Skip to content

ci: move static build and backend deploy jobs to self-hosted-k8s #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lebedevdsl wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: move static build and backend deploy jobs to self-hosted-k8s #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions .github/workflows/deploy-backend.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,11 @@ jobs:
done

deploy:
runs-on: ubuntu-latest
runs-on: self-hosted-k8s
# ci-runner ships the argocd CLI (v3.2.1) and jq; nothing is downloaded
# through NAT per run.
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest

@cubic-dev-ai cubic-dev-ai Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: This deploy job now runs with ARGO_API_KEY, but ci-runner:latest can change between runs or matrix jobs without a workflow review. Pin the approved image digest, as the static workflow does.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-backend.yaml, line 259:

<comment>This deploy job now runs with `ARGO_API_KEY`, but `ci-runner:latest` can change between runs or matrix jobs without a workflow review. Pin the approved image digest, as the static workflow does.</comment>

<file context>
@@ -252,7 +252,11 @@ jobs:
+    # ci-runner ships the argocd CLI (v3.2.1) and jq; nothing is downloaded
+    # through NAT per run.
+    container:
+      image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest
     needs: build
     if: >-
</file context>
Suggested change
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a

needs: build
if: >-
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
Expand All @@ -262,11 +266,6 @@ jobs:
flavor: ${{ fromJson(inputs.flavors) }}

steps:
- name: Setup ArgoCD CLI
uses: imajeetyadav/argocd-cli@v1
with:
version: v3.2.1

- name: Deploy ${{ matrix.flavor }} to ArgoCD
env:
ARGOCD_AUTH_TOKEN: ${{ vars.ARGO_API_KEY }}
Expand Down
21 changes: 15 additions & 6 deletions .github/workflows/deploy-static-website.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,8 @@ env:

jobs:
preview-policy:
runs-on: ubuntu-latest
# Shell-only policy evaluation; runs in the ARC runner pod itself.
runs-on: self-hosted-k8s

@cubic-dev-ai cubic-dev-ai Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Moving preview-policy, build-preview, and build-production to self-hosted-k8s breaks the enforced boundary test .github/tests/deploy-static-job-boundaries.test.rb, and it runs in validate-static-deploy.yaml on every PR touching this workflow. Lines 17, 40 and 153 abort unless runs-on == "ubuntu-latest", and lines 41/154 abort if the job defines a container. CI will fail on this PR. Update the test assertions (and drop the now-invalid "must not use a self-hosted container" checks) in the same change.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>Moving preview-policy, build-preview, and build-production to self-hosted-k8s breaks the enforced boundary test .github/tests/deploy-static-job-boundaries.test.rb, and it runs in validate-static-deploy.yaml on every PR touching this workflow. Lines 17, 40 and 153 abort unless runs-on == "ubuntu-latest", and lines 41/154 abort if the job defines a container. CI will fail on this PR. Update the test assertions (and drop the now-invalid "must not use a self-hosted container" checks) in the same change.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>

@cubic-dev-ai cubic-dev-ai Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Custom agent: Flag Security Vulnerabilities

This moves a secret-bearing PR build from an isolated GitHub-hosted VM into the cluster runner. The checkout, dependency lifecycle scripts, and pnpm build can execute repository or dependency code that may exfiltrate NPM_TOKEN or reach cluster resources; keep this build on an isolated runner or enforce and document pod isolation, disabled ServiceAccount token mounting, and restrictive network policy.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>This moves a secret-bearing PR build from an isolated GitHub-hosted VM into the cluster runner. The checkout, dependency lifecycle scripts, and `pnpm build` can execute repository or dependency code that may exfiltrate `NPM_TOKEN` or reach cluster resources; keep this build on an isolated runner or enforce and document pod isolation, disabled ServiceAccount token mounting, and restrictive network policy.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>

@cubic-dev-ai cubic-dev-ai Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: preview-policy's only step calls gh api, but the job now runs on self-hosted-k8s with no container, so it executes in the ARC runner pod's base image rather than the ci-runner container the other moved jobs use. ubuntu-latest shipped the gh CLI; nothing in the repo confirms the pod image has it. This job is the trust gate for the whole preview pipeline (its trusted output feeds build-preview and deploy-preview), so a missing gh fails the step and blocks every preview. Confirm gh and bash exist in the runner pod image, or run the job in the same ci-runner container as the other moved jobs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-static-website.yaml, line 68:

<comment>preview-policy's only step calls `gh api`, but the job now runs on `self-hosted-k8s` with no `container`, so it executes in the ARC runner pod's base image rather than the ci-runner container the other moved jobs use. ubuntu-latest shipped the `gh` CLI; nothing in the repo confirms the pod image has it. This job is the trust gate for the whole preview pipeline (its `trusted` output feeds build-preview and deploy-preview), so a missing `gh` fails the step and blocks every preview. Confirm `gh` and `bash` exist in the runner pod image, or run the job in the same ci-runner container as the other moved jobs.</comment>

<file context>
@@ -64,7 +64,8 @@ env:
   preview-policy:
-    runs-on: ubuntu-latest
+    # Shell-only policy evaluation; runs in the ARC runner pod itself.
+    runs-on: self-hosted-k8s
     permissions:
       contents: read
</file context>

permissions:
contents: read
outputs:
Expand Down Expand Up @@ -132,7 +133,11 @@ jobs:
build-preview:
needs: preview-policy
if: needs.preview-policy.outputs.trusted == 'true'
runs-on: ubuntu-latest
runs-on: self-hosted-k8s
# ci-runner ships node 22, pnpm (corepack), make and ruby (the manifest
# validator below is a Ruby heredoc). Same digest as the deploy jobs.
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a
permissions:
contents: read
pull-requests: read
Expand Down Expand Up @@ -535,7 +540,11 @@ jobs:
github.event_name == 'push' &&
github.ref == 'refs/heads/main' &&
needs.preview-policy.outputs.toolchain_allowed == 'true'
runs-on: ubuntu-latest
runs-on: self-hosted-k8s
# ci-runner ships node 22, pnpm (corepack), make and ruby (the manifest
# validator below is a Ruby heredoc). Same digest as the deploy jobs.
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a
permissions:
contents: read

Expand Down Expand Up @@ -645,7 +654,7 @@ jobs:
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: self-hosted-k8s
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a
permissions:
contents: read
id-token: write
Expand Down Expand Up @@ -707,7 +716,7 @@ jobs:
if: needs.preview-policy.outputs.trusted == 'true'
runs-on: self-hosted-k8s
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a
permissions:
contents: read
id-token: write
Expand Down Expand Up @@ -825,7 +834,7 @@ jobs:
github.event.pull_request.head.repo.full_name == github.repository
runs-on: self-hosted-k8s
container:
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960
image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a
permissions:
contents: read
id-token: write
Expand Down
Loading