---
schema_version: 1
id: RAC-KV4134WXAJGA
type: roadmap
tags: [ci, distribution, dx, sarif]
---
# v0.17.2 — CI Action and Developer Experience

## Status

Planned

## Context

`rac validate --sarif` (v0.15.2) emits SARIF; what is missing is the
*distribution* — a turnkey way to run RAC in CI and surface findings on a pull
request. This milestone ships a GitHub Action that wraps `rac validate`, uploads
SARIF to GitHub Code Scanning, and annotates findings inline, plus the developer
docs that make adoption a copy-paste. It closes the brief's hardening arc; per
ADR-052/ADR-055 it also lands the honest "custom types and edges are deferred"
note rather than docs for machinery RAC has not built.

## Outcomes

- A published GitHub Action runs `rac validate` on a pull request and annotates
  findings inline via Code Scanning, with warnings-first onboarding so a first
  run on a legacy repo does not fail the build on pre-existing findings.
- A new contributor can adopt RAC in CI from the docs alone, and understands the
  current extensibility boundary (custom types/edges deferred).
- The Action is a thin wrapper over the CLI: the CLI stays the source of truth,
  and the run is deterministic and offline (no network beyond the SARIF upload).

## Initiatives

### Initiative 1 — The GitHub Action

A composite action in this repository (`action.yml`) that installs `rac`, runs
`rac validate <dir> --sarif`, and uploads the result with
`github/codeql-action/upload-sarif`. Inputs: the corpus path and a fail-policy;
the Action surfaces the CLI exit code. Warnings (including downgraded findings,
ADR-053) annotate without failing; errors fail the check (ADR-058).

### Initiative 2 — Developer-experience docs

A CI quickstart (the workflow snippet), a warnings-first onboarding walkthrough
(adopt on a legacy repo, tighten over time via `.rac/config.yaml`), and the
one-paragraph "custom types and custom relationships are deferred; the code-defined
registries are the supported surface" note (ADR-052, ADR-055).

### Initiative 3 — Demonstration and coverage

Run the Action on a sample repository PR and confirm findings annotate inline;
fixture-test the action wiring (SARIF produced, exit code propagated). Validate
the demonstration with the existing SARIF determinism guarantees.

## Success Measures

- The Action runs on a PR in a sample repo and annotates findings inline; a clean
  repo passes, a repo with an error-severity finding fails the check.
- A new contributor follows the docs alone to add RAC to CI in one workflow file.
- Warnings-first onboarding is documented and demonstrated (a downgraded type
  keeps the check green).

## Assumptions

- GitHub Code Scanning remains the SARIF ingestion surface; the Action targets it.
- The `rac` CLI remains pip-installable and the SARIF contract (ADR-054) is stable.

## Risks

- The Action is a second distribution surface to keep in step with the CLI.
  Mitigated: it is a thin wrapper that shells the CLI, with no logic of its own.
- Code Scanning requires specific permissions; documented in the quickstart.

## Related Decisions

- adr-058
- adr-054
- adr-052

## Related Requirements

- rac-cross-artifact-enforcement
- rac-growth-adoption

## Related Designs

- ci-action-and-dx

## Related Roadmaps

- v0.15.2-validation-overrides-and-sarif
