> ## Documentation Index
> Fetch the complete documentation index at: https://grandcentral.backbase.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Build and publish workflow

> Automated build, test, and publish processes for AI agents

The build and publish workflow automatically builds, tests, and publishes your agents when pull requests are merged to main, develop, or release branches.

The build and publish workflow is triggered when:

* **PR Merged**: Pull request is merged to main, develop, or release branches
* **Manual Trigger**: Via workflow\_dispatch

The workflow uses the reusable `build-publish.yaml` workflow from `backbase-common/gc-ai-workflows` for consistent build and publish processes.

### Reusable components used

This workflow uses the following reusable components:

* **build-publish.yaml**: Main reusable workflow that orchestrates the entire build and publish process
* **setup-project**: Sets up Python environment and resolves project metadata
* **code-quality**: Runs pylint, pytest, and hadolint checks
* **sonar-check**: Performs SonarCloud code analysis (conditional)
* **promptfoo-evaluation**: Runs prompt evaluation tests (conditional)
* **promptfoo-redteaming**: Runs security and adversarial tests (conditional)
* **build-docker**: Builds Docker images
* **security-check**: Scans Docker images with Trivy
* **push-docker**: Pushes images to Azure Container Registry

See the [Reusable Components](/agentic-ai/ci-cd-workflows/reusable-components) page for detailed documentation on each component.

## Workflow flowchart

```mermaid theme={"system"}
%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryBorderColor': '#295eff',
    'primaryTextColor': '#091c35',
    'lineColor': '#091c35',
    'secondaryColor': '#f3f6f9',
    'tertiaryColor': '#ebf0f5',
    'fontFamily': 'Libre Franklin, sans-serif'
  }
}}%%
flowchart TD
    Start([PR merged or<br/>manual trigger]) --> Setup[Setup project]
    Setup --> CheckPin[Check action pinning]
    CheckPin --> CodeQuality[Code quality checks<br/>pylint, pytest, hadolint]
    
    CodeQuality --> PromptfooSetup{Enable<br/>Promptfoo?}
    PromptfooSetup -->|Yes| SetupPromptfoo[Setup Promptfoo]
    PromptfooSetup -->|No| SonarCheck{Enable<br/>Sonar?<br/>main/develop only}
    
    SetupPromptfoo --> PromptfooEval{Enable<br/>evaluation?}
    PromptfooEval -->|Yes| RunEval[Run Promptfoo evaluation]
    PromptfooEval -->|No| RedteamCheck{Enable<br/>redteaming?}
    
    RunEval --> RedteamCheck
    RedteamCheck -->|Yes| RunRedteam[Run Promptfoo redteaming]
    RedteamCheck -->|No| SonarCheck
    
    RunRedteam --> SonarCheck
    SonarCheck -->|Yes| RunSonar[Run Sonar check]
    SonarCheck -->|No| Build
    
    RunSonar --> Build[Build Docker image]
    Build --> Security[Security check<br/>Trivy image scan]
    Security --> Push[Push Docker image<br/>to Azure ACR]
    Push --> End([End])
```

## Build process

### 1. Build and test

The workflow performs:

* **Code Compilation**: Build agent code
* **Dependency Resolution**: Install and verify dependencies
* **Testing**: Run automated tests

### 2. Quality checks

Quality gates are conditionally enabled:

* **SonarQube**: Enabled for main and develop branches
* **Promptfoo**: Enabled for main and develop branches
* **Redteam**: Enabled for main and develop branches

### 3. Artifact publishing

Build artifacts are published:

* **Packages**: Agent packages published to registry
* **Docker Images**: Container images built and pushed
* **Documentation**: Auto-generated documentation

## Workflow configuration

The build and publish workflow is defined in `.github/workflows/build-publish.yaml`:

```yaml theme={"system"}
name: Build and publish

on:
    pull_request:
        branches:
            - main
            - develop
            - release/*
        types:
            - closed
    workflow_dispatch:

jobs:
    build-and-publish:
        name: Build and publish artifact
        if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
        uses: backbase-common/gc-ai-workflows/.github/workflows/build-publish.yaml@main
        secrets: inherit
        with:
            timeout: 600
            enableSonar: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
            sourcePath: "src/"
            enablePromptfoo: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
            promptfooConfig: "promptfoo_config/*.yaml"
            enableRedteam: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
            redteamConfig: "redteam.yaml"
            redteamNumTests: "5"
```

## Configuration options

### Timeout

Maximum execution time in minutes:

```yaml theme={"system"}
timeout: 600  # 10 hours
```

### SonarQube

Conditionally enabled for main and develop branches:

```yaml theme={"system"}
enableSonar: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
sourcePath: "src/"
```

### Promptfoo testing

Conditionally enabled for main and develop branches:

```yaml theme={"system"}
enablePromptfoo: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
promptfooConfig: "promptfoo_config/*.yaml"
```

### Redteam testing

Conditionally enabled for main and develop branches:

```yaml theme={"system"}
enableRedteam: ${{ endsWith(github.ref, 'main') || endsWith(github.ref, 'develop') }}
redteamConfig: "redteam.yaml"
redteamNumTests: "5"
```

## Branch-specific behavior

### Main and develop branches

Full quality gates enabled:

* SonarQube analysis
* Promptfoo testing
* Redteam security testing

### Release branches

Basic build and publish:

* Build and test
* Artifact publishing
* Quality gates disabled for faster releases

## Build artifacts

The build workflow produces:

* **Agent Packages**: Published to package registry
* **Docker Images**: Container images tagged and pushed
* **Test Reports**: Test execution results
* **Coverage Reports**: Code coverage metrics
* **Build Logs**: Complete build execution logs

## Troubleshooting

### Build failures

Common build failure reasons:

1. **Compilation Errors**: Fix syntax or type errors
2. **Test Failures**: Address failing tests
3. **Dependency Issues**: Resolve missing or incompatible dependencies
4. **Quality Gate Failures**: Improve code quality metrics (SonarQube)
5. **Security Issues**: Address Redteam findings

### Performance optimization

* Quality gates are disabled for release branches to speed up builds
* Use caching for dependencies
* Optimize test execution

## Best practices

* Keep builds fast and efficient
* Monitor build times and optimize
* Address quality gate failures promptly
* Test locally before pushing changes
* Review build logs for detailed error information

## Next steps

* [Learn about PR workflows](/agentic-ai/ci-cd-workflows/pull-request-workflow)
* [Understand release processes](/agentic-ai/ci-cd-workflows/release-workflow)