Skip to content

SKILL.md

Latest commit

 

History

History
124 lines (91 loc) · 4.32 KB

SKILL.md

File metadata and controls

124 lines (91 loc) · 4.32 KB
Raw
name nic-ci-pipelines
description CI/CD pipeline structure, GitHub Actions workflows, reusable workflow patterns, and matrix builds for NIC. Use when working on CI workflows, debugging build failures, adding new workflow steps, modifying build matrices, or understanding the release pipeline.

NIC CI/CD Pipelines

Workflow Architecture

The CI system uses GitHub Actions with extensive reusable workflow composition.

ci.yml (main CI orchestrator)
  -> checks (format, lint, codegen, CRDs, chart version)
  -> unit-tests
  -> build-artifacts.yml (reusable)
       -> build-oss.yml (per-variant, matrix)
       -> build-plus.yml (per-variant, matrix)  <- also used for NAP variants
  -> helm-tests
  -> setup-smoke.yml (reusable)
  -> e2e tests

image-promotion.yml (post-merge)
  -> builds images, tags edge/stable
  -> Trivy + DockerScout security scans
  -> publishes edge Helm charts

release.yml (manual dispatch)
  -> oss-release.yml
  -> plus-release.yml
  -> publish-helm.yml
  -> certify-ubi-image.yml
  -> marketplace pushes (AWS, Azure, GCP)

Key Workflows

Workflow Trigger Purpose
ci.yml PR to main/release-*, merge_group, workflow_dispatch Main CI: checks + build + test
lint-format.yml PR to main, merge_group goimports, gofumpt, golangci-lint, actionlint
regression.yml Daily cron (03:00 UTC), manual Multi-K8s-version regression
image-promotion.yml Push to main/release-* Post-merge image tagging + scanning
release.yml Manual dispatch Full release orchestrator
build-base-images.yml Weekday cron (04:30 UTC) Rebuilds all base images

Release Sub-Workflows (called by release.yml)

Workflow Purpose
oss-release.yml OSS image release
plus-release.yml Plus/NAP image release
publish-helm.yml Helm chart publishing to registry

Reusable Build Workflows (called via workflow_call)

Workflow Purpose
build-artifacts.yml Orchestrates GoReleaser binary builds + image matrix
build-oss.yml Builds single OSS image variant
build-plus.yml Builds single Plus/NAP image variant
build-test-image.yml Builds Python e2e test image
setup-smoke.yml Sets up and runs smoke tests
patch-image.yml OS-level patches on existing images
retag-images.yml Re-tags images in GCR Dev Registry

Security & Compliance

Workflow Purpose
codeql-analysis.yml GitHub CodeQL scanning
scorecards.yml OpenSSF Scorecards
dependency-review.yml Dependency review for PRs
certify-ubi-image.yml Red Hat UBI certification for OpenShift

CI Patterns

Matrix Builds

Image variants are defined in JSON under .github/data/:

  • matrix-images-oss.json: debian, alpine, ubi (amd64 + arm64)
  • matrix-images-plus.json: debian-plus, alpine-plus, alpine-plus-fips, ubi-10-plus
  • matrix-images-nap.json: WAF v4/v5, DoS, UBI 10 (amd64 only)
  • matrix-smoke-oss.json, matrix-smoke-plus.json, matrix-smoke-nap.json: Smoke test matrices
  • matrix-regression.json: Regression test matrix (K8s version combinations)
  • patch-images.json: Patch image definitions for patch-image.yml

Caching Strategy

  • Go binaries: cached by go_code_md5 hash
  • Docker images: cached by docker_md5 hash
  • Stable images in GCR are checked before rebuilding

Fork Awareness

forked_workflow variable gates authenticated operations. Forked PRs get local-only builds without secret access.

Concurrency

Each workflow uses group: ${{ github.ref_name }}-<suffix> with cancel-in-progress: true.

Secrets

Retrieved from Azure Key Vault via OIDC -- not stored as GitHub secrets directly.

Version Source of Truth

.github/data/version.txt contains IC_VERSION and HELM_CHART_VERSION.

Gotchas

  • Never add secrets as GitHub repository secrets -- use Azure Key Vault OIDC flow
  • Always pin GitHub Actions to immutable SHA hashes, not mutable tags
  • Matrix JSON files in .github/data/ must stay in sync with Makefile image targets
  • NAP variants are linux/amd64 only -- do not add arm64 to NAP matrices
  • Renovate manages tool versions via # renovate: comments -- do not update manually
  • image-promotion.yml runs on merge to main, not on PR -- don't expect images from PRs