CI/CD

Every INVA repo runs GitHub Actions on push and pull request. CI is the enforcement layer for the coding standards; nothing merges red.

The gate set

Gate	Tool	Applies to
Docs build	mkdocs build --strict	any repo with a wiki (broken links/nav fail)
Secret scan	gitleaks	all repos (full history on PRs)
Markdown lint	markdownlint-cli2	all repos
Lint + format	ruff / eslint + prettier	code repos
Types	mypy / tsc --noEmit	code repos
Tests + coverage	unittest/pytest + coverage, vitest	code repos
IaC	ansible-lint, tofu fmt -check/validate, shellcheck	inva-infrastructure

Action versions are pinned and reviewed. Jobs run with least-privilege permissions: — read-only by default, widened per job only where a step needs it (e.g. the secret-scan summary).

Local parity

make check mirrors CI exactly, and .pre-commit-config.yaml runs the fast gates before a commit is even created. A contributor should never discover a lint/type failure only in CI.

Publication (gated)

Documentation publishing (e.g. eng.inva.is behind Cloudflare Access) and any website deploy are separate, approval-gated steps — a green build never auto-publishes to a production surface. Deploys to managed hosts flow through Ansible over WireGuard and are permission-gated (P3); see the Operations runbooks.