# How kogut is built

Tests, CI, review, dependencies, releases, and AI tools.

## Maintainer

kogut has one maintainer, who reviews and merges every change. Contributions follow
[CONTRIBUTING.md](https://github.com/piotrkowski/kogut/blob/main/.github/CONTRIBUTING.md).

## Tests

Unit tests sit beside the Rust code. Engine scenarios replay fixed timelines, and the
probes, notifications, and server have integration tests. `crates/e2e` runs the real
server and agent together. `scripts/e2e.sh` drives the built binary through setup,
sign-in, host enrolment, the agent, a backup, and shutdown; it runs for changes to
startup, sign-in, the agent, or the CLI, and not in CI. The tracker and kogut edge have
TypeScript tests.

## CI

Every pull request and push to `main` runs:

- A size check, `cargo fmt`, Clippy with warnings as errors, and `cargo test`, plus the
  core crate's tests in release mode and Clippy and the tests of the agent-only build
- `cargo deny --config .github/deny.toml check` for licences, sources, and advisories
- Formatting, type checks, lint, tests, and the build of every pnpm package
- A [gitleaks](https://github.com/gitleaks/gitleaks) scan of the full git history

A change is merged only when these pass. A weekly job checks the Rust and npm
dependencies against the advisory databases.

## Review

The maintainer reads and tests every pull request before merging it. The maintainer's own
changes go through the same checks and a second review before they land on `main`.

## Dependencies

`cargo deny` allows only permissive licences, such as MIT, Apache-2.0, BSD, ISC, and Zlib,
and rejects unknown registries, git sources, and wildcard versions. GitHub Actions are
pinned to a commit. Dependabot opens weekly grouped updates for Rust crates, npm
packages, GitHub Actions, and the Docker base image.

## Releases

A version tag starts the release workflow. It builds static Linux binaries for x86_64 and
aarch64, the full one and the [agent-only build](https://docs.kogut.dev/reference/cli/#the-agent-only-build),
publishes them with SHA-256 checksums and build provenance attestations, and pushes a
multi-arch image of each to `ghcr.io`. Releases have no fixed schedule. See
[Versioning](https://docs.kogut.dev/project/versioning/).

## AI tools

The maintainer uses AI coding tools, and their output goes through the same tests, CI,
and review as any other change.