CI/CD

Purpose

Lumie's active CI/CD path starts from GitHub Actions in the application repositories. On main pushes, repository-local workflows run checks, build ARM64 container images, and push short-SHA plus main tags to Zot. argocd-image-updater then watches Zot, writes the newest allowed image tag back into lumie-infra, and lets Argo CD reconcile the rollout.

Tekton manifests still exist under lumie-infra/applications/tekton/**, but the Tekton Argo CD applications are commented out in lumie-infra/applications/kustomization.yaml. Treat those manifests as a retained reactivation path, not the active build system.

This page is a reference document for developers changing image builds, registry publishing, image tag automation, or the GitOps deployment handoff. For the disabled Tekton controller manifests, see Tekton.

Source Paths

Path	Role
lumie-backend/.github/workflows/ci.yml	Runs Gradle tests, builds the backend ARM64 image, and pushes to Zot
lumie-frontend/.github/workflows/ci.yml	Runs frontend checks, builds the frontend ARM64 image, and pushes to Zot
lumie-document/.github/workflows/ci.yml	Builds Docusaurus, builds the docs image, and pushes to Zot
lumie-infra/applications/argocd-image-updater/argocd.yaml	Installs the active image tag automation controller
lumie-infra/applications/argocd-image-updater/manifests/image-updaters.yaml	Maps Zot images to lumie-infra Helm values write-back targets
lumie-infra/applications/kustomization.yaml	Registers argocd-image-updater and comments out Tekton applications
lumie-infra/applications/lumie/**/{common-values,helm-values}.yaml	Deployment values that receive updated image tags
lumie-infra/applications/tekton/ci-cd/**	Disabled Tekton build and values-update manifests retained for possible reactivation

Runtime Flow

Image And Write-Back Catalog

Source	Image	Write-back target
lumie-backend	zot.lumie-infra.com/applications/lumie-backend	applications/lumie/backend/common-values.yaml
lumie-frontend	zot.lumie-infra.com/applications/lumie-frontend	applications/lumie/frontend/common-values.yaml
lumie-document	zot.lumie-infra.com/web-apps/lumie-document	applications/lumie/document/helm-values.yaml
Worker services	zot.lumie-infra.com/applications/{analysis-svc,chatbot-svc,grading-svc,report-svc,temp-omr-grading}	Worker write-back targets listed in image-updaters.yaml; the inspected workspace does not declare matching repo-local GitHub Actions workflows

argocd-image-updater only accepts tags matching ^[0-9a-f]{8}$ and uses newest-build for the active linux/arm64 platform. The main tag remains useful for humans and registry inspection, but the GitOps write-back contract is the immutable short-SHA tag.

Credential Flow

Credential	Consumer	Purpose
ZOT_USERNAME / ZOT_PASSWORD GitHub secrets	Repository GitHub Actions workflows	Log in to zot.lumie-infra.com before image push
argocd-image-updater-zot-vss	argocd-image-updater	Read Zot credentials from Vault into the updater namespace
Argo CD repo credentials	argocd-image-updater	Push Helm values write-back commits to https://github.com/Lumie-Edu/lumie-infra.git

Disabled Tekton Path

The checked-in Tekton resources describe a Gitea webhook path that would build images with Kaniko and run git-update-values against lumie-infra. That path is not active while these resources remain commented out:

Source anchor: lumie-infra/applications/kustomization.yaml Tekton CI/CD resource comments.

# - tekton/pipeline/argocd.yaml
# - tekton/triggers/argocd.yaml
# - tekton/dashboard/argocd.yaml
# - tekton/ci-cd/argocd.yaml

Keep Tekton-specific drift visible when reactivating it:

Source	Current implication
applications/tekton/ci-cd/manifests/tasks/git-update-values.yaml	Pushes deployment values through in-cluster Gitea
Active root Argo CD Applications and argocd-image-updater	Use GitHub as the canonical lumie-infra write-back target
applications/kustomization.yaml	Leaves all Tekton applications disabled

Verification

cd lumie-infra
rg -n "argocd-image-updater|ImageUpdater|writeBackTarget|allowTags|tekton" \
  applications/kustomization.yaml applications/argocd-image-updater applications/tekton

cd ../lumie-backend && rg -n "REGISTRY|IMAGE_NAME|docker/build-push-action" .github/workflows/ci.yml
cd ../lumie-frontend && rg -n "REGISTRY|IMAGE_NAME|docker/build-push-action" .github/workflows/ci.yml
cd ../lumie-document && rg -n "REGISTRY|IMAGE_NAME|docker/build-push-action" .github/workflows/ci.yml

kubectl get applications -n argocd | rg 'argocd-image-updater|tekton' || true
kubectl get imageupdaters -n argocd

Success signals:

• argocd-image-updater is registered and healthy in Argo CD.
• Tekton applications do not appear unless applications/kustomization.yaml has intentionally uncommented them.
• Application Helm values use short-SHA image tags written from Zot metadata.