# GitHub Actions

This repository runs a single **Continuous Integration(CI)** workflow that lints, versions, and publishes the CORTEX Helm chart and its documentation.

:::{tip}

This repository does not deploy CORTEX to any Kubernetes cluster or cloud
environment.  Deployment is handled entirely by the
[cortex-meta](https://github.com/ResearchDataCom/cortex-meta) repository, which
consumes the Helm chart released here.  The only automation in this repository
is the `ci.yaml` pipeline described below.

:::

## CI Pipeline

The `ci.yaml` workflow runs on every push and pull request.    On pushes to the
`main` branch it additionally cuts a release and publishes the chart and
documentation.  Its jobs are:

- `lint`  run the pre-commit hooks (YAML, shell, GitHub Actions, and Python
  checks) across the repository.
- `release`  use [commitizen](https://commitizen-tools.github.io/commitizen/)
  to compute the next semantic version from the Conventional Commits history,
  bump `pyproject.toml` and `Chart.yaml`, update the changelog, and tag the
  release.
- `github`  create the corresponding GitHub release.
- `docs`  build the versioned Sphinx documentation site.
- `ghpages`  publish the documentation to GitHub Pages.
- `pdf` build a single-file PDF of the documentation and attach it to the
  release.
- `chart` package the Helm chart with
  [chart-releaser](https://github.com/helm/chart-releaser) and publish it to the
  chart repository hosted on GitHub Pages, so consumers can
  `helm repo add cortex https://cortex.rdctdev.us`.

Only `lint` runs on feature branches and pull requests; the release, publishing,
and packaging jobs run on `main` only, and only after a release is cut.

## Private Repository Access

:::{admonition} Guidance

GitHub Actions workflows **MUST** use temporary credentials with read
access to the private GitHub repositories sourced by the build.

:::

The `lint` job authenticates to the private repositories it needs with a
short-lived GitHub App token rather than long-lived credentials, which limits
the scope of a possible supply-chain attack.