Instruction file imported from demisto/demisto-sdk (.github/instructions/ci.instructions.md). Copyright stays with the author.

Copilot instructions — CI / pre-commit configuration

Read together with the repo-wide copilot-instructions.md.

This file applies to GitHub Actions workflows, composite actions, GitLab CI pipelines, and the pre-commit configurations.

Repos and pipelines

• GitHub Actions (.github/workflows/)
  • on-push.yml — main CI on push / PR.
  • handle_new_contribution.yml — community PR triage.
  • release-to-pypi.yml — publishes demisto-sdk to PyPI.
  • sdk-release.yml — release flow.
  • nightly-gate.yml — enforces the SDK Nightly policy on PRs (see the "SDK Nightly gate" section below).
• Composite actions (.github/actions/)
  • setup_environment — installs Poetry, Python, deps.
  • setup_test_environment — extra setup for tests (Neo4j, Docker, etc.).
  • validate — runs pre-commit and validate.
  • test_summary, upload_artifacts — reporting.
• GitLab CI (.gitlab-ci.yml, .gitlab/) — internal mirror pipeline.

Conventions

• Reuse the composite actions. New jobs that need a Python + Poetry environment must call ./.github/actions/setup_environment, not re-implement Poetry installation inline.
• Pin third-party actions by full SHA or by a major-version tag where the action is trusted (actions/checkout@v4, actions/setup-python@v5, astral-sh/setup-uv@v3). Avoid @master / @main.
• Matrix Python versions must include 3.9, 3.10, 3.11 (and 3.12 where applicable) to match the supported set in pyproject.toml.
• Caching: the setup action handles Poetry's virtualenv and pip caches. Don't re-cache the same paths from a job.
• Concurrency: workflows use concurrency.group to cancel in-flight duplicates. Preserve this pattern when adding new triggered workflows.
• Secrets come from repo settings. Never embed credentials in YAML; reference ${{ secrets.NAME }}. Mirror to GitLab via vault, not hard-coded variables:.
• Artifacts: prefer the upload_artifacts composite action so retention and naming stay consistent.

Pre-commit

• .pre-commit-config.yaml governs hooks that run on this repo's commits (ruff, ruff-format, toml-sort, validate-pyproject, poetry-check, mypy, plus local hygiene hooks).
• .pre-commit-hooks.yaml declares the hooks this repo exposes to other repos (consumed by content). Changing IDs, entries, or language here is a public-API change and needs a breaking changelog entry.

When updating hook revisions:

1. Update the rev: to the latest tested version.
2. Run poetry run pre-commit run --all-files locally and fix any new findings.
3. Add a internal (or fix/feature, as appropriate) changelog entry via poetry run sdk-changelog --init -n <PR>.

SDK Nightly gate

The nightly-gate.yml workflow reads .github/nightly-gate-paths.yml and classifies the PR's changed files into three tiers:

• Must — the check fails until the PR carries either nightly-run-passed or nightly-run-skipped.
• Recommended — the check passes but posts a sticky warning comment when neither label is present.
• Skip — the file is ignored (tests, docs, images, etc.).

The author is responsible for actually running the SDK Nightly pipeline and pasting a link to the run in the PR description before adding the nightly-run-passed label. The workflow re-runs automatically on labeled / unlabeled events, so applying the label immediately flips the check from red to green - no rebase or re-push required.

When editing .github/nightly-gate-paths.yml:

1. Prefer minimal, targeted globs; broad additions can force the nightly on every PR.
2. skip beats must, and must beats recommended, so use skip (e.g. **/tests/**) to carve out safe subtrees inside a Must-listed directory.
3. Add a feature / internal changelog entry describing why the policy changed. The CODEOWNERS file requires infra-team review for changes to the config file.

Hard rules

• No latest tags for actions, container images, or pip installs in CI YAML. Pin everything.
• No interactive pip installs of unpinned versions outside the Poetry-managed env. The build must be reproducible.
• No skipping pre-commit in CI with SKIP=... for new hooks.
• Don't disable a job just because it's flaky — fix the underlying flakiness. If a job is genuinely deprecated, remove it and document why in the PR description.
• Don't introduce a third CI system. GitHub Actions is the canonical pipeline; GitLab is a mirror. New automation goes into GitHub Actions first.