ci_gate

Katz 0.172

Pull-request CI and the main release pipeline share one sequential workflow: ci.yml.
deployment_flow must not apply changesets or create tags until that workflow succeeds.
Order in one job: install workspace packages, compile crates and TypeScript once, then crate tests, check, then JS / TS tests ( prerelease_tests, check_meta_implementation, rust_fmt ).
`@reqlan/*` packages come from this git checkout ( `workspace:*` ), not from the npm registry. Platform native packages are linked the same way in this workspace through `packageExtensions` in pnpm-workspace.yaml; they are not listed in git `@reqlan/analytical` `optionalDependencies`.
A push to main does not start CI a second time as an independent workflow; release.yml calls ci.yml with `workflow_call`.
Because ci.yml declares `permissions.contents: write`, the caller job in release.yml must grant `contents: write` when invoking it.
The version-bump commit ( `chore(release):` ) skips the gate and the version job to prevent a recursive run.

implementation

release.yml, ci.yml, assert-workspace-reqlan.mjs

status

done

tests

release-ci-gate.test.ts, release-ci-gate.test.ts:release calls sequential CI before versioning, release-ci-gate.test.ts:CI is one sequential pull-request job, release-ci-gate.test.ts:one build is reused by crate tests, check, and package tests, release-ci-gate.test.ts:reference check uses workspace packages not npm

Interactive page: ci_gate