Skip to content

ci: migrate from CircleCI to GitHub Actions#6753

Open
nicksieger wants to merge 26 commits into
masterfrom
migrate-circleci-to-github-actions
Open

ci: migrate from CircleCI to GitHub Actions#6753
nicksieger wants to merge 26 commits into
masterfrom
migrate-circleci-to-github-actions

Conversation

@nicksieger
Copy link
Copy Markdown
Member

@nicksieger nicksieger commented Apr 24, 2026

Summary

Migrate CI/CD pipeline from CircleCI to GitHub Actions.

New Workflow Files

Workflow Description
ci.yml Main build, lint, and Go/JS tests
lint.yml Shellcheck for scripts
integration.yml Integration and extension tests with Kind clusters
windows.yml Windows build and tests
docs.yml Documentation generation verification
release.yml Release dry-run (master) and actual releases (tags)

Changes

  • Added 6 GitHub Actions workflow files
  • Removed TILT_CLOUD_TOKEN dependency from scripts/release-ci.sh

Required GitHub Configuration

Variables (Settings > Secrets and variables > Actions > Variables)

Variable Purpose
TILT_APP_ID GitHub App ID for generating tokens to access tilt-dev repos

Secrets (Settings > Secrets and variables > Actions > Secrets)

Secret Purpose
TILT_APP_PRIVATE_KEY GitHub App private key for generating tokens
SLACK_WEBHOOK_URL Slack incoming webhook for build failure notifications
DOCKER_USERNAME Docker Hub username for release publishing
DOCKER_TOKEN Docker Hub access token for release publishing
PULUMI_ACCESS_TOKEN Pulumi authentication for extension tests

GitHub App Requirements

The GitHub App must be installed on the tilt-dev organization with access to:

  • tilt - for release operations
  • tilt.build - for docs verification and release updates
  • cloud.tilt.dev - for release record updates
  • tilt-extensions - for extension version updates

Migration Notes

  • CircleCI orbs replaced with GitHub Actions equivalents
  • setup_remote_docker replaced with Docker-in-Docker service containers
  • Conditional step halting (circleci-agent step halt) replaced with job-level if: conditions
  • Slack notifications use incoming webhooks
  • All workflows use concurrency controls to cancel in-progress runs
  • SSH deploy keys replaced with GitHub App token generation

Test plan

  • Verify CI workflow runs on PR
  • Verify lint workflow runs shellcheck
  • Test integration workflow with Kind cluster setup
  • Test Windows build on windows-latest runner
  • Verify docs workflow can checkout tilt.build repo
  • Test release dry-run on master branch
  • Test actual release on version tag

🤖 Generated with Claude Code

nicksieger and others added 24 commits April 24, 2026 11:47
@nicksieger
ci: migrate from CircleCI to GitHub Actions
4890d68 
- Add GitHub Actions workflows for CI, linting, integration tests, Windows builds, docs checks, and releases
- Remove TILT_CLOUD_TOKEN dependency from release-ci.sh
- Workflows replicate CircleCI functionality with equivalent GitHub Actions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger @claude
ci: use GitHub App token instead of SSH deploy keys
bf12ae3 
Replace SSH deploy keys (TILT_BUILD_DEPLOY_KEY, DEPLOY_SSH_KEY) with
GitHub App token generation using actions/create-github-app-token.

- docs.yml: checkout tilt.build via actions/checkout with app token
- release.yml: generate token with access to tilt, tilt.build,
  cloud.tilt.dev, tilt-extensions repos for release script pushes
- update git config email to tilt-team@docker.com

Also pin all actions to their commit shas.

Signed-off-by: Nick Sieger <nick@nicksieger.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@nicksieger
ci: use actions/checkout@v6
216f740 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: try mounting docker socket
00939a2 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: bump to newer buildx and qemu actions
08788fc 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): run container job as root to access Docker socket
39d8f83 
The mounted Docker socket is owned by root:docker on the host,
requiring elevated permissions from within the container.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): mark workspace as Git safe directory and fetch master
b4d515f 
- Running as root causes Git ownership mismatch with files checked
  out by the container default user
- Fetch master branch ref for `git merge-base master HEAD` in build

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix: pull full clone
385d12c 
fixes fatal: ambiguous argument '': unknown revision or path not in the working tree.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): use Docker socket mounting instead of dind service
c9d8f66 
The dind service has DNS resolution issues in GitHub Actions container
jobs. Switch to mounting the host Docker socket, which is simpler and
more reliable. Requires --user root and git safe directory config.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: use updated app variables
2b14dd6 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix: fix shellcheck SC2155
0ebc66a 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): use most recent create-github-app-token
40787fd 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix: don't need app token to checkout public tilt.build
b180cf5 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): docs: check out tilt and tilt.build in subdirectories
e5a9ebe 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): add master branch ref to workflows that run make install
2312847 
The Makefile's install target uses `git merge-base master HEAD`, which
requires a local master branch. actions/checkout only fetches the PR
branch, so we need to explicitly fetch master and create the local ref.

- ci.yml: add Fetch master branch step
- integration.yml: add fetch-depth: 0 and Fetch master branch step
  to build-integration and test-extensions jobs
- docs.yml: add git safe directory and Fetch master branch step

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix: increase execer timeouts for CI
eb57f47 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: use tiltdev images
d029480 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: try --group-add docker
3c388a0 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: update release containers
6042265 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: temporary workflow to show docker socket permissions
f617c71 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
ci: try --group-add 118
4d50518 
Fail the run if the docker socket isn't connected to gid 118

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): set GOBIN for test-extensions job
1392cc5 
When running as non-root, go install puts binaries in $HOME/go/bin
(/github/home/go/bin), but the container PATH only includes
/root/go/bin. Set GOBIN=/usr/local/bin to install tilt to a directory
that's already in PATH.

Also require build-integration to succeed first before running.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): add Docker cleanup to prevent OOM in integration tests
27f8e61 
Exit code 137 indicates the process was killed by OOM killer. Unlike
CircleCI's setup_remote_docker which provides isolation, GitHub Actions
socket mounting shares the host's Docker resources and memory pool.

Add docker system prune before setting up Kind clusters to free memory
from unused containers, images, and volumes accumulated from previous
runs or other jobs on the same runner.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger
fix(ci): split integration tests into parallel matrix jobs
3a331ea 
Split integration tests into 4 parallel jobs to reduce memory pressure
and prevent OOM kills:
- quick: Analytics, config, crash, CRD, demo, env tests (19 tests)
- docker-compose: Docker Compose tests (3 tests)
- live-update: Live update tests (5 tests)
- k8s-deploy: K8s deployment and job tests (14 tests)

Each job sets up its own Kind cluster and runs a subset of tests,
reducing peak memory usage. Jobs run in parallel with fail-fast
disabled so failures in one group don't cancel others.

Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger nicksieger mentioned this pull request Apr 24, 2026
Closed
7 tasks
@nicksieger nicksieger force-pushed the migrate-circleci-to-github-actions branch 5 times, most recently from 3fb061f to 08d2916 Compare April 24, 2026 19:55
@nicksieger
fix(ci): login (when available) to avoid anonymous pull 429s
799d62a 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
@nicksieger nicksieger force-pushed the migrate-circleci-to-github-actions branch from 08d2916 to 799d62a Compare April 24, 2026 20:10
@nicksieger
fix(ci): Add $HOME/go/bin to path
6f37a6e 
Signed-off-by: Nick Sieger <nick@nicksieger.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nicksieger