Bootstrap the Giant Swarm line: CI on the giantswarm branch, publishing to ghcr.io/giantswarm/substrate, upstream sync, ledger - #1
Merged
Conversation
… requests The consumed branch of the Giant Swarm line is giantswarm, not main (main is the upstream mirror): pr-workflow and helm-e2e trigger on pushes to it, govulncheck on pushes to it, on pull requests and weekly on the default branch. Signed-off-by: Timo Derstappen <timo@giantswarm.io>
…t with upstream publish.yaml: every push to giantswarm publishes the six images the agent platform runs (ateapi, atecontroller, atelet, atenet, podcertcontroller, ateom-gvisor; linux/amd64+arm64 with ko), a digest-true mirror of the agentgateway image the chart deploys, and both charts with their image defaults stamped to this registry, as dev versions <next upstream patch>-dev.giantswarm.<date>.<time>.h<sha7>; a v* tag publishes a release. Every own image is Trivy-scanned before the charts are pushed; .trivyignore holds time-boxed acceptances only. sync-upstream.yaml (weekly + dispatch, taylorbot token): force-mirrors upstream main (upstream rebases its main onto agent-substrate), probes whether the carried patches still rebase onto it, and on a pin input re-pins the branch — rebase, build, test, force-push — or opens a hand-over pull request naming the conflicting patch. Signed-off-by: Timo Derstappen <timo@giantswarm.io>
…Giant Swarm line FORK.md records the pin (v0.0.26, kagent's go.mod replace), the carried patches with their upstream state, the re-pin procedure, what is published where and under which versions, the assets that are not images (gVisor runsc, micro-VM), the consumers, and how to contribute (upstream first, DCO). Team Bumblebee owns the fork (giantswarm/giantswarm#37757). Signed-off-by: Timo Derstappen <timo@giantswarm.io>
A negated grep never trips set -e; the check that no upstream registry reference survives the stamping now fails the job explicitly. Signed-off-by: Timo Derstappen <timo@giantswarm.io>
giantswarm/github's align-files writes a root CODEOWNERS for every repository of a team file and overwrites one it recognises as generated; keeping the same content here means the align run finds nothing to change. Signed-off-by: Timo Derstappen <timo@giantswarm.io>
hack/verify/boilerplate.sh (part of run-tests) requires the Apache header on every source file; the fork's files carry it as The Agent Substrate Authors. Signed-off-by: Timo Derstappen <timo@giantswarm.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fork's own files for the line described in FORK.md (tracking: giantswarm/giantswarm#37757, epic giantswarm/giantswarm#37705). The
giantswarmbranch this targets is v0.0.26 (the pingiantswarm/kagent-upstreamnames ingo/go.mod) plus the cherry-pick of kagent-dev#33.pr-workflow.yaml,helm-e2e.yamltrigger on pushes togiantswarm(notmain, which is the upstream mirror);govulncheck.yamlon pushes, pull requests and weekly.publish.yaml: on every push togiantswarmthe six images the platform runs (ateapi,atecontroller,atelet,atenet,podcertcontroller,ateom-gvisor; linux/amd64+arm64, ko), a digest-true mirror of the agentgateway image the chart deploys, and both charts withimage.registry/image.tag/images.agentgatewaystamped toghcr.io/giantswarm/substrate, as0.0.27-dev.giantswarm.<date>.<time>.h<sha7>;v*tags publish releases. Trivy scans every own image (fixable HIGH/CRITICAL fails;.trivyignorefor time-boxed acceptances) before the charts are pushed. Digests in the run summary and theimage-refsartifact.sync-upstream.yaml: weekly + dispatch with the taylorbot token — force-mirrors upstreammain(upstream rebases itsmain), probes the rebase of the carried patches, and with apininput re-pins the branch (rebase, build, test, force-push) or opens a hand-over PR naming the conflicting patch..github/CODEOWNERS(team-bumblebee),FORK.md, a pointer at the top of the README.This pull request is itself the first proof that upstream's suites run on pull requests to the line. Merging it (squash) is the first push to
giantswarmthat triggerspublish.