feat(skill): add kbagent-promotion-pipeline skill for source->dest project promotion - #560
Draft
Matovidlo wants to merge 1 commit into
Draft
feat(skill): add kbagent-promotion-pipeline skill for source->dest project promotion#560Matovidlo wants to merge 1 commit into
Matovidlo wants to merge 1 commit into
Conversation
…oject promotion Adds a from-scratch generator (plugins/kbagent/skills/kbagent-promotion-pipeline/) for a GitHub Actions pipeline that promotes Keboola configs between two distinct projects (e.g. dev -> prod), for the "one repo covers the whole org" pattern. Mechanic (kbagent-native, no git-branching or GH-Environment-per-branch magic needed): a pull workflow fetches the SOURCE project into a shared directory and opens one PR against main; a validate workflow runs `sync push --dry-run` against the DESTINATION project on that PR, showing exactly what would change there; a push workflow (environment-gated) ships it once the PR merges. Every step uses KBAGENT_PROJECT_FROM_ENV=1 + --project __env__, so no token ever touches disk. A single repo can host several independent pipelines via a JSON config (one entry per source/dest pair). Generator is stdlib-only, mirrors the kbagent-cicd-migration skill's structure; verified by generating both single- and multi-pipeline configs and inline sanity assertions on the rendered YAML.
Contributor
Author
|
@claude review |
There was a problem hiding this comment.
Pull request overview
Adds a new kbagent-promotion-pipeline skill under plugins/kbagent/skills/ that guides users through (and programmatically generates) a GitHub Actions–based source → destination promotion flow using kbagent sync with the KBAGENT_PROJECT_FROM_ENV=1 / --project __env__ CI authentication model.
Changes:
- Introduces a new skill runbook (
SKILL.md) describing the pull → validate → push promotion mechanic and required GitHub setup. - Adds a stdlib-only generator script that scaffolds three GitHub Actions workflows (
pull,validate,push) for one or multiple pipelines. - Adds reference docs for env-injection rationale and GitHub secrets/environment setup.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| plugins/kbagent/skills/kbagent-promotion-pipeline/SKILL.md | Skill runbook for the promotion pipeline pattern, steps, and guardrails. |
| plugins/kbagent/skills/kbagent-promotion-pipeline/scripts/generate_promotion_pipeline.py | Workflow generator producing pull/validate/push GitHub Actions YAML and a secrets checklist. |
| plugins/kbagent/skills/kbagent-promotion-pipeline/references/secrets-setup.md | Documentation for required secrets and prod environment gating. |
| plugins/kbagent/skills/kbagent-promotion-pipeline/references/env-injection.md | Background on KBAGENT_PROJECT_FROM_ENV / __env__ and why it’s used in CI. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+38
to
+42
| 2. **Validate** (`kbagent-promote-validate.yml`, on the PR) runs | ||
| `sync push --dry-run --project __env__ --directory <dir>` against the | ||
| **destination** project's token, for every pipeline touched by the PR -- | ||
| this is the cross-project diff: *if this PR merges, here is exactly what | ||
| changes in the destination project.* Read this before approving. |
Comment on lines
+159
to
+168
| prefix = "kbagent --json " if json_output else "kbagent " | ||
| return ( | ||
| f" - name: {step_name} ({p.name})\n" | ||
| " env:\n" | ||
| ' KBAGENT_PROJECT_FROM_ENV: "1"\n' | ||
| f" KBC_TOKEN: ${{{{ secrets.{token_secret} }}}}\n" | ||
| f" KBC_STORAGE_API_URL: {stack_url}\n" | ||
| " run: |\n" | ||
| f" {prefix}sync {command} --project __env__ --directory '{p.directory}'\n" | ||
| ) |
| print(f"error: {repo} is not a directory", file=sys.stderr) | ||
| return 2 | ||
|
|
||
| pipelines = _load_pipelines(args) |
Comment on lines
+85
to
+95
| if args.config: | ||
| data = json.loads(Path(args.config).read_text(encoding="utf-8")) | ||
| return [ | ||
| Pipeline( | ||
| name=str(p["name"]), | ||
| directory=str(p["directory"]), | ||
| source_stack_url=_normalize_url(str(p["source_stack_url"])), | ||
| dest_stack_url=_normalize_url(str(p["dest_stack_url"])), | ||
| ) | ||
| for p in data | ||
| ] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kbagent-promotion-pipelineskill (plugins/kbagent/skills/kbagent-promotion-pipeline/): a from-scratch generator (scripts/generate_promotion_pipeline.py, stdlib-only) that scaffolds a GitHub Actions pipeline promoting Keboola configuration changes from a named source project (e.g. dev) to a named destination project (e.g. prod).kbagent-promote-pull.yml(pulls the source project into a shared directory and opens/updates one PR againstmain),kbagent-promote-validate.yml(runssync push --dry-runagainst the destination project on that PR -- the cross-project diff), andkbagent-promote-push.yml(pushes to the destination project once merged, gated by theprodGitHub Environment).{name, directory, source_stack_url, dest_stack_url}entry per pair) -- the "one GitHub repo covers the whole org" pattern.KBAGENT_PROJECT_FROM_ENV=1+--project __env__env-injection model, so no token ever touches disk.Why
Follow-up to #402 (kbc->kbagent CI/CD migration). That PR ports an existing kbc-managed repo; this one covers the separate, from-scratch use case of standing up a new dev->prod (or any source->destination) promotion pipeline that didn't exist before, modeled after the pattern in
keboola/cli-based-sync-generatorbut adapted to kbagent's project-alias-per-invocation model rather than that tool's git-branch-bound-to-a-GitHub-Environment mechanic. Kept as a separate PR (rather than folding into #402) since it's a genuinely new capability, not a bugfix, and #402 was deliberately squeezed down in scope during its own review pass.Change type
Feature — new skill. No source/CLI-command changes, no version bump.
Impact analysis
plugins/kbagent/skills/kbagent-promotion-pipeline/.src/, no new CLI commands, no public API or behavior change.Test plan
--configJSON) modes; verified the rendered--project __env__,KBAGENT_PROJECT_FROM_ENV, per-pipeline secret names,--jsonplacement, andenvironment: prodgating are all correct against the current CLI's actual flags.Pipeline.label/secret-name derivation, URL normalization, presence of expected strings in each generated workflow) run cleanly.ruff check/format,ty check(no new diagnostics),make skill-check(main SKILL.md unchanged),make command-sync-check,make changelog-check,make loc-check(pre-existing warnings only, unrelated to this change).Deployment
Merge & automatic deploy. No migration.
Rollback plan
Revert of this PR.