OWP deployment: public GHCR images, deployment docs, CI cleanup - #14
Merged
Conversation
Removes registry auth blocks and the registry_token requirement now that images are published to ghcr.io/ngwpc/auto-eval-* under the owp-latest tag. Extends CI to build/push on the owp-deployment branch and adds SonarQube, CodeQL, and Trivy scanning. Points README at the new OWP deployment docs.
Deployment_Runbook.md covers setup/configuration (Nomad connectivity, container images, job registration, STAC API config). Verification_Guide.md covers proving the deployment works end-to-end with a fixed smoke-test unit and routine batch operations. Both are cross-checked against PI7 UAT, batch-run-guide-AWS-Test.md, and the nomad-runner repo.
sonarqube-internal depends on an NGWPC-internal self-hosted runner and SonarQube instance that will not exist once this repo is delivered to OWP; it also currently fails on sonar.projectKey being unset. Also drop the owp-deployment branch trigger and owp-latest tag logic, and gate image push/registry login to same-repo events so a fork PR's GITHUB_TOKEN is not asked to create a package it lacks permission to create.
owp-latest existed to keep owp-deployment from clobbering main's :latest tag, but main isn't actively built and this repo has a single maintainer, so the split added indirection with no benefit. Push :latest from both main and owp-deployment, update the four Nomad job defs and docs accordingly, and resolve the rename TODOs that already anticipated this.
NGWPC PI-7 PR
nomad-runner is now public and mirrored to NOAA-OWP, and the GHCR images (auto-eval-coordinator, auto-eval-jobs, auto-eval-jobs-gval) are confirmed publicly pullable, so drop the now-stale TODOs and the local-build fallback section. Also: - Retarget all NGWPC-org repo links (nomad-runner, auto-eval-coordinator, hand-index, benchmarkcat) to their NOAA-OWP mirrors; GHCR image refs stay under ngwpc since the org won't inherit those packages. - Drop owp-deployment branch references now that it's folding into main (clone instructions, CI triggers, sign-off checklist). - Clarify that deployment/verification testing was descoped and won't be performed by this team, rather than implying it's just pending.
robgpita
force-pushed
the
owp-deployment
branch
from
August 27, 2026 04:14
6ece152 to
dc0f92f
Compare
ar-siddiqui
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ghcr.io/ngwpc/auto-eval-*), updating job definitions and CI to build/push accordingly.docs/Deployment_Runbook.mdanddocs/Verification_Guide.mdfor the OWP handoff, covering cluster setup through Nomad, GHCR image pulls, STAC configuration, and an end-to-end verification/sign-off checklist.ngwpc, since that org won't inherit the packages).owp-deploymentbranch references (clone instructions, CI triggers, sign-off checklist) now that this branch is folding intomain.local-nomad-serverimage push andsonarqube-internal/codeql-scanCI jobs, upgrades the Trivy scan version, simplifies to a single:latestimage tag.Test plan
auto-eval-coordinator,auto-eval-jobs,auto-eval-jobs-gval) are publicly pullable via anonymous manifest fetchnomad-runner,hand-index, andbenchmarkcatare reachable