CI, artifacts, and release boundaries

Backend

The GitHub Actions workflow verifies source, dependencies, tests, race behavior, vulnerabilities, and component image builds. The Go toolchain is pinned consistently with the module and Docker builder. Each executable receives a separate image. Build metadata identifies version and revision; the runtime is non-root scratch.

Agent

The independent agent workflow runs source verification and reachable vulnerability analysis. Its build is from that checkout alone, with a published contracts module. It prints binary identity after building. The current workflow does not publish native packages, signed fleet artifacts, or an automatic update channel.

Contracts

Contract CI checks lint, generated bindings, compilation, and backward compatibility. The baseline is a remote-tracking main reference so branch state does not silently change the comparison. Releases use version tags; generated bindings are committed.

Release and rollback limits

A successful CI build is not authorization to deploy or evidence that a production migration is reversible. Keep image/source revision, contracts version, ruleset version, and schema state together in release records. Roll back rules by activating a previous immutable ruleset. Treat database downgrade, CA rollback, and endpoint state format changes as separate recovery problems.

Source evidence

Reviewed against the source baseline. Seagull-backend-v2/.github/workflows/ci.yml · Seagull-agent-v2/.github/workflows/ci.yml · Seagull-contracts/.github/workflows/ci.yml · Seagull-backend-v2/deploy/Dockerfile.