From 9517447ee889871f2b56db7bb4546cca6ef947ca Mon Sep 17 00:00:00 2001 From: Brooke Storm Date: Wed, 27 May 2026 15:22:41 -0700 Subject: [PATCH] ci: update CI readme to more current information Signed-off-by: Brooke Storm --- .github/CI_README.md | 61 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 50 insertions(+), 11 deletions(-) diff --git a/.github/CI_README.md b/.github/CI_README.md index 5d37652c2d..6f02da2229 100644 --- a/.github/CI_README.md +++ b/.github/CI_README.md @@ -6,35 +6,74 @@ reusable actions, and supporting docs. ## What Lives Here - `workflows/` - GitHub Actions workflow definitions for source validation, Studio CI, GPU - tests, semantic PR checks, and releases. + GitHub Actions workflow definitions for source validation, Studio CI, + documentation, security scanning, semantic PR checks, DCO merge-queue + handling, and releases. - `actions/` - Local composite actions shared across workflows. + Local composite actions shared across workflows: change detection, policy + WASM builds, disk cleanup, and self-hosted runner metadata. ## Workflow Overview ### CI Check Workflows - `ci.yaml` - Main Python unit/integration/lint CI workflow. Parts of this must pass for - merge. On successful `main` pushes, it also sends a generic completion event - to an external CI consumer. + Main source validation workflow. It runs linting, OPA policy WASM build, + Python unit tests, Python integration tests, OPA policy tests, and PR + coverage comments. It runs on pushes to `main`, pull requests to `main`, + merge queue checks, and manual dispatch. On successful `main` pushes, it + also sends a completion event to an external CI consumer. - `studio-ci.yaml` - Frontend/Studio CI workflow. + Frontend/Studio workflow. It runs Studio type checks, tests, formatting, + linting, dependency checks, and scripts checks for relevant web changes. + Studio UI E2E tests run only on manual dispatch. + +- `security.yaml` + Security workflow. It runs TruffleHog secrets scanning and CodeQL analysis on + pushes to `main`, pull requests to `main`, and manual dispatch. It also runs + in merge queues so required checks can resolve, but the TruffleHog job + intentionally skips its scan for `merge_group` events. + +- `docs.yaml` + Documentation workflow. It builds docs for relevant docs changes, deploys + GitHub Pages on `main` pushes, tag pushes, and manual dispatch, deploys PR + previews for same-repository PRs, and cleans up PR previews when those PRs + close. - `semantic-pull-requests.yaml` Pull request title validation. +- `dco-war.yaml` + Merge queue compatibility shim for the DCO check. Normal DCO validation comes + from the installed DCO app. + ### Deployment and Release Workflows -- `release*.yaml` - Nightly, RC, and stable release orchestration. These consume a reusable workflow file to minimize - duplication. +- `release-nightly.yaml` + Scheduled and manually dispatched nightly release orchestration. + +- `release-rc.yaml` + Manually dispatched release candidate orchestration. + +- `release-stable.yaml` + Manually dispatched stable release orchestration. It includes a preview step + and requires the `release-stable` environment approval before producing the + release bundle. + +- `release-bundle.yaml` + Reusable release implementation shared by nightly, RC, and stable workflows. + It validates release inputs, creates release tags when needed, builds SDK + wheels, assembles the release bundle artifact, and dispatches the downstream + release handoff event. ## GitHub Apps - DCO app Developer Certificate of Origin (DCO) checks are handled by the installed DCO - app, not by a repository workflow. + app, not by a repository workflow. The `dco-war.yaml` workflow exists only + because the DCO app does not currently understand merge queue checks. The + ruleset allows any source named `DCO` to satisfy the required check so merge + queue entries can pass. When the DCO app supports merge queues, change the + ruleset to require the app-owned DCO check instead and remove the workaround.