ALL-CI0001 · continuous_integration
Assess whether continuous integration enforces required gates.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Inspect workflow triggers, required tasks, supported runtimes, dependency locking, cancellation, permissions, and branch protection from the selected in-memory fact provider. The engine skips the rule when no provider can build this family because missing evidence does not prove that the repository has no continuous integration.
Evidence
Section titled “Evidence”Findings retain workflows, triggers, commands, environments, and missing gates.
Exceptions
Section titled “Exceptions”A pre-release prototype can accept partial automation through explicit project policy. An
Explicit evidence with no gates classifies CI as absent. No evidence leaves the rule
unassessed. required_tasks names the gates a change has to pass, defaulting to lint,
typecheck, and test, so a project that spells its gates differently states its own.
Examples
Section titled “Examples”A pull request workflow running lint, types, and tests is complete for those gates. A
manually triggered test workflow is partial protection.
References
Section titled “References”- Cites “Software Engineering at Google”, Continuous Integration
- Cites “GitHub Actions documentation”
- Cites “OpenSSF Scorecard”, CI tests