Reference¶

Reference pages are information-oriented: the facts, laid out for looking up. One page per component, mirroring templates/<name>.yml 1:1. If you want a guided lesson instead, see Tutorials; for a task-oriented recipe, see How-To Guides; for the why behind a design, see Explanation.

Every component is included the same way:

include:
  - component: gitlab.com/phpboyscout/cicd/<name>@vX.Y.Z

Pin to a @vX.Y.Z tag — never @~latest or a branch. Pre-1.0: a minor bump may change input shape (see Versioning).

Across all components¶

Two pages cover facts that are not per-component:

Which pipelines each component runs on — the trigger matrix for all 31 components (merge request, branch, default branch, tag, schedule), which triggers you can override, and why a component that appears to have been ignored usually produced no job at all.
Limitations — what these components deliberately do not do: unsupported platforms and clouds, combinations that do not work, and the things you have to supply yourself.

Terraform / OpenTofu¶

Component	Purpose
`tofu-lint`	`tofu fmt -check`, `tflint --recursive`, `terraform-docs --check` drift.
`tofu-security`	`trivy config`, `checkov`, `gitleaks detect` against the IaC.
`tofu-validate`	`tofu init -backend=false && tofu validate` walked across consumer-specified paths.
`tofu-plan`	OIDC-authenticated `tofu plan` against AWS; produces a reviewable plan artifact + MR widget.
`tofu-apply`	Consumes a `tofu-plan` artifact, runs `tofu apply`; same-pipeline or cross-pipeline plan retrieval; optionally records a (stoppable) GitLab environment.
`tofu-stop`	Manual stop lane for a stoppable non-prod environment — strips it to baseline via an overlay apply (development/staging tiers only).
`tofu-deploy-generate`	Emits per-target deploy child pipelines from the consumer's environment catalog on release tags; golden-fixture verification on MRs.
`tofu-module-publish`	Publishes the repo to the GitLab Terraform Module Registry on release tags.

Go¶

Component	Purpose
`go-lint`	`golangci-lint run` with a stable per-project cache.
`go-singleuse`	The `singleuse` analyzer from go/controls, advisory: a finding is a warning, a broken run is a failure.
`go-core-currency`	On a release MR, checks every Go family core the project requires is at its latest release; reads the cores from a family feed.
`go-test`	`go test -race -coverprofile`, with an optional e2e job.
`go-security`	Five MR-time scanners: govulncheck, trivy, gitleaks, osv-scanner, semgrep.
`goreleaser`	Tag-gated `goreleaser release --clean`, with transient-failure auto-retry.

Rust¶

Component	Purpose
`rust-lint`	`cargo fmt --check` + `cargo clippy`.
`rust-test`	cargo-nextest matrix: Linux always-on, opt-in cross-OS / integration / coverage.
`rust-security`	`cargo-deny`, `cargo-audit`, trivy, gitleaks.
`rust-docs`	`cargo doc --no-deps --all-features` with `RUSTDOCFLAGS=-D warnings`.
`release-plz`	Rust release driver — Release MR, then publish + tag when it merges.

Svelte¶

Component	Purpose
`svelte-build`	Builds the frontend bundle and hands it to the release job as an artifact.
`svelte-lint`	svelte-check, eslint, prettier — the project's own tool versions.
`svelte-test`	`vitest run`, with an opt-in Playwright e2e job.
`svelte-security`	Eight scanners: semgrep, osv-scanner, npm-audit, retire.js, audit-signatures, lockfile-lint, SBOM, gitleaks. Always-on.

Static sites¶

Component	Purpose
`zensical-pages`	Build a Zensical microsite and deploy to GitLab Pages. (This site.)
`hugo-pages`	Build a Hugo site and deploy to GitLab Pages — the one component that deploys on a schedule.

Cross-track quality¶

Gates that are not tied to a language track — any project can adopt them.

Component	Purpose
`docs-verify`	Runs a project's own documentation check on every merge request. Deliberately always-on: a docs gate filtered on docs paths skips the merge requests that break the docs.

Release & dependency automation¶

Component	Purpose
`image-scan`	Scans a built image with trivy — OS packages as a hard gate, tool binaries as advisory — and keeps one dashboard issue per image current with the findings.
`renovate-self`	Schedule-driven Renovate run over the repos you name; pairs with the bundled preset that tracks component pins.
`renovate-group`	Schedule-driven Renovate in autodiscover mode — one job manages every already-configured repo under a group filter, picking up new repos automatically.
`renovate-merge`	Merges the group's green Renovate MRs that Renovate itself cannot, because GitLab's fast-forward merge API needs a `sha` Renovate never sends.
Renovate presets	The composable preset library — a base plus ecosystem/role leaves you combine to describe a project; change policy in one file, fleet-wide.
`release-train`	Derives the estate's first-party dependency order from its `go.mod` files and plans (or walks) the release cascade in it — the sequencing Renovate structurally cannot do.
`releaser-pleaser`	Release-MR-driven releases for Conventional-Commits projects (the Go-track sibling of `release-plz`).
`release-stamp`	Comments the shipped version onto every issue a release closed, on the tag pipeline — the information lost when issue closure moved to merge.

AI skills & instruction files¶

Component	Purpose
`skill-security`	Hidden-char, injection-heuristic, plugin-schema, and gitleaks scans for Claude skills / `CLAUDE.md` / similar instruction-file repos.