formula_id: WBS_10_DOTNET_CICD_CHAIN_CONTRACT_V1
owner: QuantEngine
status: draft
goal: "CI, prepare-release, deploy-prod 순차 게이트를 고정한다."

workflows:
  ci:
    file: .gitea/workflows/ci.yml
    name: "Validators (Pushes and Pull Requests)"
    triggers:
      - push: main
      - pull_request: main
    role: "upstream validator"
  prepare_release:
    file: .gitea/workflows/prepare-release.yml
    name: "Prepare Release"
    triggers:
      - workflow_run: Validators (Pushes and Pull Requests)
      - workflow_dispatch
    role: "release builder"
    upstream_gate: "Validators (Pushes and Pull Requests) success"
  deploy_prod:
    file: .gitea/workflows/deploy-prod.yml
    name: "Deploy to Production"
    triggers:
      - workflow_run: Prepare Release
      - workflow_dispatch
    role: "production deployer"
    upstream_gate: "Prepare Release success"

dependency_chain:
  - "Validators (Pushes and Pull Requests) -> Prepare Release -> Deploy to Production"

required_guards:
  - "prepare-release는 Validators 성공 없이는 실행 금지"
  - "deploy-prod는 Prepare Release 성공 없이는 실행 금지"
  - "deploy-prod는 upstream CI SHA를 release tag와 대조"
  - "모든 단계는 concurrency group을 사용해 동일 SHA 중복 실행을 차단"

health_checks:
  - "upstream workflow conclusion == success"
  - "release tag sha matches workflow_run head_sha"
  - "artifact 존재 확인"
  - "SSH/Gitea secret 존재 확인"

notes:
  - "순차 게이트는 workflow_run 연결과 검증 스텝 둘 다 필요하다."
  - "병렬 실행은 금지된다."