The Cicada open automation system for assembly processes allows you to deploy an infrastructure similar to GitHub Actions, Azure DevOps, and GitLab CI on your own server, independent of cloud services. The project code is written in Python and is distributed under the AGPLv3 license.
The system is capable of automatically triggering build and testing scripts upon certain events, such as receiving a push request in Git, creating releases, opening/closing issues, and opening/closing pull requests. A distinctive feature of Cicada is its provision for defining the logic of a domain-specific functional programming language, which supports variables, expressions, loops, conditional blocks, and built-in functions. on git.push fn test(compiler): env.CC = compiler echo Testing (compiler) shell make clean all let compilers = ["gcc", "clang"] for compiler in compilers: test(compiler)
The offered language makes it easy to create handlers that are difficult to describe in configuration files based on the YAML format and allows you to avoid using external Shell or Python scripts. This approach also addresses the issue of incompatibility among YAML configuration formats used in different build automation platforms. Cicada offers platform-independent universal event types that enable the same automation script to be linked to different platforms, for example, a push request handler can be attached to events coming from both GitHub and GitLab.
Particular attention is also paid to the secure storage of tokens and passwords used for accessing APIs, repositories, and environments for installing resulting builds. This confidential information is stored in encrypted form (AES-GCM with a 256-bit key) using the HashiCorp Vault toolkit. A separate encryption key is created for each repository and installation point, and keys are automatically updated every 30 days, with the key storage running on a separate server. server.
By default, sensitive data is not transferred through environment variables, and the repository is only given read access. There is built-in protection against command substitution in expressions, ensuring automatic escaping of dangerous constructs; for example, the expression 'let name = "; rm -rf /"; echo Hello, (name)' will not execute the 'rm' command. Notable optimizations include a built-in caching system for compilation results and resource loading.
Source: opennet.ru
