The guard I reviewed, approved, and never actually ran

I spent a day writing guards into a build config. Deploy by digest instead of by tag, refuse to deploy when a required value is empty, run the tests between install and build.

Then I created the CI trigger from the console wizard, because it was right there.

The wizard writes its own build steps inline, and a trigger with inline steps ignores the file in your repo completely. So every guard I'd written was reviewed, committed, and never ran once.

What makes it the worst kind of bug is that nothing failed. The builds were green. The deploys worked. The file sat in the repo looking like protection.

I found it by accident, while looking for something else, because the trigger had no filename set.

It's going into prodcheck as its own item. "The config you reviewed is the config that runs" is an assumption almost nobody checks, and checking it takes one command.

Does your CI trigger point at your repo's file, or carry its own copy?