Universal Go CI Tool

[kalverra]

Intent

Replace fragile, untested inline bash scripts and static YAML matrices in CI with a typed, modular Go CLI tool (tools/ci). The tool provides automatic tool target discovery, dynamic matrix generation based on git changes, and standardized test execution in CI workflows.

Big Changes

tools/ci CLI Architecture and Target Discovery

Introduced the tools/ci Go module containing subcommands for version reporting (ci version) and tool target discovery/matrix calculation (ci tools matrix). The matrix command scans the repository for tool submodules and root packages, evaluates changed files against git history or provided diff lists, and outputs a JSON matrix for GitHub Actions jobs.

Bash scripts in CI workflows are hard to test locally, prone to silent failures, and require complex jq/sed string manipulation. Moving this logic to a Go CLI allows unit testing, strict type safety, and local execution.

Dedicated ci-tools.yml Workflow and Composite Actions

Created a standalone .github/workflows/ci-tools.yml workflow to run tool unit tests across discovered matrix targets. Added reusable composite actions setup-ci-cli (to build/cache the CLI binary) and setup-gotestsum (to install and cache gotestsum), deduplicating test runner setup across multiple CI workflows.

Isolating tool testing to its own workflow reduces noise in ci-core.yml and speeds up PR feedback loops for tool changes. Reusable composite actions eliminate duplicated caching and installation boilerplate across CRE and CCIP workflows.

Small Changes

• Added /tools/ci/ entry to .github/CODEOWNERS to assign ownership to devex and core teams.
• Added ci-cli build target to GNUmakefile for local building and test parity.
• Deduplicated gotestsum installation in CCIP and CRE system test workflows by switching to .github/actions/setup-gotestsum.
• Added testing.Short() and CI environment skip guards to heavy database/integration tests in tools/test and tools/githooks so unit test matrix runs succeed without external dependencies.
• Added robust fallback candidate resolution for base git branches in getGitChangedFiles.

Callouts

• Reviewers should verify the target discovery logic in tools/ci/internal/tools/target.go to ensure all current and future tool submodules/root packages are accurately categorized.
• Ensure the path triggers and caching strategy in .github/workflows/ci-tools.yml and .github/actions/setup-ci-cli/action.yml work properly across different runner OS/architectures.

[github-actions]

👋 kalverra, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

✅ No conflicts with other open PRs targeting develop

[trunk-io]

   

View Full Report ↗︎ ⋅ Docs

[Copilot]

Pull request overview

Risk Rating: MEDIUM

Introduces a new tools/ci Go-based CLI intended to centralize CI helper logic (matrix generation, GitHub Actions outputs, version reporting) and replaces repeated gotestsum-install snippets with reusable composite actions, while extending ci-core to run tools unit tests from a generated matrix.

Changes:

• Added tools/ci Go module with Cobra CLI (version, tools matrix) plus internal helpers (ghaction, target discovery/matrix filtering) and tests.
• Updated ci-core to build/cache the CI CLI, generate a tools test matrix, and run tools tests as a separate matrix job.
• Replaced inline gotestsum installation/caching in multiple workflows with a new setup-gotestsum composite action; added a setup-ci-cli composite action.

