-contract` |
| 71 | downloads both binaries at pinned versions, verifies them against pinned |
| 72 | sha256 digests, and runs the server on loopback inside the job's |
| 73 | existing bubblewrap sandbox. Nothing persists on the box. |
| 74 | |
| 75 | The test **skips itself** unless `CARLOS_MINIO_TEST=1`, and a skipped |
| 76 | test exits 0. The step therefore requires the parent's `--- PASS:` line |
| 77 | to appear in the output and fails without it, so a dropped env var |
| 78 | cannot turn this into a green step that exercised nothing. |
| 79 | |
amadan