Pin the CI/CD shape with an explicit two-level structure, anticipating
the GitLab migration on the 6-18-month horizon:
Level 1 - vendor-neutral, survives the migration:
- Trunk-based with short-lived feature branches; squash-merge only.
- Branch protection on main: no direct push, no force push, linear
history, required green CI, required reviewers = 0 in v1 (raised to
>=1 when a second contributor joins), branch deletion after merge.
- Required CI gates (all blocking): format, lint, type-check, test,
build (nx affected), audit (pnpm + Trivy), secret-scan (gitleaks),
commit-lint (Conventional Commits on the PR commit range). Future
a11y and perf gates land with their respective ADRs.
- Conventional Commits validated locally (hook from ADR-0007) and in
CI as defense in depth.
- Signed commits recommended but not required in v1; revisited at the
GitLab migration.
- Thin YAML: all orchestration logic lives in package.json scripts
(ci:check, ci:scan, ci:commits) and Nx targets. Workflow files only
do checkout, setup, cache, and call one script per job. The migration
rewrites the YAML wrappers, never the gates.
- Secrets convention SCOPE_PURPOSE; gitleaks enforces no-secrets-in-code.
- Container images / deploy explicitly out of scope (deferred to the
on-prem infrastructure ADR).
Level 2 - Gitea Actions specific, will be superseded by a GitLab
migration ADR:
- Engine: Gitea Actions (built-in, GitHub Actions-compatible syntax,
partial portability hedge if the org pivots to GitHub).
- Runners: >=3 self-hosted act_runner instances on-prem, Debian image
pinned by SHA, weekly rebuild via security-scheduled.yml.
- Three workflow files: ci.yml (PR + push to main), release.yml
(stub for tag, populated by the deploy ADR), security-scheduled.yml
(weekly Trivy + gitleaks full-tree scan + Renovate trigger).
Migration weight estimated at 3-5 days dev/ops when GitLab arrives:
the YAML is rewritten, the gates and scripts are unchanged. A future
ADR will explicitly supersede only the level-2 sections.
decisions/README.md index updated. CLAUDE.md gains an explicit 'CI/CD'
line pointing to ADR-0015 and noting the future GitLab supersession.
Julien Gautier