# platform's CI on amadan

`ci.d/` is this repo's gate, running on a self-hosted amadan runner.
**It is the only one.** `.github/workflows/ci.yml` was deleted on
2026-08-24; nothing stands behind these three steps. A green run here
is the whole of what "green" means for this repo, and a red one is not
a discrepancy to reconcile against a more official run somewhere else.

The workflow went for two reasons that arrived together. The steps here
had caught up with it and then gone past it — the last gap, `gofmt`,
closed by *widening*, so this gate is now strictly the tighter of the
two (see below). And GitHub Actions on the `carlosframework` account
had stopped starting jobs at all over billing, so the "required check"
had been gating nothing for some time before anyone removed it. The
evidence for the first half is the run on `cd47f38`, green on the real
arm64 worker with all four sections in the log: `=== gate ===`
including `gofmt -l .: clean`, `=== cross ===` with all five targets,
and `=== minio-contract ===` with `--- PASS: TestDeliveredContractMinio`
and its five subtests.

## Where each step came from

This table is provenance, not a checklist against a live file. Every
step here is shaped the way it is because of the job it descends from,
and dropping that history makes the scripts read as arbitrary choices
rather than as ported ones. The left column names a job in a file that
no longer exists.

| descended from | here | |
|---|---|---|
| `gate` | `10-gate` | build · vet · `go test ./... -count=1` |
| `cross` | `20-cross@5` | one target per shard, all five |
| `minio-contract` | `30-minio-contract` | MinIO on loopback, no container |
| `gofmt` | `10-gate` | repo-wide, via `make test` — see below |

## `gofmt`: ported by widening it, not by reproducing it

This section is the reason it was safe to delete the workflow, so it is
worth keeping even now that the comparison is with a dead file. The
whole risk in a `ci.d/` that covers *less* than what it replaces is
that it invites people to read a green run as meaning more than it
does — and that risk did not end when the other gate did. It moved:
there is nothing left to compare against, so a gap here is now a gap
full stop. This file is the check on that, and it has to stay true.

**`gofmt`** was the last gap, and it closed by widening rather than by
imitation. The workflow checked only the files a PR changed, because it
needed a **base SHA** — a GitHub concept. amadan CI hands a job its
commit and its branch and has no notion of what it is a pull request
against, so that job could not be reproduced faithfully here.

It did not need to be. The scoping existed to protect three
pre-existing unformatted files, and those are gone: `gofmt -l .` over
the whole tree is clean today. So `10-gate` runs `make test`, whose
recipe already contains a **repo-wide** gofmt check — strictly stronger
than the job it replaced, and one definition shared with what a
developer runs locally rather than a second list that can drift.

The rule that survives from the old scoping is the one worth keeping:
if a repo-wide check ever starts failing on arrival, fix the tree
rather than narrowing the check, because a gate people learn to ignore
is not a gate.

## `minio-contract`, and why it turned out to be portable

It was listed here as impossible: it started MinIO in Docker, and amadan
jobs get no container runtime. That conflated the job with its
packaging. MinIO and `mc` are single static Go binaries, and
`TestDeliveredContractMinio` only wants an endpoint and credentials over
HTTP — it has no opinion about what is serving. So `30-minio-contract`
downloads both binaries at pinned versions, verifies them against pinned
sha256 digests, and runs the server on loopback inside the job's
existing bubblewrap sandbox. Nothing persists on the box.

The test **skips itself** unless `CARLOS_MINIO_TEST=1`, and a skipped
test exits 0. The step therefore requires the parent's `--- PASS:` line
to appear in the output and fails without it, so a dropped env var
cannot turn this into a green step that exercised nothing.