homelab/stack
1
0
Fork 0
Code Issues 114 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

pkg-pipeline-abstract: CI-agnostic pipeline definition for all package operations #168

New Issue
Closed
opened 2026-03-24 03:54:38 +00:00 by kert · 0 comments
kert commented 2026-03-24 03:54:38 +00:00
Owner
Copy Link

Goal

Define the package supply chain pipeline in a CI-agnostic format that generates concrete workflow files for Gitea Actions, Woodpecker, and GitHub Actions.

Scope

  • Abstract definition: dev/pipelines/pkg-supply-chain.yml (custom schema)
  • Steps: inventory → mirror-sync → drift-check → vuln-scan → issue-create
  • Generator script: dev/scripts/generate_ci.py that emits:
    • .gitea/workflows/pkg-supply-chain.yml
    • .woodpecker/pkg-supply-chain.yml
    • .github/workflows/pkg-supply-chain.yml
  • Each generated file uses the same scripts/containers, only CI syntax differs
  • Triggers: on push (if Dockerfile/pyproject.toml/uv.lock changed), on schedule (daily)

Acceptance

  • uv run python dev/scripts/generate_ci.py produces valid workflow files for all 3 CI systems
  • Generated Gitea Actions workflow runs successfully
  • Pipeline includes: inventory, mirror sync, drift detection, vuln scanning, auto-issue creation
## Goal Define the package supply chain pipeline in a CI-agnostic format that generates concrete workflow files for Gitea Actions, Woodpecker, and GitHub Actions. ## Scope - Abstract definition: `dev/pipelines/pkg-supply-chain.yml` (custom schema) - Steps: inventory → mirror-sync → drift-check → vuln-scan → issue-create - Generator script: `dev/scripts/generate_ci.py` that emits: - `.gitea/workflows/pkg-supply-chain.yml` - `.woodpecker/pkg-supply-chain.yml` - `.github/workflows/pkg-supply-chain.yml` - Each generated file uses the same scripts/containers, only CI syntax differs - Triggers: on push (if Dockerfile/pyproject.toml/uv.lock changed), on schedule (daily) ## Acceptance - [ ] `uv run python dev/scripts/generate_ci.py` produces valid workflow files for all 3 CI systems - [ ] Generated Gitea Actions workflow runs successfully - [ ] Pipeline includes: inventory, mirror sync, drift detection, vuln scanning, auto-issue creation
kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-03-24 03:54:38 +00:00
kert added the cipipeline:ci labels 2026-03-24 03:54:38 +00:00
kert closed this issue 2026-03-24 04:35:00 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label ci pipeline:ci
Milestone
No items
No Milestone P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#168
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?