pipeline

CI configuration includes catalog components by pinned tag, never a floating ref. A build that can change without a source change is not reproducible, and a build you cannot reproduce is a build you cannot trust.

What this standard checks

• .gitlab-ci.yml exists.
• No catalog include: ends in @latest or @main. Every include names a version tag.

Why

A floating ref means the same commit builds differently tomorrow, silently, when the upstream component moves. Pinning makes the build a function of the source alone. Upgrades become deliberate edits (bump the tag) that show up in review and in the record, rather than drift that shows up as a mystery failure.

How to adopt

Pin every component to a release tag:

include:
  - component: gitlab.com/nomograph/pipeline/<name>@vX.Y.Z