From 91c4227f100f7dfbc4a8fc4fb64c1114427cce2a Mon Sep 17 00:00:00 2001
From: Eva <arncalso@gmail.com>
Date: Wed, 10 Jun 2026 03:02:11 +0700
Subject: [PATCH] ci: gate the qa/ release-gate + scoring tests (closes #729)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'test' job only collected servers/*/tests/ — qa/test_*.py was NEVER run in CI, so a
*tested* crash (#723 build_shas, caught by test_release_readiness.py's 4 build_sha tests)
merged green and shipped, surfacing only when the live RRI rollup crashed. Add a
qa-release-gate-tests job running the release-authority surface: test_release_readiness,
test_release_readiness_scope, test_scores_db_comparability, test_scores_db,
test_release_gate_static (67 tests, validated locally via the engine venv). A regression in
release_readiness.py / scores_db.py can no longer merge green.

Closes #729.
---
 .github/workflows/ci.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f6881b2..10c1d5f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,6 +60,28 @@ jobs:
         # -p no:xdist keeps this single-process (no parallel workers) — lean by design.
         run: python -m pytest viewer/tests -q -p no:xdist
 
+  qa-release-gate-tests:
+    # #729: the qa/ release-gate + scoring + wrapper-contract tests were NEVER in CI — the `test`
+    # job only collects servers/*/tests/. A *tested* crash (#723 `build_shas`, caught by
+    # test_release_readiness.py's 4 build_sha tests) shipped because CI never ran them. Gate the
+    # release-authority surface (release_readiness.py, scores_db.py, the play-wrapper contracts) so
+    # a regression there can no longer merge green.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+      - name: QA release-gate + scoring + wrapper-contract tests
+        # Run from the engine venv (pydantic etc. on path) with cwd=servers/engine, so the qa tests'
+        # `import server/store` resolves and release_readiness.py subprocesses use the same interpreter.
+        run: |
+          uv run --directory servers/engine --group dev python -m pytest -q -p no:xdist \
+            ../../qa/test_release_readiness.py \
+            ../../qa/test_release_readiness_scope.py \
+            ../../qa/test_scores_db_comparability.py \
+            ../../qa/test_scores_db.py \
+            ../../qa/test_release_gate_static.py
+
   license-check:
     runs-on: ubuntu-latest
     steps: