CI visibility

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/ci-visibility"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/7473b000-24e7-496a-b6cd-92513c7d73d7/social-card.svg?v=3e7ae33eec8b" alt="CI visibility" width="600" height="315"></a>

  1. Create a source: POST /v1/projects/{p}/ci-sources {"provider":"github|gitlab|buildkite|circleci"}. The response shows secret and signing_secret once; only the SHA-256 is stored.

  2. Point the provider's webhook at /v1/ci/{provider}/{source id} on the edge.

    • GitLab: X-Gitlab-Token = secret (Pipeline and Job events). Buildkite: X-Buildkite-Token = secret (build.finished, job.finished).

    • GitHub (workflow_run, workflow_job; header X-Hub-Signature-256) and CircleCI (workflow-completed, job-completed; circleci-signature): set the webhook secret to signing_secret.

  3. Only finished runs and jobs are kept. Each becomes a span (cicd.pipeline.*, service ci:<repo>) in the trace sha256("provider:run_id")[..16], and a ci_runs_v1 row. Spans that follow the OTel CI/CD conventions sent through the gateway are recognised too.

  4. Test results: wtctl ci upload-junit report.xml --api ... --key ... --project ... --run-id $RUN --sha $SHA [--coverage 81.5] (multipart, up to 20 MiB). A test is flaky when it passed and failed on one commit, or flipped outcome at least 3 times in its last 20 runs.

Reads: /ci/pipelines, /ci/runs/{id}, /tests?flaky=true, /tests/coverage, /dora.

Updated