tools-cicd

share cicd scripts

Running tool locally

Example:

uv sync
AWS_PROFILE=dev-admin-terraform uv run cicd --help
uv run cicd --version      # or `cicd version`
uv run pytest

Release Procedures

• This project uses "trunk" based development off of master.
• PRs are allowed but always folded back to master.
• Releasing is manual through the publish.yml workflow.
• To release:
  • Ensure all your features are ready on master
  • Trigger the publish.yml workflow with workflow_dispatch and choose patch, minor, or major for bump.
    • The workflow runs uv version --bump to auto-rev the version, commits pyproject.toml + uv.lock, tags vX.Y.Z, then builds with uv build and publishes to PyPI.

Multi-Repository Release Coordination

The quest-v2 project includes a coordinated release script that allows you to trigger deployments across all related Quest v2 repositories simultaneously, rather than having to manually trigger each repository's release workflow individually.

Prerequisites

1. GitHub CLI: Install the GitHub CLI tool

   # macOS
   brew install gh
   
   # Ubuntu/Debian
   sudo apt install gh
   
   # Windows
   winget install GitHub.cli
   

2. Authentication: Authenticate with GitHub

   gh auth login
   

3. Script Setup: Navigate to the quest-v2 directory and make the script executable

   cd quest-v2
   chmod +x release-all.sh
   

Usage

From the quest-v2 directory, the script supports promoting from develop to qa:

# Promote to QA
./release-all.sh

# Show help and options
./release-all.sh --help

What it does

The script will:

1. Trigger the "Release" workflow on all three Quest v2 repositories:
   • allfly-quest-ui
   • allfly-quest-core-api
   • gds-api
2. Promote code from develop branch to qa
3. Provide real-time status updates and links to monitor progress
4. Display a summary of successful and failed releases

Monitoring

After triggering the releases, you can monitor progress through:

• The provided GitHub Actions URLs in the script output
• GitHub's Actions tab in each repository
• Your configured Slack notifications (if enabled)

Note: The script requires appropriate permissions to trigger workflows on all three Quest v2 repositories. Ensure your GitHub account has the necessary access rights.

Vulnerability scans (cicd vscan)

Weekly dependency audit that also fixes what it can, as one PR per repo:

cicd vscan python                      # scan only (pip-audit against uv.lock)
cicd vscan python --fix --dry-run      # show the upgrade plan, touch nothing
cicd vscan python --fix                # upgrade uv.lock locally and re-scan
cicd vscan python --open-pr --notify   # CI: commit, open/update `chore/vscan-python` PR, post to Slack

cicd vscan npm takes the same flags. It runs npm audit fix --package-lock-only (never --force) and diffs package-lock.json to report what moved; fixes that need a breaking upgrade are listed under "Needs attention". A dry run fixes and re-audits a throwaway copy, so its report matches a real run.

• Each vulnerable package is pinned to the smallest version that fixes all of its advisories (uv lock --upgrade-package pkg==x). Upgrades that uv can't resolve (e.g. another dependency caps the version) or that exceed max_bump are listed under "Needs attention" instead.
• The PR branch is stable, so an unmerged PR is updated in place the next week instead of piling up.
• The PR must be pushed with ACTIONS_PAT (not GITHUB_TOKEN) so PR checks run on it.
• Per-repo overrides (display name, base branch, max_bump, expiring ignores) live in .github/vscan.toml; see src/allfly/vscan/config.py.
• Repos call the reusable workflow .github/workflows/vscan.yml (usage at the top of that file).
• Slack: posts when there are findings or the scan fails. Add --notify-clean (or notify_clean = true in vscan.toml) to also post on clean runs. The reusable workflow posts its own alert if the job dies before cicd can report (e.g. checkout/token errors).