Build out CI/CD pipeline

[soord]

We want to build out a CI/CD pipeline in order to streamline our releases. This should include running tests and release process in an automated and easy to use pipeline.

(Is this done already?)

[rinchen]

Not done currently. Right now it's submit a bunch of PRs so codeql runs and our massive test suite runs again

1. Build binaries on github from main (manual run) and test
2. bump deps if not done
3. run release.sh
4. Create the release itself

[rinchen]

I have a few things that fire on every PR and then a smaller number for every tagged release. I'm using release.sh to ensure everything is done properly, then the github actions run to both build the release and also build the images with all the artifacts for the release

[soord]

Yeah so this can def be updated from that. Would probably require permissions to be awarded and is probably lower priority though

[rinchen]

I do have two docs as starters for this, docs/ci-cd.md and docs/release-process.md for when we get to this.

[rinchen]

I would love for this to also enable merge queues with strict_required_status_checks_policy = true

[rinchen]

Already done

• PR gates: ci.yaml, tests.yaml, CodeQL, path-gated sidecar
• Tag → draft release: release.yaml + flatpak.yaml (sole draft creator, upload-by-id, packaging smoke, macOS signing)
• Maintainer path: pnpm run release (scripts/release.sh) with full preflight
• Manual packaging smoke: build.yaml
• Docs: docs/ci-cd.md, docs/release-process.md

Still manual / incomplete

• Cut release locally with pnpm run release (bump, tag, push)
• Human Publish on the GitHub draft
• Dep bumps via pnpm run update (Dependabot PRs disabled)
• Merge queue with strict_required_status_checks_policy (called out in-thread) — not configured
• Branch protection / rulesets: API shows none on main (docs claim required checks; repo is public on the free org plan, so merge queue is available)

[rinchen]

Done — CI/CD + merge queue

Most of the original ask was already in place (PR CI, tag→draft release/Flatpak, pnpm run release). Remaining gaps from this issue are closed:

Area	Status
PR lint/typecheck/build/tests	Done
CodeQL / CodeRabbit	Done (CodeQL stays PR/push only — default setup does not run on merge_group)
Tag → draft multi-OS + Flatpak + smoke	Done
pnpm run release	Done; non-interactive via -- --yes / MESH_CLIENT_RELEASE_YES=1
Manual draft Publish	Intentional
Dep bumps	Still manual (pnpm run update)
Merge queue + strict required checks	Live — ruleset main merge queue (strict_required_status_checks_policy)
E2E	Daily/dispatch only — not a merge gate

Landed

• chore(ci): merge queue support and release --yes (#378) #849 — merge_group on ci.yaml/tests.yaml, release --yes, cut-release workflow docs, gap audit in docs/ci-cd.md
• fix(ci): licenses PR flow for merge-queue ruleset #850 — licenses workflow opens a PR (Actions cannot bypass the ruleset on this org); confirmed merge queue re-ran CI on merge_group

Still manual (by design)

• Human Publish on the GitHub draft after packaging smoke
• Optional Actions cut: set secret RELEASE_PUSH_TOKEN, then run Cut release (cut-release.yaml) — prefer local pnpm run release -- --yes

Closing this issue.