Areas for scrupulous human review

• tools/ci/cmd/tools.go:getGitChangedFiles + matrix generation path (error handling and correctness in shallow checkouts / PR contexts).
• .github/workflows/ci-core.yml filter job’s “Generate tools test matrix” step (ensuring the matrix is non-empty when tools changes occur, and that git refs/history are sufficient).
• .github/actions/setup-ci-cli/action.yml cache key correctness across runner architectures.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tools/ci/README.md	Documents the new unified CI CLI tool and basic usage/testing.
tools/ci/main.go	CLI entrypoint calling the Cobra root command.
tools/ci/internal/tools/target.go	Discovers tool test targets and computes a filtered matrix based on changes/events.
tools/ci/internal/tools/target_test.go	Unit tests for target discovery and matrix filtering behavior.
tools/ci/internal/ghaction/ghaction.go	Wrapper for GitHub Actions outputs/env/summary and grouping.
tools/ci/internal/ghaction/ghaction_test.go	Tests for GitHub Actions wrapper behavior and fallbacks.
tools/ci/go.mod	New Go module for the CI CLI and its dependencies.
tools/ci/go.sum	Dependency checksums for the new CI CLI module.
tools/ci/cmd/root.go	Root Cobra command and repo-root discovery helper.
tools/ci/cmd/version.go	ci version subcommand with text/JSON output.
tools/ci/cmd/version_test.go	Tests for help output, version output, and repo-root discovery.
tools/ci/cmd/tools.go	ci tools matrix command to emit matrix output (stdout and/or GHA outputs).
tools/ci/cmd/tools_test.go	Tests for matrix JSON output, GHA output writing, and change filtering.
tools/ci/AGENTS.md	Adds development rules/conventions for tools/ci.
GNUmakefile	Adds make ci-cli target to build tools/ci binary locally.
.github/workflows/ci-core.yml	Generates tools matrix via ci and adds a tools-tests matrix job.
.github/actions/setup-ci-cli/action.yml	Composite action to build/cache tools/ci binary and export it to PATH.
.github/actions/setup-gotestsum/action.yml	Composite action to cache/install gotestsum and add it to PATH.
.github/workflows/cre-wf-caching-test.yml	Switches to setup-gotestsum composite action.
.github/workflows/cre-system-tests.yaml	Switches to setup-gotestsum composite action.
.github/workflows/cre-soak-memory-leak.yml	Switches to setup-gotestsum composite action.
.github/workflows/cre-regression-system-tests.yaml	Switches to setup-gotestsum composite action.
.github/workflows/cre-mixed-env-tests.yaml	Switches to setup-gotestsum composite action.
.github/workflows/ccip-system-tests.yaml	Switches to setup-gotestsum composite action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 4 comments.

Suppressed comments (2)

tools/ci/internal/ghaction/ghaction_test.go:73

• This fallback test is skipped in CI due to GITHUB_ENV being set. It can be made hermetic by clearing GITHUB_ENV via t.Setenv and running unconditionally in CI.

func TestGHAction_SetEnv_FallbackStdout(t *testing.T) {
	if os.Getenv("CI") == "true" || os.Getenv("GITHUB_ACTIONS") == "true" {
		t.Skip("skipping in CI: GITHUB_ENV is set in CI environment")
	}
	t.Parallel()
	var stdout bytes.Buffer
	act := ghaction.New(&stdout, "", "")

tools/ci/internal/ghaction/ghaction_test.go:104

• This fallback test is skipped in CI due to GITHUB_STEP_SUMMARY being set. It can run in CI by clearing GITHUB_STEP_SUMMARY via t.Setenv before constructing the action context.

func TestGHAction_AddStepSummary_FallbackStdout(t *testing.T) {
	if os.Getenv("CI") == "true" || os.Getenv("GITHUB_ACTIONS") == "true" {
		t.Skip("skipping in CI: GITHUB_STEP_SUMMARY is set in CI environment")
	}
	t.Parallel()
	var stdout bytes.Buffer
	act := ghaction.NewWithOptions(&stdout, "", "", "")

[Copilot]

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

tools/ci/internal/ghaction/ghaction.go:80

• When falling back to writing to out (i.e. when GITHUB_ENV is unset), this ignores the fmt.Fprintf write error and always returns nil. Since the method already returns error, propagate the write error so callers can detect failures writing environment exports.

	if a.envPath == "" {
		fmt.Fprintf(a.out, "%s=%s\n", key, value)
		return nil

tools/ci/internal/ghaction/ghaction.go:90

• When falling back to writing to out (i.e. when GITHUB_STEP_SUMMARY is unset), this ignores the fmt.Fprintln write error and always returns nil. Since the method already returns error, propagate the write error so callers can detect summary output failures.

	if a.summaryPath == "" {
		fmt.Fprintln(a.out, markdown)
		return nil

[Tofel]

why do we want to run them on schedule? catching flaky tests or more data points for testing the CI tool?

[cl-sonarqube-production]

Quality Gate failed

Failed conditions
1 New Blocker Issues (required ≤ 0)
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE