Skip to content

CI-CD.md

Latest commit

 

History

History
110 lines (88 loc) · 4.59 KB

CI-CD.md

File metadata and controls

110 lines (88 loc) · 4.59 KB
Raw

CI/CD pipeline — CVE Radar

GitHub Actions workflows are grouped by file prefix under .github/workflows/. GitHub only loads YAML in that folder root (not subfolders).

Index: workflows/README.md · Secrets: ACTIONS-SECRETS.md

Pipeline overview

flowchart LR
  subgraph PR["Pull request → main"]
    CI[ci-*]
    SEC[security-*]
    QUA[quality-*]
  end

  subgraph Main["Push → main"]
    CI2[ci-*]
    SEC2[security-*]
    QUA2[quality-*]
    DEP[deploy-pages]
  end

  subgraph Tag["Tag v*"]
    REL[release-*]
    DEP2[deploy-pages]
  end

  subgraph Ops["Manual / scheduled"]
    OPS[ops-*]
    AUTO[automation-*]
    CODEQL_W[security-codeql weekly]
  end

  PR --> CI & SEC & QUA
  Main --> CI2 & SEC2 & QUA2 & DEP
  Tag --> REL & DEP2
Loading

Categories

Prefix Stage Purpose Runbook
ci- Continuous integration Build & verify before merge workflows/ci/README.md
security- Security Audits, SAST, container scan workflows/security/README.md
quality- Quality Coverage, bundle size, SonarCloud workflows/quality/README.md
deploy- Deploy GitHub Pages workflows/deploy/README.md
release- Release Semver tag publishing workflows/release/README.md
ops- Operations Docker Hub maintenance workflows/ops/README.md
automation- Automation Issue bots & helpers workflows/automation/README.md

Triggers by lifecycle

Event Workflows that run
Pull request → main All ci-*, security-*, quality-* (path-filtered)
Push → main Same + deploy-pages (docs paths) + ops-dockerhub-metadata (dockerhub docs)
Tag v* release-github (dispatches deploy-pages on main), release-docker-hub
Schedule security-codeql, security-audit, security-pip-audit, security-container-trivy (weekly)
Issue opened automation-issue-summary (non-bot, no no-ai-summary label)
workflow_dispatch All except issue-only automation

Required vs optional checks

Job name Category Branch protection
App (lint · typecheck · build) CI Recommended required
npm audit Security Recommended required
pip audit Security Recommended
dependency-review Security Recommended (PRs)
Extended docs (MkDocs strict) CI Recommended required
Analyze (javascript-typescript) Security Recommended
Trivy Security Optional
SonarCloud Code Analysis Quality Optional (SONAR_TOKEN)
Run tests and collect coverage Quality Optional (CODECOV_TOKEN)
Docker image (build only) CI Optional (path-filtered)

Skipped workflows (path filters) do not block merge unless marked required in branch protection.

Secrets & variables by category

Category Secrets / variables Doc
Quality CODECOV_TOKEN CODECOV.md
Quality SONAR_TOKEN SONARCLOUD.md
CI MERGIFY_TOKEN ACTIONS-SECRETS.md
Release / Ops DOCKERHUB_USERNAME, DOCKERHUB_TOKEN docs/DOCKER.md
Deploy DOCS_SITE_URL (variable) ACTIONS-SECRETS.md

Related automation (not Actions workflows)

Tool File Role
Dependabot dependabot.yml Weekly npm / pip / Actions updates
Mergify .mergify.yml Merge queue, protections, Test Insights — MERGIFY.md
Codecov config codecov.yml Coverage thresholds & PR comments (repo root)
SonarCloud config sonar-project.properties Analysis scope & exclusions

Local parity

make check                 # mirrors ci-app (app)
make extended-docs-check   # mirrors ci-docs
npm audit --omit=dev       # mirrors security-audit
pip install pip-audit && pip-audit -r extended-docs/requirements.txt  # mirrors security-pip-audit
docker build -t cve-radar:ci .   # mirrors ci-docker-smoke
npm run test:ci            # mirrors quality-codecov / quality-sonarcloud tests step

See docs/CONTRIBUTING.md for contributor checklist.