safe-global / safe-client-gateway / 35708126183

89%

push

github

ci: Extract the quality gate into a reusable workflow (#3472)

Pull requests now enter through pull-request.yml, which calls _ci-node.yml.
ci.yml calls the same reusable for its own gating, so there is one definition of the quality gate with two entry points instead of a copy per event.

The jobs themselves are unchanged in substance — license-headers, env-validation, biome plus tsc --noEmit, unit and integration tests with their redis/postgres/rabbitmq services, and the parallel Coveralls reporting. What changed around them: the Node and Python versions and the checkout ref are inputs, and callers pass `secrets: inherit` so the job bodies keep reading SAFE_CONFIG_BASE_URI as they did.

ci.yml keeps docker-publish-staging, docker-publish-release and autodeploy, now gated on the reusable instead of on two of its own jobs. Nothing about building or deploying changes here; this is the PR gate only. It is the first of four PRs, so that removing the repo's only CI is not one 978-line change.

REQUIRED CHECKS MUST BE RENAMED WHEN THIS MERGES. Branch protection requires "tests (test:cov)", "tests-finish" and "biome". Called through a reusable those become "ci / tests (test:cov)", "ci / tests-finish" and "ci / biome". A required check that no longer reports is never satisfied, so every open PR in the repo blocks until branch protection is updated — not just this one.

pull-request.yml carries its own concurrency group. ci.yml used to cancel superseded PR runs through its group; without this, rapid pushes to a PR would pile up runners instead.

Three guides described ci.yml's jobs by name and are updated here. The billing README's arm64 link stays pointing at ci.yml, which still holds the build jobs until the next PR.

Refs: WA-3407, WA-3420, WA-3421, WA-3424

4354 of 5125 branches covered (84.96%)

Branch coverage included in aggregate %.

11060 of 12163 relevant lines covered (90.93%)

539.01 hits per line