ci: migrate to sps

[aryamohanan]

SPS Pipeline Setup

• Create .secrets.baseline
• Create .pipeline-config.yaml
• Configure the existing instana-eng-node-js-tracer-ci toolchain
• Add GitHub repository to the toolchain
• Create and configure the Delivery Pipeline
• Configure pipeline settings, definitions, workers, and environment properties
• Add and validate a manual pipeline trigger
• Run and verify npm install

Compliance & CVE

• Review and finalize files excluded from compliance scanning
• Ensure package-lock.json is not excluded
• Enable required compliance checks
• Fix outstanding CVE reports
• Determine whether CVE PRs can be safely closed or need manual fixes
• Create a script/process to close obsolete CVE PRs
• Fix Docker file warnings

Branch Protection

• Enable branch protection
• Enable required status checks:
  • tekton/code-branch-protection
  • tekton/code-unit-tests
  • tekton/code-vulnerability-scan
  • tekton/code-detect-secrets

Registry pull

• Getting "429 Too Many Requests - Server message: toomanyrequests: Data limit exceeded" error on SPS

Test Migration

• Run core tests without sidecars
• Validate SPS sidecar support and limitations
• Enable and validate Docker-in-Docker (DinD)
• Run Redis sidecar test using DinD
• Validate environment variable handling
• Design the pipleine
• Configure secrets in Secret Manager and read them as environment variables
• Sussfully un all tests:
  • Static tests
  • Database tests
  • Messaging tests
  • Cloud tests
  • Other integration tests

Pipe Design

• Investigate sharing npm cache across tasks
• Evaluate reusing root-level npm install / npm ci
• Investigate Docker image caching
• Check SPS shared registry / pull-through cache options
• Dynamically split tests into parallel groups
• Identify reusable test dependencies
• Avoid repeatedly downloading existing Docker images

Secrets & Access

• Verify Secret Manager read/write access (submitted access request)
• Update required secrets in Secret Manager
• Validate secrets are correctly consumed by the pipeline

Pipeline Triggers & Automation

• Configure PR pipeline
• Configure weekly pipeline
• Configure production dependency PR bot
• Configure currency bot
• Configure long-running pipeline
• Configure and validate Sonar analysis
• Run and validate the main listener

Cleanup & Documentation

• Remove obsolete Tekton files
• Add README with SPS pipeline documentation

ref: https://ibm.ent.box.com/notes/2405458268781

[aryamohanan]

elliptic CVE-2025-14505: Skipped for now due to its low severity and the absence of an upstream patched version. The vulnerability affects elliptic versions up to 6.6.1, which is currently the latest available version.

[aryamohanan]

hbs CVE-2021-32822: Skipped for now due to its moderate severity and the absence of an upstream patched version. The vulnerability affects hbs versions up to 4.1.2, and there is currently no fix available.

hbs is a dependency of admin pkg, which is a development dependency of us

[aryamohanan]

CRA scan fails on Dockerfiles using build args for image tags (e.g. FROM node:${NODEJS_VERSION}-alpine) because the variable cannot be resolved during the scan, causing invalid reference format and cra:bom-generate to exit with code 1.

The Node.js version is intentionally passed during the actual build.

[aryamohanan]

rimraf not required types anymore