Validation Pipeline

SveltyCMS tiered validation architecture for contributors — fast commits, safe pushes, deterministic CI

8/6/2026

3 min read

On this page

SveltyCMS uses a three-tier validation architecture that balances developer velocity with code safety. Every tier catches a different class of defect at the right stage of the development lifecycle.

Tip

New to the repo? Run bun run test:doctor --list for the live gate map, or bun run test:doctor to run unit + SQLite integration. Live dashboard: Test Status.

Tier 1 — Pre-commit (~40–60s)

Hook: .githooks/pre-commit · Manual: bun run precommit

scripts/check-test-db-safety.ts — never point tests at a live DB name
bun run check — format (oxfmt) + lint (oxlint)
bun run gate:fast — lint-staged
bun run risk:audit — security-risk scan (all adapters) + secret misuse + slop + bun audit + OSV (skipped if only docs changed)
bun run test:unit — full Vitest suite (skipped if only docs changed)
SBOM sync — bun run audit:sbom when bun.lock / package.json changed

Tier 2 — Pre-push (~5–8 min)

Hook: .githooks/pre-push · Manual: bun run gate or bun run prepush

Production build with COMPILE_ALL_ADAPTERS=true
Prod build backdoor verify — scripts/verify-prod-build-backdoor.ts --mode=bench
Bundle size gate — scripts/check-bundle-size.ts
bun run check — TypeScript / Svelte quality gate
Secret misuse scan — scripts/scan-secret-misuse.ts --strict
Tenant isolation — bun run test:tenant
SQLite integration: bun test --timeout 300000 tests/integration/
(in-suite harness starts preview + config/private.test.ts)

Docs-only pushes skip build + integration. Multi-DB matrix, benchmarks, and Playwright E2E are not on pre-push — they run in CI.

Important

No double-run rule: full unit suite runs on pre-commit only. Pre-push does not re-run all unit tests.

Tier 3 — GitHub Actions

Workflow: .github/workflows/ci.yml

bootstrap → whitebox (format / lint / check / unit / tenant / secrets / CVE / backdoor probe) → build → db-tests × 4 → bench-core × 4 → e2e-prep → e2e × 6 named groups → all-green

Manual commands

Command	Purpose
`bun run test:doctor`	Gate map + unit + SQLite integration
`bun run test:security`	Focused hooks security suite
`bun run risk:audit`	Full pre-commit security scanners
`bun run test:smart`	Git-diff suite picker
`bun run test:e2e`	CI-parity Playwright
`bun run gate`	Same as pre-push

Private config safety

Local automated runs use config/private.test.ts only. Never read or write the developer’s live config/private.ts. CI may create an ephemeral private.ts on the runner only.

Full detail: docs/tests/git-workflow.mdx · docs/tests/index.mdx · AGENTS.md technical standards