Jon Chery
03adaa80a6
Byte-identical .github/workflows/publish.yml + mirror on the dev forge
(<dev-forge>/workflows/publish.yml) — same file content, installed in
both locations per the repo's byte-identical workflow convention.
NFR-6 (wheel/layer co-versioning): on push to main affecting core/**,
adapters/**, nova/**, or pyproject.toml, the workflow publishes BOTH a
wheel AND a Lambda layer with identical version strings. If either
publish fails, the job fails and the merge is blocked (REQ-323 AC).
Steps:
- actions/checkout@v4 + actions/setup-python@v5 (python 3.12)
- aws-actions/configure-aws-credentials@v4 (OIDC, role-to-assume from
AWS_ROLE_ARN secret, id-token: write)
- pip install build twine
- compute version: tomllib.load(pyproject.toml)["project"]["version"]
→ steps.ver.outputs.version (e.g. 1.14.0)
- python -m build --wheel
- twine upload dist/nova-<ver>-*.whl with two modes:
* CodeArtifact: NOVA_CODEARTIFACT_DOMAIN set →
aws codeartifact login --tool twine --domain $DOMAIN --repository
nova-pypi
* Fallback: NOVA_CODEARTIFACT_DOMAIN unset → TWINE_REPOSITORY_URL +
TWINE_USERNAME + TWINE_PASSWORD secrets (any PEP 503 index)
Idempotent: a re-upload that hits "file already exists" is treated as
success.
- build Lambda layer: pip install --target layer/python/ the wheel +
argon2-cffi + cryptography + pyjwt, then zip -r nova-layer.zip python/
- aws lambda publish-layer-version --layer-name nova-cli
--compatible-runtimes python3.12 --compatible-architectures x86_64
--description "nova-cli v<ver>" → steps.layer.outputs.arn
- aws ssm put-parameter /nova/layer/nova-cli/version =
"<wheel-version>:<layer-arn>" (CAP-035)
- final guard step fails the job if wheel uploaded!=true or layer arn
is empty
permissions: id-token: write (OIDC), contents: write (tag).
Secrets documented in the workflow header comments.
---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: backend-engineer
---/ci---
GitHub Workflows — Nova Platform CI/CD Catalog
This directory contains the GitHub Actions workflows for the Nova
platform. 3 are generated from workflows-src/<name>; 4 are GitHub-only.
Shared workflows (generated from source)
These 3 are generated from workflows-src/<name>. Run python3 scripts/sync_workflows.py --check to verify
no drift.
| Workflow | Trigger | Inputs | Required Secrets | Purpose |
|---|---|---|---|---|
ci.yml |
pull_request: [main] |
— | — | Lint + test + check-only (runs on every PR) |
deploy.yml |
workflow_call (reusable) + push: [main] |
contract (string, required), mode (string, default deploy), changeRequestId (string), environment (string) |
NOVA_AWS_ACCESS_KEY_ID, NOVA_AWS_SECRET_ACCESS_KEY, NOVA_AWS_DEFAULT_REGION, NOVA_KMS_KEY_ID, NOVA_LAMBDA_URL |
Reusable deploy workflow (invoked by consumer repos via uses: nova/.github/workflows/deploy.yml@v1.19) |
modules-lifecycle.yml |
pull_request: [main] + workflow_dispatch |
lifecycle_mode (string, default plan — plan or full) |
NOVA_AWS_ACCESS_KEY_ID, NOVA_AWS_SECRET_ACCESS_KEY, NOVA_AWS_DEFAULT_REGION, NOVA_AWS_ACCOUNT_ID |
L1 + L2 module lifecycle pipeline (plan-only default; full apply/modify/destroy on override) |
GitHub-only workflows
These 4 have no counterpart (the dev forge lacks the features
they require — reusable workflows, matrix needs, release API).
| Workflow | Trigger | Inputs | Required Secrets | Purpose |
|---|---|---|---|---|
platform-test.yml |
pull_request: [main] |
— | — | Lint + unit + integration + schema-validation (replaces ci.yml for PRs) |
primitives-plan.yml |
pull_request: [main] |
— | NOVA_AWS_* |
Plan-only for all L1 primitives (matrix) |
patterns-plan.yml |
pull_request: [main] |
— | NOVA_AWS_* |
Plan-only for all L2 modules (matrix) |
release.yml |
push: [main] |
— | NOVA_RELEASE_TOKEN |
Semver tag + MAJOR.MINOR/MAJOR floating-tag maintenance + release creation on merge to main |
Reusable deploy workflow (deploy.yml)
Consumer repos invoke the deploy workflow via a versioned tag:
jobs:
deploy:
uses: nova/.github/workflows/deploy.yml@v1.19
with:
contract: .nova/contract.yml
environment: dev
secrets: inherit
The workflow checks out the consumer repo + the Nova platform repo, runs
scripts/run_platform.sh, and posts deploy outputs as a PR comment +
to SSM Parameter Store.