vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-05-05 15:23:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
Pulse/.github/workflows
History
rcourtman 07afa94d19 feat(security): add gitleaks secret scanning to pre-commit hook and CI 
Add three layers of secret leak prevention:

1. .gitleaks.toml — config extending the default ruleset (~150 rules for
   AWS, GCP, Stripe, OpenAI, private keys, JWTs, etc.) with allowlists
   tuned to suppress false positives from test fixtures and docs.

2. .husky/pre-commit — enhanced with gitleaks protect --staged (graceful
   skip if not installed), sensitive file type blocking (.pem, .key, .enc,
   id_rsa, etc.), and broadened fallback patterns covering AWS, OpenAI,
   GCP, and private key headers alongside existing Stripe checks.

3. .github/workflows/build-and-test.yml — new secret-scan CI job using
   gitleaks-action that runs in parallel with build on every push/PR,
   serving as the last gate if someone bypasses local hooks.
2026-02-04 09:52:54 +00:00
..
build-and-test.yml feat(security): add gitleaks secret scanning to pre-commit hook and CI 2026-02-04 09:52:54 +00:00
create-release.yml fix(ci): fix YAML quoting on line 494 2026-02-03 22:09:24 +00:00
deploy-demo-server.yml fix: add sudo to mv command in deploy 2026-01-18 09:46:50 +00:00
eval-model-matrix.yml docs: update AI evaluation matrix and approval workflow documentation 2026-01-30 19:00:40 +00:00
helm-ci.yml Add Helm chart tooling, CI, and release packaging 2025-10-18 11:50:57 +00:00
helm-pages.yml ci: use git pull --rebase in helm-pages.yml to avoid push conflicts 2026-01-20 20:07:51 +00:00
promote-floating-tags.yml fix(ci): add run-name to workflows for reliable tag extraction 2025-12-24 09:41:26 +00:00
publish-docker.yml revert: remove dual-key license verification 2026-02-03 21:29:21 +00:00
publish-helm-chart.yml Improve Helm chart package visibility configuration (related to #686) 2025-11-11 17:50:02 +00:00
README.md chore: remove deprecated Pulse+ agent metrics and add audit log rotation docs 2025-10-20 15:13:38 +00:00
release-dry-run.yml revert: remove dual-key license verification 2026-02-03 21:29:21 +00:00
test-e2e.yml revert: remove dual-key license verification 2026-02-03 21:29:21 +00:00
test-updates.yml revert: remove dual-key license verification 2026-02-03 21:29:21 +00:00
update-demo-server.yml ci: improve demo server update robustness with pipefail and version check 2026-01-20 19:34:35 +00:00
validate-release-assets.yml Ensure release validation handles published edits (related to #669) 2025-11-12 17:33:30 +00:00

README.md

GitHub Actions Workflows

Update Demo Server

File: update-demo-server.yml

Automatically updates the public demo server when a new stable release is published.

Configuration Required

Add these secrets to your GitHub repository settings (Settings → Secrets and variables → Actions):

  1. DEMO_SERVER_SSH_KEY

    • The private SSH key for accessing the demo server
    • Generate with: cat ~/.ssh/id_ed25519 (or your key file)
    • Should be the full private key including -----BEGIN and -----END lines

  2. DEMO_SERVER_HOST

    • The hostname or IP of the demo server
    • Value: 174.138.72.137 (or hostname if using DNS)

  3. DEMO_SERVER_USER

    • The SSH username for the demo server
    • Value: root (or the appropriate user with sudo access)

How It Works

  1. Trigger: Runs automatically when a GitHub release is published
  2. Filter: Only runs for stable releases (skips RC/pre-releases)
  3. Update: SSHs to demo server and runs the install script
  4. Verify: Checks that the new version is running and mock mode is active
  5. Cleanup: Removes SSH key from runner

Testing

To test without publishing a release:

  1. Go to Actions tab in GitHub
  2. Select Update Demo Server workflow
  3. Click Run workflow (if manual trigger is enabled)

Benefits

  • ✅ Demo server always showcases latest stable release
  • ✅ Validates install script works on real server
  • ✅ Removes manual step from release process
  • ✅ Free to run (public repos get unlimited GitHub Actions minutes)

Helm CI

File: helm-ci.yml

Runs helm lint --strict and renders the chart with common configuration combinations on every pull request that touches Helm content (and on pushes to main). This prevents regressions before they land.

  • Triggered by PRs/pushes touching deploy/helm/**, docs, or the workflow itself
  • Uses Helm v3.15.2
  • Renders both the default deployment and an agent-enabled configuration to catch template issues

Publish Helm Chart

File: publish-helm-chart.yml

Packages the Helm chart and pushes it to the GitHub Container Registry (OCI) whenever a GitHub Release is published. Also makes the packaged .tgz available as both an Actions artifact and a release asset. The same behaviour can be triggered locally via ./scripts/package-helm-chart.sh <version> [--push].

  • Triggered automatically on release: published, or manually via workflow dispatch (requires chart_version input)
  • Chart and app versions mirror the Pulse release tag (e.g., v4.24.0 → 4.24.0)
  • Publishes to oci://ghcr.io/<owner>/pulse-chart
  • Requires no additional secrets—uses the built-in GITHUB_TOKEN with packages: write permission