Jojung/promote test envs#143
Draft
jojung1 wants to merge 5 commits into
Draft
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (11)
🚧 Files skipped from review as they are similar to previous changes (10)
📝 WalkthroughWalkthroughAdds a protected GitLab promotion workflow for ChangesTest-environment promotion flow
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitlab/ci/build.yml:
- Around line 215-218: Replace each broad NVCM_PROMOTE_ENV-only exclusion with
the full promote predicate used in .gitlab/ci/promote-test-envs.yml: web/api
pipeline source, default branch, and NVCM_PROMOTE_ENV matching test or test01.
Apply this consistently at .gitlab/ci/build.yml lines 215-218, 243-245, and
278-280; .gitlab/ci/pulse.yml lines 37-40; .gitlab/ci/sonar.yml lines 81-84 and
119-121; and .gitlab/ci/test.yml lines 416-419, 466-469, 502-505, and 538-541.
In @.gitlab/ci/promote-test-envs.yml:
- Around line 183-193: Pin the baseline revision across validation and
deployment: in .gitlab/ci/promote-test-envs.yml at lines 183-193, resolve the
commit used by the Helm render and export its SHA as a dotenv value; in
.gitlab/ci/scripts/write_deploy_state.sh at lines 73-76, consume that exported
SHA instead of fetching and recomputing origin/main.
- Around line 206-220: Add the same per-environment resource_group configuration
to test-promote-deploy-state, test-rollback-env, and test-release-env in
.gitlab/ci/promote-test-envs.yml, using $NVCM_PROMOTE_ENV as the shared resource
key so all environment-branch mutations are serialized.
- Around line 135-136: Update the yq download steps in the promote-test-envs job
to use a fixed release URL instead of the floating latest endpoint, then verify
the downloaded binary’s SHA-256 against the expected checksum before chmod or
any execution. Keep chmod and subsequent use only after checksum validation
succeeds.
In @.gitlab/ci/scripts/write_deploy_state.sh:
- Around line 36-47: Normalize values-repository URLs consistently across all
clone operations: in .gitlab/ci/scripts/write_deploy_state.sh lines 36-47, clone
NV_CONFIG_MANAGER_VALUES_REPO_URL directly, while constructing the GitLab URL
only when using NVCM_VALUES_REPO_PATH; apply the same distinction in
.gitlab/ci/promote-test-envs.yml lines 172-177, 254-259, and 314-319 for chart
validation, rollback, and release respectively.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e9a786c0-da4a-4bb5-a804-c989fa62084a
📒 Files selected for processing (15)
.gitlab-ci.yml.gitlab/ci/README.md.gitlab/ci/build.yml.gitlab/ci/common.yml.gitlab/ci/pr-build.yml.gitlab/ci/promote-test-envs.yml.gitlab/ci/pulse.yml.gitlab/ci/scripts/pr_ref_guard.sh.gitlab/ci/scripts/promote_build_pipeline.sh.gitlab/ci/scripts/promote_push_images.sh.gitlab/ci/scripts/test_env_config.sh.gitlab/ci/scripts/write_deploy_state.sh.gitlab/ci/sonar.yml.gitlab/ci/test.ymlMakefile
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.gitlab/ci/scripts/write_deploy_state.sh (1)
49-59: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not log the raw values-repository URL.
NV_CONFIG_MANAGER_VALUES_REPO_URLmay contain authentication credentials, butvalues_repois printed in the commit/error messages and embedded in the final view URL. This can expose tokens in CI logs and produces a malformed view URL for full-URL overrides. Use a sanitized display label, and construct the view URL only from the repository path when available.Also applies to: 139-139
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gitlab/ci/scripts/write_deploy_state.sh around lines 49 - 59, Sanitize the repository identifier used by the deploy-state logging and final view URL construction. Update the relevant commit/error messages to use a credential-free display label instead of raw values_repo or NV_CONFIG_MANAGER_VALUES_REPO_URL, and derive the view URL from the repository path only when available so full-URL overrides cannot embed credentials or produce malformed URLs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.gitlab/ci/scripts/write_deploy_state.sh:
- Around line 49-59: Sanitize the repository identifier used by the deploy-state
logging and final view URL construction. Update the relevant commit/error
messages to use a credential-free display label instead of raw values_repo or
NV_CONFIG_MANAGER_VALUES_REPO_URL, and derive the view URL from the repository
path only when available so full-URL overrides cannot embed credentials or
produce malformed URLs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: eff0741c-d9e4-4719-90c0-d1d3c0cb04f0
