GitHub Actions

This repository runs a single Continuous Integration(CI) workflow that lints, versions, and publishes the CORTEX Helm chart and its documentation.

Tip

This repository does not deploy CORTEX to any Kubernetes cluster or cloud environment. Deployment is handled entirely by the cortex-meta repository, which consumes the Helm chart released here. The only automation in this repository is the ci.yaml pipeline described below.

CI Pipeline

The ci.yaml workflow runs on every push and pull request. On pushes to the main branch it additionally cuts a release and publishes the chart and documentation. Its jobs are:

• lint run the pre-commit hooks (YAML, shell, GitHub Actions, and Python checks) across the repository.

• release use commitizen to compute the next semantic version from the Conventional Commits history, bump pyproject.toml and Chart.yaml, update the changelog, and tag the release.

• github create the corresponding GitHub release.

• docs build the versioned Sphinx documentation site.

• ghpages publish the documentation to GitHub Pages.

• pdf build a single-file PDF of the documentation and attach it to the release.

• chart package the Helm chart with chart-releaser and publish it to the chart repository hosted on GitHub Pages, so consumers can helm repo add cortex https://cortex.rdctdev.us.

Only lint runs on feature branches and pull requests; the release, publishing, and packaging jobs run on main only, and only after a release is cut.

Private Repository Access

Guidance

GitHub Actions workflows MUST use temporary credentials with read access to the private GitHub repositories sourced by the build.

The lint job authenticates to the private repositories it needs with a short-lived GitHub App token rather than long-lived credentials, which limits the scope of a possible supply-chain attack.