Extend the .github/workflows/ci.yml pattern with a build gate: lint, unit
tests, Docker build, and smoke — all green before merge.
1. Pipeline stages
Lint (ruff/flake8) -> unit tests (pytest -q) -> docker build -> containerized
smoke (test_smoke.py). Fail fast in that order: cheap checks first.
2. Branch protections
main requires the CI workflow green + 1 review. No direct pushes; model
promotion happens via PR with the run-comparison report attached.
3. Build gate vs deploy gate
CI build gate (this lesson) proves the artifact is sound. The deploy gate (m5 flagship) proves the artifact runs somewhere real with a live URL.