ci: mutation-testing gate via flawd, report-only while it soaks - #66
Merged
Conversation
Diff-scoped 'flawd ci' on pull requests and a weekly full-depth audit on main, with SARIF into code scanning and the full report as an artifact. Threshold is 0: this is a dogfooding gate being soaked in public before any enforcement — reds here are findings, not blockers, until the score history earns a real threshold. Runners use flawd.ci.toml (same scope and budgets as flawd.toml; native execution backend, the documented hosted-runner setup — an ephemeral VM gains nothing from a per-run Docker image build). Fork PRs are skipped with an explanatory notice because repository secrets are unavailable to them. flawd is installed from the public release mirror with checksum verification and activated from a repo secret.
…iff pass The next flawd release emits a valid empty SARIF on that path; the guard stays harmless after the version bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands the mutation-testing workflow: diff-scoped
flawd cion PRs, weekly full-depth audit on main, SARIF → code scanning, report artifact. Threshold 0 = report-only: this is a dogfooding gate being soaked in public before any enforcement is considered.flawd activatefrom theFLAWD_LICENSE_KEYrepo secret (already set); fork PRs skip with a visible notice since secrets aren't available to themflawd.ci.toml(same scope/budgets asflawd.toml) — measured on this repo: setup ≈2min warm, a small PR-shaped judged run ≈5.5min end to end (probe run)The rehearsal history lives on the (closed) probe PR #63.