ci: consolidate cicd workflow lanes, clean up helpers, and align CI docs #86

Merged

darkhelm merged 9 commits from docs/cicd-renovate-sync into main 2026-07-17 17:14:05 -04:00

Conversation 1 Commits 9 Files Changed 8 +996 -459

darkhelm commented 2026-07-16 13:19:08 -04:00

Owner

Copy Link

Summary

This PR simplifies the CICD workflow by merging related lanes, reducing duplicated script logic, and keeping the same overall pipeline behavior and gates. It also updates CI documentation to match the new job topology.

What Changed

Workflow consolidation

• Merged base and complete CICD image publication into one producer job:
  • Build and Push CICD Images
• Merged dependency audits into one informational lane:
  • Dependency Audits (Informational)
• Merged runtime image build lanes into one release producer:
  • Build Release Images
• Merged tester image build lanes into one tester producer:
  • Build Tester Images

Dependency/gate rewiring

• Updated downstream needs to consume merged producers.
• Kept output contracts for deployable and tester image references.
• Updated production and postmortem gates to the new job IDs.

Cleanup/simplification

• Removed duplicate helper-function definition(s) in CICD scripts.
• Replaced a manual docker login retry loop with existing retry helper usage.
• Removed redundant shell option declarations where behavior was unchanged.
• Removed one unused E2E environment variable.

Documentation alignment

• Updated CI architecture documentation to reflect merged workflow lanes.
• Updated troubleshooting guidance to reference current job sequencing.

Why

• Reduce job startup overhead on self-hosted runners.
• Keep behavior consistent while lowering workflow complexity.
• Improve maintainability by removing duplicated/unused script fragments.
• Keep docs in sync with operational workflow reality.

Validation

• Workflow file checks passed with pre-commit.
• Documentation checks passed with pre-commit (including markdownlint/prettier).
• No diagnostics/errors reported for updated workflow/docs files.

Risk and Impact

• Low-to-medium operational risk due to job-ID/needs rewiring.
• Mitigated by preserving output keys consumed by integration and e2e lanes.
• Audit lane remains informational-only (non-blocking), same intent as before.

## Summary This PR simplifies the CICD workflow by merging related lanes, reducing duplicated script logic, and keeping the same overall pipeline behavior and gates. It also updates CI documentation to match the new job topology. ## What Changed ### Workflow consolidation - Merged base and complete CICD image publication into one producer job: - Build and Push CICD Images - Merged dependency audits into one informational lane: - Dependency Audits (Informational) - Merged runtime image build lanes into one release producer: - Build Release Images - Merged tester image build lanes into one tester producer: - Build Tester Images ### Dependency/gate rewiring - Updated downstream needs to consume merged producers. - Kept output contracts for deployable and tester image references. - Updated production and postmortem gates to the new job IDs. ### Cleanup/simplification - Removed duplicate helper-function definition(s) in CICD scripts. - Replaced a manual docker login retry loop with existing retry helper usage. - Removed redundant shell option declarations where behavior was unchanged. - Removed one unused E2E environment variable. ### Documentation alignment - Updated CI architecture documentation to reflect merged workflow lanes. - Updated troubleshooting guidance to reference current job sequencing. ## Why - Reduce job startup overhead on self-hosted runners. - Keep behavior consistent while lowering workflow complexity. - Improve maintainability by removing duplicated/unused script fragments. - Keep docs in sync with operational workflow reality. ## Validation - Workflow file checks passed with pre-commit. - Documentation checks passed with pre-commit (including markdownlint/prettier). - No diagnostics/errors reported for updated workflow/docs files. ## Risk and Impact - Low-to-medium operational risk due to job-ID/needs rewiring. - Mitigated by preserving output keys consumed by integration and e2e lanes. - Audit lane remains informational-only (non-blocking), same intent as before.

darkhelm added 1 commit 2026-07-16 13:19:12 -04:00

Update CI and Renovate docs to match current workflows ff51f04c36

darkhelm added 1 commit 2026-07-16 13:41:08 -04:00

ci: consolidate cicd lanes and align docs 3d045f71f6

darkhelm added 1 commit 2026-07-16 17:07:00 -04:00

ci: guard second checkout in merged build_cicd job 4c6015d3e0

darkhelm added 1 commit 2026-07-16 22:10:55 -04:00

ci: always run backend dependency audit c52a385b02

darkhelm added 1 commit 2026-07-17 07:40:07 -04:00

ci/docs: finalize staging promotion flow and docs sync 8318294e0b

darkhelm commented 2026-07-17 07:41:59 -04:00

Author

Owner

Copy Link

Update since original PR description:

This PR now includes additional CI behavior changes and full doc alignment updates beyond the initial consolidation work.

What changed since the original description

1. Dependency audits are now informational-only, but both always run

• In .gitea/workflows/cicd.yaml, the dependency-audits job now keeps both frontend and backend audit steps non-blocking via step-level continue-on-error: true.
• Backend audit explicitly uses if: always() so it still runs even if frontend audit fails.
• Net effect: both audit reports are produced every run; audit failures no longer fail the overall workflow.

2. Runtime image publication now uses staging repos first

• Build Release Images now publishes deployable runtime artifacts to:
  • darkhelm.org/deployable-backend-staging
  • darkhelm.org/deployable-frontend-staging
• This decouples build/publish from final release tagging.

