CI Convergence

Core rule

A local green run is not release evidence. The authoritative unit is the pushed SHA and every required check attached to that exact SHA.

Contract

1. Record the pushed SHA immediately after push.
2. Enumerate required checks for that SHA; never substitute “latest run”.
3. Wait while any required check is queued or running. Pending is not success.
4. Require every required check to reach a terminal successful state.
5. If one fails, inspect its log, fix the causal defect, push a new SHA, and restart convergence from step 1.
6. Tag, publish, or end the task only after the exact release SHA is terminal-green.

For a release, verify the tag resolves to the same green SHA and verify the uploaded artifacts after publication.

After the checks are green

Required checks do not include GitHub security alerts. Dependabot, code scanning, and secret scanning can open after the workflow is green. Query the repository you just created, pushed, or updated. This is every repository, not one product.