Modern Concourse pipeline and shared CI tools image#5686
Merged
norman-abramovitz merged 3 commits intoJul 23, 2026
Conversation
New modern pipeline under ci/ (the legacy deploy/ci/ node:8 pipelines are untouched): gate on tracked-branch commits, nightly report-only audit (make audit + modrot), and v* tag-triggered release running the same make targets as release.yml. Tasks are thin make callers in the shared tools image; all logic stays in the Makefile and build/ scripts. Structure file ci/pipeline.yml carries spruce (( param )) asserts so an incomplete config fails the merge loudly; operators copy ci/settings.yml.example to the untracked ci/settings.yml and deploy with ci/repipe (needs spruce, jq, fly — operator-side only, workers never see them). Validated: spruce merge + fly validate-pipeline.
One image (ghcr.io/cloudfoundry/stratos-ci) for every runner to execute the same make targets in: node 24 + bun + go 1.26.5, gh CLI, and the make audit scanner set (gosec, govulncheck, modrot, osv-scanner, gitleaks, trivy, zizmor). Replaces the legacy node:8 deploy/ci/Dockerfile.concourse for CI purposes. Built and pushed by the new ci-image.yml workflow on changes under ci/tools-image/. Deliberately absent until a job needs them: ZAP (DAST workstream cloudfoundry#5679) and golangci-lint (no lint job; its from-source build is also the image's biggest compile). Smoke-built locally; all tools verified runnable in the image.
dev.144 rides the open release-notes-fragments PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a modern Concourse pipeline under
ci/and the shared CI tools image both CIs can runmaketargets in. The legacydeploy/ci/node:8 pipelines are untouched — this is a clean replacement path, not a modernization of them.Pipeline (
ci/)Every task is a thin caller of the same
maketargets a developer or GitHub Actions runs — no logic lives in the pipeline YAML.gatemake check gateauditmake audit+make audit modrot(report-only)releasev*tagmake build→make release cf github→make publish— the same path as the release.yml workflow; notes come from the annotated tag bodyci/pipeline.ymlis a spruce structure file: required settings are(( param ))asserts, so an incomplete config fails the merge loudly instead of reaching Concourse. Operators copyci/settings.yml.exampleto the untrackedci/settings.yml(secrets can resolve via spruce's vault operator) and deploy withci/repipe. spruce/jq/fly are operator-side only — workers receive fully-resolved YAML.Validated with
spruce merge+fly validate-pipeline, including the missing-settings failure path.Tools image (
ci/tools-image/)One image —
ghcr.io/cloudfoundry/stratos-ci— with node 24 + bun + go 1.26.5 (modrot and osv-scanner need ≥ 1.26.4), gh CLI, and themake auditscanner set (gosec, govulncheck, modrot, osv-scanner, gitleaks, trivy, zizmor). Replaces the legacy node:8deploy/ci/Dockerfile.concoursefor CI purposes; the newci-image.ymlworkflow builds and pushes it on changes underci/tools-image/. GitHub Actions jobs can consume the same image viacontainer:.Smoke-built locally and every tool verified runnable inside the image. zizmor is clean on the new workflow.
Deliberately deferred until a job needs them: ZAP (joins with the DAST workstream, #5679) and golangci-lint (no lint job yet; it is also the image's biggest from-source compile). The all-in-one docker image build stays in GitHub Actions — it is a docker build/push, not a
maketarget.Bumps to v5.0.0-dev.145 (dev.144 rides #5685) and carries its changelog.d fragment per the mechanism introduced there.