CAST AI CI Contract Lane

Overview

Keep pull-request checks local and credential-free. Validate syntax, rendered Kubernetes objects, policy invariants, and destructive change boundaries before allowing a separately protected job to inspect a real CAST AI environment.

Prerequisites

• The workflow, Terraform, Helm values, and workload manifest paths in scope
• An explicit source of truth for each CAST AI setting
• Maintainer approval for any protected live probe

Instructions

Step 1: Map the trust boundary

Use Read and Grep to identify fork execution, secret references, Terraform backends, generated plans, Helm values, kubeconfig use, and direct CAST AI calls. Classify each check as offline, protected read-only, or prohibited.

Step 2: Build the required offline lane