CI/CD and GitHub Actions, 8 of 26
There is no badge.
Here is the run.
A badge needs a public repository. This one holds client work, so it stays private, and a screenshot of a green tick proves nothing at all.
So the run posts what it did. Every push checks the types, runs the offline suites and runs the Python service tests, then sends the commit, the jobs and the counts here.
fix(container): say none, not null
feat(proof): the container, and the limits read back off it
fix(qc): wait for the answer, not for a stopwatch
feat(proof): fifty-one skills, counted off disk, with one of them running
docs: the queue stops carrying a score that goes stale
fix(ci): say that the number is a duration
fix(ci): let the report read its own run, and stop trusting gh's stdout
fix(ci): give tsc a heap it fits in, and stop running actions on a dead node
Four decisions
No check needs a credential
Every job runs offline. The TypeScript suites work on values built inside the test, and the Python suites build their own PDFs. A pipeline that needs production keys is one leaked log away from an incident, and it also stops anybody else from running it. The only secret in the file belongs to the last job, which reports the result and checks nothing.
The numbers come from the run
The count of assertions is read out of the output and posted with the result. Writing "229 assertions" into the workflow file would be true the day it was typed and quietly wrong afterwards, which is the whole failure this site keeps a ledger to prevent.
A failure is posted as loudly as a pass
The reporting job carries if: always(), so it still runs when a check fails. Without that it is skipped on failure and this page only ever shows green, which is worse than having no page. Then it re-fails itself, because a workflow whose last job succeeded reports success no matter what happened above it.
The audit against the live site runs on its own schedule
It reads production, so on a pull request it would fail for reasons the branch cannot control, and a check like that is one people learn to click past. It runs daily instead, and what it catches is a page that used to prove something and stopped.
What this pipeline does not do
It does not run the Next.js build, because the build reads environment variables the workflow does not hold. That is a real gap. A route file exporting something Next does not allow passes the type check and fails the build, and it has happened here twice.
Deployment is Vercel on push, so the pipeline does not own it. What the checks buy is the answer to a smaller question: did the logic still work before it went out.
The endpoint returns the same runs as JSON. What broke is the longer version of what these tests exist to catch. The whole list is 41 requirements from 114 job posts, with the gaps at the same size as the wins.