feat(0.2): CI onboarding — GitHub Action template + trust ladder + init pointer (Tracks 8.4/8.5/8.6)

[pmclSF]

Summary

Closes the install → CI gate journey. Three small deliverables that work together: the recommended workflow file, the doc that explains when to flip on each rung, and the `terrain init` step that points at both.

Track 8.5 — `docs/examples/gate/github-action.yml`

The ONE recommended GitHub Action config for 0.2.0. Drops into `.github/workflows/terrain-pr.yml`. Gives adopters:

• per-PR `terrain analyze --write-snapshot --json`
• per-PR `terrain report pr` posting a unified comment (stable marker so successive runs update the same thread)
• SARIF upload to GitHub code scanning
• safe-default mode: warn-only by default; `--fail-on critical` is one uncomment away
• `--new-findings-only --baseline` baked in so adopters with existing debt don't brick CI on day one

Concurrency group + cancel-in-progress so force-pushes don't pile up runs.

Track 8.6 — `docs/product/trust-ladder.md`

The four-rung adoption path: Inventory → Warnings → CI annotations → Blocking gates. Each rung says what you do, what you get, what it doesn't do, and when to move up.

The fundamental pattern this addresses: teams that jump from Rung 1 to Rung 4 in one step have CI bricking on day one against inherited debt. The ladder makes "see signals first, gate later" the recommended path, with the recommended config matching it.

Cross-links to vision.md, feature-status.md, policy/examples/, github-action.yml. An adopter who lands on any one of those docs can navigate to the rest.

Track 8.4 — `terrain init` CI pointer

`terrain init`'s "Next steps" output now includes a final step pointing at the recommended workflow + trust ladder. Policy step references the three starter policies instead of the "uncomment stuff" workflow. Flow from `terrain init` to a working CI gate is now four bullet points instead of five separate doc trails.

Pillar parity impact

• Area 12 (Distribution / install) P4 (Onboarding): 2 → 3
• Cross-cutting Examples axes across multiple areas via the recommended config + trust ladder
• The `init` extension closes a P4 (Onboarding) gap on area 1 (Core analyze pipeline) too

Test plan

• `go test ./...` full suite green
• `go test ./internal/engine/ -run TestRunInit` — all 9 init tests green
• Manual: read `trust-ladder.md` end-to-end; cross-references resolve; the four-rung path makes sense
• Manual: `docs/examples/gate/github-action.yml` parses as valid YAML

Plan link

`/Users/pzachary/.claude/plans/kind-mapping-turing.md` (Tracks 8.4 / 8.5 / 8.6).

🤖 Generated with Claude Code

[github-actions]

Terrain AI Risk Review

Metric	Value
AI surfaces	13
Eval scenarios	16
Impacted scenarios	0
Uncovered surfaces	13

Decision: PASS — AI surfaces are covered.

[github-actions]

[INFO] Terrain — Informational only

Insufficient data to assess change risk confidently.

Metric	Value
Changed files	3 (1 source · 0 test)
Impacted units	1
Protection gaps	1
Tests selected	18 of 772 (2% of suite)

---

Coverage gaps in changed code

• cmd/terrain/cmd_analyze.go [LOW] — cmd_analyze.go has no observed test coverage.
  → Add unit tests for cmd_analyze.go.

---

Pre-existing issues (1)

• cmd/terrain/cmd_analyze.go [HIGH] — [blastRadiusHotspot] Changes to this file propagate to 162 tests (162 direct, 0 indirect). High blast radius increases regression risk.

---

Recommended tests

18 test(s) selected via structural heuristics. 1 unit(s) remain uncovered. 1 impacted unit(s) have no covering tests in the selected set.

Package	Tests	Sample
cmd/terrain	18	cmd/terrain/ai_workflow_test.go ...

---

Limitations

• No coverage artifacts provided; protection gaps reflect missing data, not measured absence. Provide --coverage to improve accuracy.
• Mixed test cultures reduce cross-framework optimization confidence. Consider standardizing on fewer frameworks.

_{Generated by Terrain · terrain pr --json for machine-readable output}

Targeted Test Results

Terrain selected 18 test(s) instead of the full suite.

• Go tests: passed