Stage: validate

The validate stage is the pipeline’s fail-fast front door. It runs cheap, deterministic checks — linting, type-checking, schema-drift, and unit tests — so a typo or a broken type never burns expensive build, scan, or deploy minutes. It is the first stage; nothing here touches a cluster.

Part of the Full pipeline action map. Use the Fullscreen button on the diagram to view it edge-to-edge.

⛶ Fullscreen

flowchart TD
  SRC["Push · merge request · schedule"]
  GATE["ci:gate<br/>pipeline-status anchor<br/>(allow_failure: false)"]

  subgraph LINT["Lint &amp; structure"]
    direction TB
    Y["validate:yaml — yamllint"]
    SH["validate:shell — shellcheck"]
    HELM["validate:helm — lint + template x3 clouds"]
    RT["validate:routes — Next.js route-export check"]
  end

  subgraph TYPE["Types · schema · tests"]
    direction TB
    TC["validate:typecheck:portal — tsc baseline"]
    PR["validate:prisma-drift — shadow DB migrate diff<br/>(allow_failure: false — blocks)"]
    VT["test:vitest:portal — unit tests<br/>(allow_failure: false — blocks)"]
    MCP["validate:mcp-portal — typecheck + build + test"]
  end

  SRC --> GATE
  GATE --> LINT
  GATE --> TYPE

  class GATE gate
  class Y,SH,HELM,RT,TC,MCP validate
  class PR,VT block
  class SRC io
  classDef validate fill:#1f6feb,stroke:#0b3d91,color:#ffffff
  classDef gate fill:#9a6700,stroke:#5c3d00,color:#ffffff
  classDef block fill:#1f6feb,stroke:#0b3d91,color:#ffffff,stroke-width:3px
  classDef io fill:#57606a,stroke:#32383f,color:#ffffff

Jobs in this stage

Job	What it does	Why
ci:gate	A ~5s no-op that is allow_failure: false.	With merge trains on, GitLab’s status state machine needs at least one non-allow-failure job, or all-green pipelines tombstone as canceled. This anchors the status.
validate:yaml	yamllint over SARC-authored YAML (excludes vendored charts). allow_failure: true.	Catches YAML syntax/format issues early without blocking on legacy noise.
validate:shell	shellcheck over scripts/ci/ and bootstrap scripts. allow_failure: true.	Static shell analysis before runtime.
validate:helm	helm lint + helm template smoke-render of both charts with dev + per-cloud values.	Catches chart lint and template-render failures before any deploy.
validate:routes	Node regex scan for invalid Next.js route exports.	Fails in seconds on export patterns Next.js rejects, before any docker build.
validate:prisma-drift	Spins a throwaway Postgres+pgvector, applies migrations, runs prisma migrate diff (exit 2 = drift). allow_failure: false.	Blocks merge on schema drift — forces committed migrations.
validate:typecheck:portal	tsc, reports net-new error count to the MR widget. allow_failure: true (Phase 1).	TypeScript baseline; will flip to a hard gate once pre-existing errors are cleared.
test:vitest:portal	vitest unit tests with coverage. allow_failure: false.	Blocks merge — the suite is green on main and regressions must be fixed. Placed in validate to catch failures before build minutes.
validate:mcp-portal	npm ci + typecheck + build + test for the MCP server. allow_failure: true.	Validates the MCP server spike without blocking.

Why this stage exists

Everything here is fast and deterministic, and the two gates that block (validate:prisma-drift and test:vitest:portal) protect the two things most likely to break silently: database schema drift and unit-test regressions. Running it all first means the pipeline never spends build or cloud minutes on a change that was never going to pass.

---

Stages: validate → build · all stages