3. Added explicit promotion gate after runtime validation

• New promote-release-images job (Promote Staging Images To Release) was added.
• It runs only after:
  • build_cicd
  • build-release-images
  • integration-tests
  • e2e-tests
• It promotes validated staging digests to release repos:
  • darkhelm.org/deployable-backend
  • darkhelm.org/deployable-frontend
• It pushes latest, version tag, and build tag.

4. Release version/tag strategy formalized in workflow

• SHORT_SHA is fixed to 7 chars.
• If HEAD has a semver tag (vX.Y.Z), that exact semver is used.
• Otherwise, workflow derives latest semver baseline and auto-increments patch (including checking existing release tags in registry for the same major/minor line).
• Build tag format: <semver>-<short_sha>.

5. Documentation synchronized to current workflow behavior
   Updated docs:

• docs/CICD_MULTI_STAGE_BUILD.md
• docs/DEVELOPMENT.md
• docs/CICD_TROUBLESHOOTING_GUIDE.md
• docs/CICD_SUCCESS_SUMMARY.md
• docs/DEPLOYABLE_RUNTIME_CONTRACT.md

Doc updates include:

• current job topology and lane naming
• informational audit semantics
• staging -> promotion release lifecycle
• release tag/version rules
• troubleshooting entries for promotion and version-selection behavior

Implementation note

During finalization, a YAML parse issue in cicd.yaml (multiline Python string in promotion logic) was corrected so pre-commit check-yaml passes and the branch now pushes cleanly.

Update since original PR description: This PR now includes additional CI behavior changes and full doc alignment updates beyond the initial consolidation work. ## What changed since the original description 1. Dependency audits are now informational-only, but both always run - In `.gitea/workflows/cicd.yaml`, the `dependency-audits` job now keeps both frontend and backend audit steps non-blocking via step-level `continue-on-error: true`. - Backend audit explicitly uses `if: always()` so it still runs even if frontend audit fails. - Net effect: both audit reports are produced every run; audit failures no longer fail the overall workflow. 2. Runtime image publication now uses staging repos first - `Build Release Images` now publishes deployable runtime artifacts to: - `darkhelm.org/deployable-backend-staging` - `darkhelm.org/deployable-frontend-staging` - This decouples build/publish from final release tagging. 3. Added explicit promotion gate after runtime validation - New `promote-release-images` job (`Promote Staging Images To Release`) was added. - It runs only after: - `build_cicd` - `build-release-images` - `integration-tests` - `e2e-tests` - It promotes validated staging digests to release repos: - `darkhelm.org/deployable-backend` - `darkhelm.org/deployable-frontend` - It pushes `latest`, version tag, and build tag. 4. Release version/tag strategy formalized in workflow - `SHORT_SHA` is fixed to 7 chars. - If HEAD has a semver tag (`vX.Y.Z`), that exact semver is used. - Otherwise, workflow derives latest semver baseline and auto-increments patch (including checking existing release tags in registry for the same major/minor line). - Build tag format: `<semver>-<short_sha>`. 5. Documentation synchronized to current workflow behavior Updated docs: - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/DEVELOPMENT.md` - `docs/CICD_TROUBLESHOOTING_GUIDE.md` - `docs/CICD_SUCCESS_SUMMARY.md` - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` Doc updates include: - current job topology and lane naming - informational audit semantics - staging -> promotion release lifecycle - release tag/version rules - troubleshooting entries for promotion and version-selection behavior ## Implementation note During finalization, a YAML parse issue in `cicd.yaml` (multiline Python string in promotion logic) was corrected so pre-commit `check-yaml` passes and the branch now pushes cleanly.

darkhelm added 1 commit 2026-07-17 12:17:55 -04:00

ci: make release promotion tag-driven and keep audits informational f5f5c75949

darkhelm added 1 commit 2026-07-17 12:53:49 -04:00

ci: harden registry auth host pinning for runner DNS cb491dabd4

darkhelm added 1 commit 2026-07-17 15:21:01 -04:00

ci: auto-tag main promotions from v0.0.0 baseline 16d6569acd

darkhelm added 1 commit 2026-07-17 15:57:20 -04:00

docs: document main-only auto-tagged promotions f1a32f20c0

darkhelm merged commit e539f9b0d8 into main 2026-07-17 17:14:05 -04:00

darkhelm referenced this issue from a commit 2026-07-17 17:14:06 -04:00

ci: consolidate cicd workflow lanes, clean up helpers, and align CI docs (#86)

darkhelm deleted branch docs/cicd-renovate-sync 2026-07-17 17:14:11 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

afk

Autonomous-friendly issue

algorithm

Selection logic

api

API contract

backend

Backend related

database

Database related

devex

Developer experience

docs

Documentation

epic

Top-level planning item

frontend

Frontend related

hitl

Requires human-in-the-loop decision

ingestion

Ingestion/sync

ops

Operations

performance

Performance

realtime

Realtime/eventing

release

Release readiness

security

Security

task

Implementation ticket

testing

Testing

ui

UI/UX

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

copilotcoder darkhelm renovate-bot repository-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DarkHelm.org/plex-playlist#86