VayuPress CI Governance

Version: 1.0.0 (Prompt 10 — Automated Governance)
Pipeline: GitHub Actions
Gate job: ci-pass (all checks must pass to merge)

Philosophy

Every constraint in the VayuPress Governance Constitution v6.0 that can be mechanically verified must be verified in CI. No human reviewer is required to catch what a machine can catch.

CI is the enforcement layer of the Constitution. Maintainers cannot override CI for merges to main.

Workflows

ci.yml — Primary CI

Runs on every push and pull request to main.

security.yml — Security Enforcement (Prompt 9)

Runs on push to main, PRs to main, and weekly on Monday 02:00 UTC.

Required Checks (Branch Protection)

The following checks must pass before merging to main:

1. CI Pass — All Checks (from ci.yml ci-pass job)
2. Security Pass — All Checks (from security.yml security-pass job)

These are enforced via GitHub branch rulesets. See CONTRIBUTING.md for setup.

Constraint Budgets

These limits are enforced in CI or smoke tests:

Adding a New CI Check

1. Add the check as a new job in .github/workflows/ci.yml or security.yml
2. Add the job name to the needs: list in the relevant gate job (ci-pass or security-pass)
3. Add an entry to this document
4. Update Makefile with a local equivalent target
5. Open an ADR if the check enforces a new architectural constraint

Do NOT add advisory-only jobs to the gate's needs: list.

Local CI Equivalents

All CI checks can be run locally via make:

make check-docs       # verify all required docs exist
make lint             # golangci-lint
make vuln             # govulncheck
make test-race        # go test -race ./...
make check-size       # binary + JS size budgets
make check-governance # grep Constitution for all 12 Prompts
make check-ethics     # grep ETHICS.md for charter sections
make check-security   # grep SECURITY.md for required sections
make bench            # performance benchmarks

Run make (no target) to see all available targets.

Governance Enforcement Matrix

This table maps each Constitution Prompt to its CI enforcement:

CI Failure Response

When CI fails:

1. Read the failure log — every job emits ✅/❌ per item
2. Fix the root cause — do not suppress the check
3. If the check is wrong: open an issue, propose amendment via PR to .github/workflows/ci.yml with justification — requires BDFL approval
4. Never merge with failing required checks — branch protection enforces this

Bypassing CI requires BDFL + Security Lead + Architecture Lead consensus and is documented in the audit log.