Before a Change Lands ​

A reader who reruns Tidemark should reach the same answer, and a reader who does not rerun it should still be able to see why the answer holds. This page covers what a change has to pass before it reaches main, which mise verify runs on a laptop as well, and what those checks show about the numbers and the tables published here.

One Gate per Change ​

Nothing reaches main except through a pull request, and a pull request merges only once a single check named ⚓ All Clear has passed. That check is a job that waits for every other job in its run and reports their verdicts together, so a green mark means each concern passed, rather than that the last one did.

Each concern takes a row of its own, so a failure names which one broke. The rows cover:

  • The lockfiles, which hold every pinned tool and package to what a manifest declares and pin no package at a version a published security advisory names
  • The repository's own declarations, which the section below covers
  • The Python source, meaning the formatter, the linter, and the suite under coverage
  • The workflows and the shared action that installs their tools, which zizmor audits for the security faults a workflow can carry
  • The site, meaning its build and every check on it the site: group runs

Every row runs on GitHub's ubuntu-26.04 image.

The Declarations Agree ​

Most of what a repository states about itself sits in more than one file, and a statement that drifts in one of them is an error the whole suite still runs green over. One row runs repo:audit for that alone, reading each declaration against the others rather than against a hand-written description.

  • The authors and the address in CITATION.cff are held against the same fields in pyproject.toml, and its licenses against licenses.toml
  • The owners .github/CODEOWNERS assigns every path to are held against the GitHub login CITATION.cff gives each author, in the citation's order
  • The title and the copyright line of LICENSE.md are held against the license licenses.toml declares and the authors in pyproject.toml
  • The license expression and each pattern license-files names in pyproject.toml are held against licenses.toml and the files each pattern matches, so a license text the wheel ships cannot drop out of it unnoticed
  • Each file the wheel and the site ship, each release asset, and each package docs/bundled.json records the site's build carrying is held against the licenses and the source terms licenses.toml lists, so a file under no listed terms fails the row
  • Each pinned tool is held against the lockfile entry recording where it came from
  • An action pinned in one workflow is held against the commit another workflow names for it
  • The runner image one job names is held against every other job's
  • The label registry is held against the release-notes categories in both directions, so a label that files a pull request under a section of the notes cannot go missing from the registry that creates it
  • Every label's color, each hex in every mark, and the color of each README badge are held against the palette the package declares, so a hex copied into one of them cannot drift from it
  • A table on this site that docs:render writes from one of the package's own declarations is held against that declaration, so a page cannot describe a field the declaration no longer holds
  • Every mark is held whole against the drawing the package writes for it, so a mark edited by hand cannot stand

A check that fails names the two files that disagree and the values each holds, and where a file is malformed, rather than out of step, it names the key and what it expected there, and carries on, so one bad line hides no other disagreement.

The Coverage Figure ​

The Python suite and the site's suite each run under coverage on every pull request that touches what they read, and each fails below 95%. The figure this site shows pools both, counting the statements and branches the two suites ran against every one they could have, and the last workflow run on main writes it out for the badge to read, rather than a page stating it. Every workflow run that measures a suite attaches that suite's HTML report of the lines it ran and missed to the run itself, since the report prints the source it measures and the repository is private. The summary of each deployed 🌊 Pages run shows how the pooled total moved across the most recent merges.