Gate a release in CI

Outcome

A release goes out only when the claim held on the live app.

Does not do

A CI job cannot approve a plan. The first check of a claim waits until a person approves it at the link.

Gate on the decision, never the run state. A finished run is not a pass. In CI the exit code is what an if-statement reads.

With the CLI

The job needs VRAELIS_API_KEY in its environment, from a key with launch access, and Node 18 or newer. The CLI does not open a browser in CI: the approval link goes to the log. [Create an API key]((retired endpoint))

The first check of a claim

A CI job has no person at the terminal, and a key cannot approve a plan, so the first check of a claim waits on the link until someone approves it or --timeout runs out. Re-checks of that approved plan need no new approval within 24 hours of the approval, up to 10 times, on the same address. A new preview URL is a different address, so its first check waits for a person again. The gate below splits the two cases instead.

A gate that calls the API

The CLI collapses “blocked” and “could not run” into 2, because a gate should treat “I could not check” the same as “no verdict.” A hand-rolled gate that polls the API can split those out, exiting 3 when no decision is reached in the window.