[smith-xyz]

What

GitHub Actions for the SDK, shaped like traust-core's, with a tighter merge gate. Today the repo has no CI; only local hooks, which --no-verify skips.

Workflow	Job	Runs	Required
ci.yml (PR, merge queue, push to main/development)	lint	make lint	✅
	test	go test -race ./... (the runner's heartbeat / lease loss is concurrent)	✅
	integration	make test-integration on PostgreSQL 16	✅
	security	make security (pinned govulncheck, gosec)	✅
	drift	make -C go check-drift: generated code matches CONTRACTS_REF / CORE_REF, never hand-edited	✅
	e2e	make e2e: traust-server from core at CORE_REF (SQLite, local issuer), generated client checks auth, paging, typed 404 / 401 problems	✅
	guardrails	make guardrails: no committed spec, no package outside AGENTS.md's list, no env reads / database/sql / hand-built URLs in framework packages, estate data, conventional commits	✅
core-head.yml (nightly)		regenerate + build + e2e against core's development tip; red = bump CORE_REF	—
auto-merge.yml		traust-core's, plus: a breaking type(scope)!: PR is armed only by the automerge label	—
review-after-merge.yml		traust-core's: merged without approval → review/after-merge	—

• CODEOWNERS: the framework's shape only (AGENTS.md, .agents/, .github/, ci/, go/go.mod, go/Makefile, go/internal/generate/, go/v1/api/client.go, go/v1/ops/, go/v1/feed/) → @smith-xyz @chubirka. Drops the * catch-all so routine PRs don't wait on a reviewer.
• .github/pull_request_template.md from AGENTS.md's rules.
• Deleted the GitLab leftovers ci/lang/_base.yml, ci/lang/go.yml (no .gitlab-ci.yml runs them); ci/lang/go/ci.py stays (security tool pins).

Stacked

On #39 (CORE_REF lives in its Makefile). Review the last commit.

Repo settings (admin, after merge)

auto-merge.yml and review-after-merge.yml use pull_request_target, which only fires from the default branch (main), so they need a sync to main. Then:

• Branch protection on development: required checks lint, test, integration, security, drift, e2e, guardrails; required approvals 0 with code-owner review on (CODEOWNERS paths still need an owner); signed commits stay.
• Allow auto-merge on; squash merge off (pins point at merge commits).

Changed tests

None.

Checks

• make lint, make guardrails, make -C go check-drift, make e2e (4 e2e tests pass locally against core 1a6779a)
• go test -race ./...
• actionlint clean

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment