CI/CD
Quality Gates
Required and optional checks before merge
Required Checks (Before Merge)
These checks must pass on every PR targeting Trunk:
| Check | Command | Blocks PR |
|---|---|---|
| Rust formatting | cargo fmt --all -- --check | Yes |
| Rust linting | cargo clippy -p exfil-analysis -p exfil-server -p exfil-certs-gen -- -D warnings | Yes |
| Analysis + Server tests | cargo test -p exfil-analysis -p exfil-server | Yes |
| Agent + Server tests (Windows) | cargo test -p exfil-server -p exfil-agent (Windows) | Yes |
| Analysis + Server build | cargo build -p exfil-analysis -p exfil-server -p exfil-certs-gen | Yes |
| Frontend lint | bun run check | Yes |
| Frontend types | bun run typecheck | Yes |
| Frontend build | bun run build | Yes |
Optional Checks
| Check | Command | Purpose |
|---|---|---|
| Benchmarks | cargo bench --workspace | Performance regression tracking |
| Security audit | cargo audit | Dependency vulnerability scan |
| Docs build | cd docs-site && bun run build | Documentation integrity |
Git Hooks
Set up a pre-commit hook to catch issues locally:
# .git/hooks/pre-commit
#!/bin/bash
set -e
echo "Running pre-commit checks..."
# Rust
cargo fmt --all -- --check
cargo clippy --workspace -- -D warnings
# Frontend
cd desktop && bun run check && bun run typecheckMake it executable:
chmod +x .git/hooks/pre-commitBranch Protection
Configure on GitHub under Settings > Branches > Trunk:
- Require pull request reviews before merging
- Require status checks to pass (
lint-rust,lint-frontend,test-analysis,test-server) - Require branches to be up-to-date before merging
- Do not allow force pushes