Prow

The generic-autobumper tool automates version upgrading for container images (such as Prow deployment manifests).

Workflow:

1. It operates on a local git repository containing deployment manifests (e.g., the /config/prow/cluster folder).
2. It identifies the most recent tags for specified prefixes in a registry (e.g., gcr.io).
3. It modifies the YAML files with these new tags.
4. It performs a git-commit, pushes the changes to the remote repository, and creates or updates a Pull Request (PR).

Cluster administrators can then upgrade the image versions by simply approving the generated PR.

Prow Job Integration Patterns:

• Periodic Jobs: Use a periodic job to run the autobumper workflow at regular intervals to generate version-bump PRs.
• Postsubmit Jobs: Use a postsubmit job to automatically deploy the changes once the PR is merged, making the new versions effective in the cluster.

Prow is implemented as a microservice architecture consisting of container images running as Kubernetes deployments. The components are categorized into Core, Merge Automation, and Optional services.

Core Components

• crier: Reports ProwJob status changes to external systems like Gerrit, GitHub, Pub/Sub, or Slack.
• deck: A UI component that provides views for recent jobs, command/plugin help, merge automation status (Tide), and a dashboard for PR authors.
• hook: The central stateless server that listens for GitHub webhooks and dispatches them to plugins (e.g., for triggering jobs or handling slash commands).
• horologium: Triggers periodic jobs.
• prow-controller-manager: Manages the lifecycle and execution of jobs running in Kubernetes pods (replaces plank).
• sinker: Handles cleanup of old jobs and pods.

Merge Automation

• tide: Manages the retesting and merging of Pull Requests based on configured merge criteria.

Optional Components

• branchprotector: Configures GitHub branch protection policies.
• exporter: Exposes general ProwJob metrics.
• gerrit: An adapter for handling CI workflows on Gerrit.
• hmac: Updates HMAC tokens and secrets for specified organizations/repositories.
• tot: Vends sequential build numbers (useful for legacy automation; otherwise, Prow uses monotonically increasing non-sequential numbers).
• status-reconciler: Prevents in-flight GitHub PRs from getting stuck when blocking presubmit configurations change.
• sub: Listens to Cloud Pub/Sub notifications to trigger Prow jobs.

Peribolos is a GitOps tool that allows you to declare GitHub organization settings, teams, and memberships in a YAML file. When applied, Peribolos updates the GitHub organization to match the declared configuration.

To use Peribolos, you extend your primary Prow config.yaml by adding a top-level orgs key. Peribolos only manages the fields explicitly defined in your configuration; any fields missing from the YAML will remain unchanged in GitHub.

orgs:
  this-org:
    # org settings
    company: foo
    email: foo
    name: foo
    description: foo
    has_organization_projects: true
    has_repository_projects: true
    default_repository_permission: read
    members_can_create_repositories: false

    # org member settings
    members:
    - anne
    - bob
    admins:
    - carl

    # team settings
    teams:
      node:
        # team config
        description: people working on node backend
        privacy: closed
        previously:
        - backend  # Renames 'backend' team to 'node'

        # team members
        members:
        - anne
        maintainers:
        - jane
        repos: # Permissions for the team on specific repos
          some-repo: admin
          other-repo: read

ghCache is an HTTP cache specifically optimized for the GitHub API (https://api.github.com). It implements two key non-standard behaviors to optimize for both data freshness and GitHub API rate limits:

1. Mandatory Revalidation: Every cache hit is revalidated with a conditional HTTP request to GitHub, even if the cache entry is still fresh (within its TTL). It ignores and overwrites the Cache-Control header to force this behavior. This leverages GitHub's support for conditional requests, which do not consume API tokens if the resource has not changed.
2. Request Coalescing: If multiple concurrent requests are made for the same resource, ghCache coalesces them into a single upstream request to GitHub. This prevents redundant API calls and token consumption when many handlers (such as Prow's hook component) react to the same event simultaneously.

Additionally, ghCache provides Prometheus instrumentation to monitor cache activity, request duration, and API token usage/savings.