📒 Files selected for processing (6)
.gitlab/ci/build.yml.gitlab/ci/promote-test-envs.yml.gitlab/ci/pulse.yml.gitlab/ci/scripts/write_deploy_state.sh.gitlab/ci/sonar.yml.gitlab/ci/test.yml
🚧 Files skipped from review as they are similar to previous changes (5)
- .gitlab/ci/sonar.yml
- .gitlab/ci/pulse.yml
- .gitlab/ci/build.yml
- .gitlab/ci/test.yml
- .gitlab/ci/promote-test-envs.yml
7 tasks
jojung1
force-pushed
the
jojung/promote-test-envs
branch
2 times, most recently
from
July 21, 2026 14:22
354a47e to
c4b2daf
Compare
Signed-off-by: Joseph Jung <jojung@nvidia.com>
Signed-off-by: Joseph Jung <jojung@nvidia.com>
Signed-off-by: Joseph Jung <jojung@nvidia.com>
Signed-off-by: Joseph Jung <jojung@nvidia.com>
…mages Signed-off-by: Joseph Jung <jojung@nvidia.com>
jojung1
force-pushed
the
jojung/promote-test-envs
branch
from
July 24, 2026 21:28
c4b2daf to
dc51bc2
Compare
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the protected promote pipeline that deploys a PR to the shared test / test01 environments by consuming the immutable artifacts built in #134 and committing a machine-written
deploy-state.yamlto the env branch in the ArgoCD values repo. It targets only test/test01 (every rule requiresNVCM_PROMOTE_ENV∈ {test, test01}); production stays on the tag-driven release flow.Run on the mirror's default branch with
NVCM_PROMOTE_PR+NVCM_PROMOTE_ENV. Jobs (.gitlab/ci/promote-test-envs.yml):test-promote-build— resolves the vettedpull-request/<n>snapshot, reuses or triggers the Add secret-free build stage for untrusted PRs #134 build, and gates provenance on GitLab pipeline metadata (sha/ref/status/source) — never on anything the untrusted build wrote.test-promote-push-images— downloads the image tarballs by job id,docker load, retag to0.0.0-pr<n>.<sha>, push, capture registry digests.test-promote-chart— downloads the chart.tgzpackaged in Add secret-free build stage for untrusted PRs #134's secret-free stage, validates the render against the env's baseline+overrides+digests, and publishes it (no PR checkout, no repackaging —helm templateonly, which is sandboxed).test-promote-deploy-state— commitsdeploy-state.yamlto the env branch (NV_CONFIG_MANAGER_VALUES_PUSH_TOKEN), owning the GitLab Environment.test-rollback-env/test-release-env— commit a prior deploy-state / reset to canonicals.Security model: the promote stage operates only on already-built immutable artifacts, so no untrusted PR code executes with secrets. Provenance is established from GitLab metadata; the build stage (#134) holds no secrets.
Default-branch job guards: a
web-source pipeline on the default branch withNVCM_PROMOTE_ENVset would otherwise also matchdocker-build-main-*,test-main-*, sonar, and pulse (theirrules:changesevaluate true on non-push pipelines). Each gets a leading- if: $NVCM_PROMOTE_ENV / when: neverso a promote run doesn't rebuild/retest main as a side effect. Normal push/MR/tag pipelines are unaffected.Chart source: the promote publishes the dev chart to the existing NGC Helm registry (
https://helm.ngc.nvidia.com/nvidian/cfa) via thengctarget; ArgoCD pulls it by exact version. (Confirmed exact-prerelease pins resolve there.)Required protected CI/CD variables:
NVCM_MIRROR_API_TOKEN,NVCM_TEST_ENV_TARGETS,NVCM_CHART_REPO,NV_CONFIG_MANAGER_VALUES_PUSH_TOKEN,NVCM_VALUES_REPO_PATH, plus the existing image/chart target vars. Documented in.gitlab/ci/README.md.Validation
yqparse of.gitlab-ci.yml+promote-test-envs.yml+ the four guarded CI files;bash -non all four promote scripts.Confirmed the promote source allowlist and default-branch guards behave as intended.
Exercised the build→promote chart handoff locally: packaged the chart as Add secret-free build stage for untrusted PRs #134's
pr-build-chartdoes, then ran the promote render gate against the real test baseline+overrides+digests → rendersnvcr.io/nvidian/cfa/...@sha256:....End-to-end pipeline validation is gated on Add secret-free build stage for untrusted PRs #134 merging (nothing here runs until the build stage exists) and the protected variables being provisioned.
Standard CI passes.
Kind integration passes, or this PR explains why it was not run.
Kind integration not run — not applicable. This PR only adds GitLab CI job definitions and shell scripts for the deploy pipeline; it changes no application code or Helm chart runtime output, and nothing the Kind suite exercises.
Checklist
CONTRIBUTING.md.Summary by CodeRabbit
New Features
Documentation
Bug Fixes