# M6 CI contract

The repository remote is Gitea, so the authoritative workflow is
`.gitea/workflows/m6-ci.yml`. `main` is the protected release ref. Pull requests and ordinary
pushes run quick and Chromium lanes; the release lane runs only for a `main` push or an explicit
`workflow_dispatch`.

## Pinned runner matrix

| Component | Pinned value | Lane |
| --- | --- | --- |
| Runner | self-hosted Debian 13 x86_64, labels `blender-web` / `blender-web-release` | all |
| Node.js | 20.19.2 | all |
| npm | lockfile-compatible npm 9 | all |
| Playwright | 1.62.1 | Chromium, release |
| Chromium | Playwright Chromium 149.0.7827.55 or `CHROME_PATH` override | Chromium, release |
| Blender | official Blender 5.2.0 LTS with USD enabled, configured by `BLENDER_BIN` | release |
| Emscripten | 3.1.69 | release |

`BLENDER_ARCHIVE_SHA256` must identify the official Blender archive used by acceptance. VDB jobs
use `VDB_RESOURCE_ROOT`; when it is absent, tools resolve `resource-library/blender-web-vdb`
under the runner home directory.

## Lane contents

`npm --prefix web run ci:quick` installs from `package-lock.json`, then runs typecheck, lint, Node
tests, status consistency and release-evidence schema checks.

`npm --prefix web run ci:chromium` runs the P0 user loop (including main-thread and Offscreen
viewports), release browser smoke, network interruption, device loss, OOM, real OPFS quota,
malicious blend and archive gates. Every browser command receives a newly allocated loopback port;
Playwright owns and cleans its server process.

`npm --prefix web run ci:release` runs full E2E, the complete performance and VDB matrices, V1
acceptance, reproducible offline packaging, archive cold boot, and binary/source independent
verification.

Each lane writes `release/ci-reports/<lane>.json`, a sidecar SHA-256 and one immutable log per
command. Reports use `docs/status/ci-lane-report.schema.json` and bind the commit, lockfile, parity
ledger, engine manifest, SBOM, available archives and every command log. A failed subcommand writes
an atomic `FAILED` report before the lane exits nonzero; it cannot reuse an older READY report.

The npm cache key is derived from `web/package-lock.json`. The Emscripten cache additionally binds
version 3.1.69 and `tools/web/emscripten-env.sh`. Release evidence, reports and archives are never
cache inputs. Artifact retention is fixed at 7 days for quick, 14 days for Chromium and 30 days for
release; the report checker runs before upload.