Mando CI/CD

GitLab CI/CD pipeline and deployment configuration for the Mando workspace.

Pipeline Stages

graph LR
    SEC["Security<br/>(Snyk)"] --> CONT["Pipeline<br/>Container"]
    CONT --> SETUP["Setup"]
    SETUP --> BUILD["Build &<br/>Test"]
    BUILD --> PUB["Publish"]
    PUB --> REL["Release"]
    REL --> PAGES["Pages"]

1. Security — Snyk vulnerability scanning
2. Pipeline Container — Build Docker base/build images
3. Setup — Environment preparation
4. Build & Test — Compilation and test suite
5. Publish — Artifact/package publication
6. Release — Release tagging
7. Pages — Documentation deployment

Branch Strategy

Branch Pattern	Target	ECR
feature/*, bugfix/*, rc/*, develop	Dev	Dev ECR
release/*	Production	Prod ECR

Container Images

Production Image (Dockerfile)

FROM debian:13.1-slim
# Installs: ca-certificates, libc6, libssl3
# Copies: certs, assets, libduckdb.so, pre-built target/release/mando_bess
EXPOSE 8080
CMD ["mando_bess"]

Updated 2026-07-10

samba-libs/libsmbclient removed from the runtime image by the remotefs-smb to smb migration (pure-Rust smb crate). The build images still install them (harmless leftover). Toolchain is now 1.89.0 via rust-toolchain.toml even though the build image base tag remains rust:1.88.0-bookworm.

Build Image (container.linux.Dockerfile)

Base: rust:1.88.0-bookworm (toolchain 1.89.0 installed via rust-toolchain.toml)

Tools installed:

• Docker, jq, AWS CLI
• CMake, Go
• Poetry, pipx
• pkg-config, samba dev libs
• Maturin 1.9.2

Windows Variants

• container.win.base.Dockerfile — Windows base image
• container.win.chef.build.Dockerfile — Chef-based dependency caching

Pipeline Triggers

Container images rebuild when any of these change:

• rust-toolchain.toml
• container.*.Dockerfile
• Cargo.toml / Cargo.lock
• py-mando/pyproject.toml / poetry.lock

System Dependencies (Linux Runtime)

Package	Purpose
ca-certificates	TLS certificate store
libc6	C standard library
libssl3	OpenSSL / TLS

Quality Gates

• Lint gate: cargo clippy --release --all-features must be clean
• Test gate: cargo test --all-features --release --lib -- --test-threads=1 (.gitlab/scripts/test.sh; single-threaded mandatory: shared in-memory DB pools)
• No cargo fmt gate — never run bare cargo fmt locally (reformats ~64 legacy files); scope to touched files
• See Mando AGENTS.md Master Guide for the full pre-push checklist

The test gate is --lib-only (correction 2026-07-22)

The --lib in .gitlab/scripts/test.sh means CI compiles and runs ONLY lib unit tests. */tests/ integration targets are never built by the pipeline and rot silently; the separate “Integration Test Linux Dev” job covers only the mando-lib archiver Postgres suite. Concrete rot: mando-bess/tests/flight_end_to_end.rs is compile-broken on develop (E0603). Local gates must use --lib for CI parity. Full record: mando-ci-lib-only-test-gate-2026-07-22.

Known Flaky Tests

Intermittent CI failures with no underlying code defect are tracked in mando-known-flaky-tests-2026-07-15. Prefer retrying the CI job; real fixes land in dedicated follow-up tickets.

Build Requirements

Tool	Version	Purpose
Rust	1.89.0 toolchain (MSRV 1.88.0)	Compiler
Python	3.12	py-mando build
Maturin	1.9.2	PyO3 wheel builder
Poetry	2.1.3	Python dependency management
CMake	—	Native dependency builds
Go	—	Tool compilation
AWS CLI	—	ECR push, deployment