a2eee9c279
CI gates (active on every PR via .gitea/workflows/)
───────────────────────────────────────────────────
1. test-count consistency
cpp-tests.yml gains a step after test-cgal that runs
`scripts/check-test-counts.sh` against the just-built ./build dir
(reuse via new BUILD_DIR env var, ~5 s overhead). Drift between
`doc/api/tests.md` and ctest reality now fails the PR.
2. End-to-end smoke
`scripts/try_it.sh` (the documented user quick-start) is now part of
the CGAL job, so README quick-start regressions fail the PR rather
than silently breaking when users land.
3. Internal markdown link checker
New `.gitea/workflows/markdown-links.yml` + `scripts/check-markdown
-links.py`. PRs that touch any *.md file run the check; main pushes
trigger it too; a weekly cron catches external link rot. Pure
Python, no third-party action. Validated against the current tree:
122 internal links across 37 *.md files, 0 broken.
Local quality scripts (`scripts/quality/`, not in CI)
─────────────────────────────────────────────────────
* `license-headers.sh` — `SPDX-License-Identifier: MIT` audit over
code/{include,src,tests}/. Currently
reports 60/66 files missing it — that's
a follow-up; the script captures the
structural gap.
* `sanitizers.sh` — ASan + UBSan over the fast test suite.
* `coverage.sh` — gcov/lcov line + branch coverage of
code/include/, HTML report under
build-coverage/lcov-html/.
* `clang-tidy.sh` — runs the curated `.clang-tidy` policy over
every public header.
* `multi-compiler.sh` — sequential build + test against every
detected g++/clang++ (auto-discovery or
explicit list).
* `cgal-version-matrix.sh`— sequential build + CGAL test suite against
every CGAL tree under `~/cgal/<ver>/` (or
via `CGAL_ROOTS=...` env var).
* `reproducible-build.sh`— two `Release -j1` builds, fail if any test
executable byte-differs.
* `run-all.sh` — driver: `--fast` for the ~5-min subset,
no arg for the ~25–40 min full sweep;
captures per-gate logs to
build-quality-logs/.
+ `.clang-tidy` — curated, deliberately-small policy (only
checks that fire on OUR code, never on
transitive CGAL/Eigen/Boost headers).
+ `scripts/quality/README.md` — explains the structure, lists each
gate's wall-time + prereqs, and codifies
the promotion path: a gate moves into CI
only when it's green on the dev machine
AND has a recovery-instructions paragraph
in `doc/release-policy.md`.
Doc updates
───────────
`doc/architecture/locked-vs-flexible.md` (reviewer-facing) gains 4
"closed" rows in the limitations table — the 3 CI gates above and the
local quality-script suite.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Local structural quality gates
This directory contains the structural quality checks that run locally
rather than in CI. They are intentionally not wired into
.gitea/workflows/ (yet) because each is either too slow, too brittle
against the runner environment, or both — running them before a release
or before showing the repo to an external reviewer is the intended
workflow.
The CI gates that are enforced live in .gitea/workflows/cpp-tests.yml
and .gitea/workflows/doxygen-pages.yml; they cover the day-to-day
correctness loop (build + test + doxygen-coverage + test-count
consistency + markdown links + end-to-end smoke via try_it.sh).
What runs locally
| Script | What it checks | Wall time | Prereqs |
|---|---|---|---|
license-headers.sh |
every C++ source carries SPDX-License-Identifier: MIT |
~1 s | bash |
../check-markdown-links.py |
every internal markdown link resolves | ~2 s | python3 |
sanitizers.sh |
fast test suite under ASan + UBSan | ~3 min | clang++ ≥ 14 or g++ ≥ 11 |
coverage.sh |
gcov/lcov line + branch coverage of code/include/ |
~2 min | lcov |
clang-tidy.sh |
curated clang-tidy checks over public headers | ~2 min | clang-tidy ≥ 14, .clang-tidy |
multi-compiler.sh |
build + test under every detected gcc/clang | ~5 min × N compilers | any 2 of g++, clang++ |
reproducible-build.sh |
two builds → byte-identical test executables | ~6 min | none beyond compiler |
cgal-version-matrix.sh |
build + CGAL test suite against multiple CGAL versions | ~5 min × N versions | CGAL trees under ~/cgal/<ver>/ (or CGAL_ROOTS=...) |
How to use
# Fast subset (license + links + sanitizers + clang-tidy) — ~5 min total
bash scripts/quality/run-all.sh --fast
# Full sweep — ~25–40 min, intended for pre-release tagging
bash scripts/quality/run-all.sh
# One specific gate
bash scripts/quality/sanitizers.sh
Every gate writes its full output to build-quality-logs/<gate>.log
when invoked via run-all.sh, and to its own per-gate build directory
(build-sanitizers/, build-coverage/, build-multi-<cc>/, …) when
invoked directly.
Promotion path to CI
Each gate can be wired into .gitea/workflows/cpp-tests.yml once two
conditions are met:
- The gate is green on the canonical dev machine. If the script exits 1 today, the CI gate would block every PR.
- There is a published policy line in
doc/release-policy.mdthat explains what regression the gate catches and what the recovery is. Future contributors should be able to read the error and know what to fix.
Promoting a gate is a one-line change to cpp-tests.yml; the test
recipe is the script invocation itself.
Known limitations
cgal-version-matrix.shdoes not download CGAL. Each version must already be on the dev machine under~/cgal/<ver>/(override withCGAL_ROOTS=...:...). The Dockerfile under.gitea/docker/Dockerfile.ci-cppcould be extended to ship multiple CGAL trees in a single image; not done yet.sanitizers.shonly instruments the fast (non-CGAL) test suite — the CGAL templates are too expensive to compile under instrumentation on most laptops.clang-tidy.shrequires a.clang-tidyconfig in the repo root; the default Anthropic-quality lint set is intentionally minimal until the reviewer signs off on the warning policy.reproducible-build.shchecks the test executables only. The library is header-only, so there is nothing else to compare.