This repository contains Continuous Integration (CI) workflows, repositories settings and template files for repositories in the cloudquery and cloudquery-policies GitHub organizations. Since we have many repositories, and that number is expected to grow as we add more providers, we rely on automation to reduce the maintenance burden and to keep repositories in sync.

See code here and configuration here.

We sync the following files

• GitHub Actions workflows under workflows directory
• Pull request templates, linting configurations, release configurations, code owners files, renovate configuration, etc. under misc directory.

We use a customized version of a GitHub Action to sync files between repositories. The customized version adds templating support when syncing files.

To create a template file prefix a file's content with {{=<% %>=}} and then create template values files with the following naming convention: <filename-with-extension>.<target-repo-name>.values.yml. The template values file should be a key value configuration of template values to replace. For example, given the following template file:

# template.yml
{{=<% %>=}}
name: example provider workflow <%> name %>

and values file

# template.yml.cq-provider-aws.values.yml
name: "aws"

When syncing files to the cq-provider-aws repositories, the synced file will have the content of:

# template.yml
name: example provider workflow aws

If a repository doesn't have a matching template values file, the file will not be synced.

Some templates don't use any placeholders (values) but we still use an empty template placeholder {{=<% %>=}} in the file. With this, it's possible to enable/disable workflows depending on the existence of a template values file.

See code here and configuration here.

We use a tool created by Google to sync settings between repositories. Example settings are enabling only squash merges, enforcing code reviews, etc.

See here for the default settings we use for providers.

We use renovate for dependency updates via a GitHub Action. All repositories (except this one) use a common file that extends various configurations.

As renovate runs in the context of this repository, it uses a self hosted renovate configuration file to generate the dependencies updates.

We use a GitHub application called Kodiak to allow auto-merging of PRs. The application will automatically merge any PRs that has the automerge label and all required conditions are met (e.g. review approved, status checks passed). The configuration for the application is synced to all repositories from this file.

We provide a manually triggered GitHub Action workflow to add the automerge label to PRs based on their title. You can trigger the workflow from here: