Skip to content

ci-cd.md

Latest commit

 

History

History
85 lines (63 loc) · 1.76 KB

ci-cd.md

File metadata and controls

85 lines (63 loc) · 1.76 KB

CI/CD Contract

Workflows

.github/workflows/Tests.yml    CI
.github/workflows/Release.yml  CD

CI

Triggers:

pull_request
push branches
workflow_dispatch

Permissions:

permissions:
  contents: read

Gates:

cmake -S "$GITHUB_WORKSPACE" -B "$GITHUB_WORKSPACE/$BUILD_DIR" ...
cmake --build "$BUILD_DIR" --config "$BUILD_TYPE" --parallel "$(nproc)"
ctest --test-dir "$BUILD_DIR" --build-config "$BUILD_TYPE" --output-on-failure --timeout 120
timeout 180 python -m pytest "$GITHUB_WORKSPACE/C2Client/tests" -vv -s
cmake --build "$BUILD_DIR" --target validate_release_bundle --config "$BUILD_TYPE"
cmake --build "$BUILD_DIR" --target stage_integration_runtime --config "$BUILD_TYPE"

CD

Triggers:

push tags
workflow_dispatch

Build job permissions:

permissions:
  contents: read

Publish job permissions:

permissions:
  contents: write

Gates before publishing:

ctest --test-dir "$BUILD_DIR" --build-config "$BUILD_TYPE" --output-on-failure --timeout 120
timeout 180 python -m pytest "$GITHUB_WORKSPACE/C2Client/tests" -vv -s
cmake --build "$BUILD_DIR" --target validate_release_bundle --config "$BUILD_TYPE"
python packaging/import_implant_releases.py ...
python packaging/validate_release.py --release-root "$BUILD_DIR/release-staging/Release" --require-implants
tar -C "$BUILD_DIR/release-staging" -czf Release.tar.gz Release

Cache

pip cache from C2Client dependency files
Conan cache from conanfile.txt, conan.lock, conan/profiles/linux-gcc13

Rules

  • CI runs before release.
  • CD publishes only after build and tests pass.
  • Archive is created from validated staging.
  • Default GitHub token permission is read-only.
  • Only the publish job gets contents: write.