Deterministic CI Gates

All CI/CD automation should be deterministic, machine-independent, and enforced via failing gates—never relying on “latest tag,” unstated baselines, or author-local tooling.

Apply these rules: 1) Release automation must compute baselines programmatically

• When building changelogs or diffs for a specific release tag, derive the “previous release cut” for that channel, not the most recent tag overall.
• Encode multi-version releases (e.g., stable_00/01/02) explicitly in the baseline-selection logic.

2) Standards should be enforced by CI-run checks

• If a rule is hard to review manually (e.g., “use per-tab theme lookup only inside tab content”), implement a custom lint and run it in presubmit as a hard failure (e.g., dylint with -D warnings).

3) Test environments must be reproducible

• Pin required tool versions in CI (e.g., Nushell >= 0.109.0 via pinned Nix input / devshell package).
• CI must assert the required version before smoke tests.
• If the binary/tool is unavailable in CI, explicitly skip those tests rather than depending on local developer configuration.

Example (baseline selection + CI gate sketch):

// Pseudocode for deterministic “previous cut” lookup
fn previous_cut(tag: &str, all_tags: &[&str]) -> Option<&str> {
    let channel = parse_channel(tag);
    // Filter to same channel, then sort by the release-cut identifier
    // (not by the most recent full tag string).
    let mut cuts = release_cuts_for_channel(channel, all_tags);
    // Find the cut immediately preceding the one containing `tag`
    cuts.find_preceding_cut(tag)
}

// CI (presubmit) should fail on lint violations
// cargo dylint --lib appearance_theme_in_tab_path -- -D warnings

Net effect: release artifacts are correct, rules are enforced automatically, and CI results match across machines.