Continuous integration and delivery (CI/CD) automate the process of building, checking, and delivering software. Automation helps teams integrate changes consistently and catch problems early.
Our workflow
- Code: Source code is hosted in GitHub. Repository access is managed by the project team using the organization’s standard access controls.
- Build and test: GitHub Actions runs workflows when changes are pushed or pull requests are opened. Workflows build and test code, scan it with Trivy by default, and create release artifacts such as Docker images.
- Store artifacts: Docker images are stored in Harbor. Public and private JavaScript packages are published to npm.
- Deploy to Kubernetes: Argo CD or Flux CD is the default continuous delivery tool. Use Helm or Kustomize to manage Kubernetes applications and configuration.
- Deliver: Build artifacts can be used for testing and deployment to the environments required by a project.
Workflow guidance
- Use the Wiredcraft common GitHub Actions workflows for Docker builds where they fit; otherwise, choose a workflow suited to the project.
- Use self-hosted runners when a workflow requires them. Select an appropriate runner for the project and keep runner access limited to trusted workflows.
- Store credentials as GitHub Actions secrets and non-sensitive configuration as variables. Never commit credentials or print them in workflow logs.
- Include Trivy scanning in CI/CD pipelines by default, and add automated tests and other quality checks appropriate to the project.
- Keep workflows understandable, reviewable, and scoped to the permissions they need.
Use Terraform for infrastructure provisioning and Ansible for configuration management where appropriate.
Some legacy components still use the previous Pipelines system. Treat these as exceptions and confirm with the project team before changing their build process.