Stability checkpoint — integration-tests CI re-enabled + auto-merge dev→main shipped - feat(ci): include auto-merge-dev-to-main template (iris-common) - feat(ci): re-enable integration-tests via SaaS Linux runner (saas-linux-medium-amd64) - fix(ci): switch kafka -> redpanda (boot ~3-5s vs kafka KRaft >30s) - ci: GitHub Actions mirror workflow for integration-tests (Linux amd64 native) CI : - ✅ Main pipeline #2514037064 green (post-promote dev→main, includes redpanda fix) - ✅ All validate gates (ruff, mypy, import-linter, pip-audit, docs:check, shellcheck, adr-drift, conv-commits) - ✅ unit-tests + benchmarks - ✅ integration-tests : 18 passed, 1 minor flake on aiokafka client teardown (deterministic on retry) - ✅ promote-dev-to-main job : auto-pushes dev to main on green dev pipeline GitHub Actions : - 🆕 First run live (run #25637713122) — mirror integration-tests on ubuntu-latest with services postgres + bitnamilegacy/kafka Local test pass : - ⏭ uv run pytest : not re-validated this rev (CI gates confirm) - ⏭ uv run pip-audit : 0 CVEs (gate green in CI) Regression check vs previous tag : - ✅ All v0.7.3 known limitations still bounded : - Docker image alpine 412 MB still blocked (musl wheels for cryptography) - integration-tests scope-out — NOW LIFTED (this tag) ✅ - 🆕 New limitation : GitLab CI integration-tests routes to SaaS (~400 free min/mo). Local runner not yet support — debug attempts documented in docs/audit/runner-dind-migration-2026-05-09.md + docs/audit/kafka-ci-redpanda-switch-2026-05-10.md - ⏭ N/A — no AI/ML code change in this rev - pip-audit : 0 CVEs (still green from v0.7.3 fixes) - AUTOMERGE_TOKEN : Personal Access Token (write_repository scope, expires 2027-05-10), masked + protected at iris-7 group level - Branch protection : dev now protected on all 5 iris repos with allow_force_push for the AUTOMERGE_TOKEN user (Owner) - ⏭ N/A — CI/release-engineering rev, no domain feature - ⏭ N/A - ⏭ N/A - ruff format + ruff:lint : green - mypy strict : green - import-linter : green - docs:check : green - pip-audit : 0 CVEs - 🆕 integration-tests : real gate again (was scope-out in v0.7.3) - Coverage : ≥90% (gate enforced via pyproject.toml addopts) - 🆕 Auto-merge dev → main template (iris-common ci-templates/auto-merge-dev-to-main.yml) - Skips when dev is already ancestor of main - Force-with-lease on divergence - Requires AUTOMERGE_TOKEN group var + main branch protection allow_force_push - 🆕 Kafka switch to redpanda (faster CI cluster bootstrap) - 🆕 SaaS routing for integration-tests (saas-linux-medium-amd64 tag) - 🆕 GitHub Actions mirror workflow (ubuntu-latest, services postgres + kafka) - workflow:rules now matches dev branch (was main-only) - iris-common SHA pinned at 8e8eabd (cf. java + ui) - Template-driven CI : 4 universal templates from iris-common (shellcheck, adr-drift, conv-commits, auto-merge-dev-to-main) - Audit doc pattern : docs/audit/*.md per major investigation - ⏭ N/A — backend repo - 141 stale local + remote branches cleaned (this session) - Auto-merge dev → main = no more manual promote MRs - GitHub mirror as backup / portfolio surface - **integration-tests on GitLab CI**: routes to SaaS (free quota ~400 min/month). Local runner attempts (5 approaches tried 2026-05-09→10) all hit kafka KRaft bootstrap >30s timeout. Re-attempt local-only later as separate effort. - **Docker image alpine** : 412 MB → ~280 MB possible. Blocked: pydantic_core / cryptography / bcrypt have no musl wheels. - Re-test local-only integration-tests with redpanda image (unblocked the fundamental issue) - pin iris-common SHA bump after next iris-common rev