Hyperi Edgestream Shared CI

Usage

To use these actions in your project's workflow, reference them using the full repository path and a version tag.

Public Repository Access

If this repository is public, you can call the actions directly in any .github/workflows/*.yml file:

jobs:
  build:
    runs-on: self-hosted
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Build Environment
        uses: hyperi-io/shared-ci/setup-deps@v1.2.0

Private Repository Access

If this repository is private, you must ensure the calling repository has permission to "see" the shared actions.

1. Organization Settings: Go to shared-ci Settings -> Actions -> General -> Access and allow access to all repositories in the hyperi-io organization.

2. Explicit Checkout (Fallback): If cross-repo permissions are restricted, you must check out the actions manually:

    steps:
      - name: Checkout Shared Actions
        uses: actions/checkout@v4
        with:
          repository: hyperi-io/shared-ci
          token: ${{ secrets.GH_ACTIONS_READ_TOKEN }}
          path: .github/shared-actions

      - name: Run Setup
        uses: ./.github/shared-actions/setup-deps

3. Deployment Configuration (Secrets):

The deploy-deb action is hardened to ensure no infrastructure details (hostnames, paths, or usernames) are stored in plain text. To use this action, you must configure the following GitHub Secrets in your repository or organization:

Secret Name	Description	Example Value
EDGESTREAM_REPO_SSH_KEY	Private SSH key for the repo server.	-----BEGIN RSA...
EDGESTREAM_KNOWN_HOSTS	Fingerprint of the repo server.	repo.devex.hyperi.io ...
EDGESTREAM_REPO_USER	SSH username for the repo server.	hyperi
EDGESTREAM_REPO_HOST	FQDN of the repository server.	repo.devex.hyperi.io
EDGESTREAM_REPO_INCOMING_PATH	Base path for incoming .deb files	./export/hyperi/incoming
EDGESTREAM_REPO_UPDATE_SCRIPT	Path to the repo update script.	/usr/local/sbin/update.sh
EDGESTREAM_REPO_SYNC_SCRIPT	Path to the repo sync/mirror script.	/usr/local/sbin/sync.sh

Available Actions

Preparation

  - name: Setup Build Environment
    uses: hyper-io/edge-shared-ci/setup-deps@v0.0.x

Security Scans

  - name: Security - Gitleaks
    uses: hyper-io/edge-shared-ci/gitleaks-scan@v0.0.x
    env:
      GIT_READY: "true"

  - name: Security - Semgrep SAST
    uses: hyper-io/edge-shared-ci/code-scan@v0.0.x
    
  - name: Go Code Quality - Lint
    uses: hyper-io/edge-shared-ci/go-lint@v0.0.x

Build

  - name: Prepare Build Workspace
    uses: hyper-io/edge-shared-ci/prepare-env@v0.0.x

  - name: Build Debian package
    uses: hyper-io/edge-shared-ci/build-deb@v0.0.x

Post Build Security Scans

  - name: Security - Trivy (Package Scan)
    uses: hyper-io/edge-shared-ci/trivy-scan@v0.0.x
    with:
      scan-path: './dist'

Deployment

  - name: Deploy Package
    if: success()
    uses: hyper-io/edge-shared-ci/deploy-deb@v0.0.x

Versioning & Tracking

We use Semantic Versioning (SemVer) tags to ensure build stability across the organization.

• Major Tags (@v1): Point to the latest stable release of a major version. Recommended for most projects.

• Specific Versions (@v1.2.1): Use this if you require a frozen environment and want to avoid automatic updates.

• SHAs (@a1b2c3d...): The most secure method; pins the action to a specific commit hash.

Version Headers

Every action includes a metadata header in the logs. You can verify which version your CI ran by checking the Action Metadata group in the GitHub Actions console output:

::group::Action Metadata
Action: Hyperi Setup Build Env
Version: 1.2.0
Build Image: debian:trixie
::endgroup::

Automatic Updates (Dependabot)

We recommend adding a dependabot.yml to your application repositories to stay updated with security patches in these actions:

updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"

Contributing

1. Create a feature branch.
2. Update the description field in action.yml with the new version number.
3. Submit a PR.
4. Upon merge, a maintainer will cut a new Git Tag.