Containers, CI/CD & Delivery

Build, sign, scan and ship artifacts through a governed delivery spine.

The delivery plane: a policy-driven build factory, a multi-target app/mobile build-and-release system, a quality/test grid that gates releases, and a signing container registry where nothing is admitted without a signature, SBOM and a clean scan. Evidence is a byproduct of shipping.

Auth is one model across every service here — an SS-01 bearer token plus X-Tenant-Id on every /api/v1 route. Public base https://api.nexocloud.io/api/v1.

4 real backends, 103 operations.

Every path below is a real route from services/<svc>/openapi.json. Each service lists a representative slice of its full contract.

Factory SS-31

13 operations

Build factory — classified, policy-gated build runs with attestation, approvals and per-class ceilings.

POST/api/v1/runsStart a classified build run.
POST/api/v1/runs/{id}/buildExecute the build step for a run.
POST/api/v1/runs/{id}/gatesEvaluate policy gates against a run.
POST/api/v1/runs/{id}/attestProduce a signed build attestation.
POST/api/v1/runs/{id}/approveRecord a human approval on a gated run.

AppForge SS-48

49 operations

App & mobile delivery — detected build targets, Tekton pipelines, release approvals, promotion and rollback across channels.

POST/api/v1/apps/{id}/detectDetect build targets (web, iOS, Android) from a repo.
POST/api/v1/pipelinesCreate a delivery pipeline from a detected target.
POST/api/v1/buildsQueue a build.
POST/api/v1/releases/promotePromote a release across channels.
POST/api/v1/releases/rollbackRoll a channel back to a prior release.

TestGrid SS-53

27 operations

Quality & test grid — suites, test runs, flaky-test quarantine, device farm, performance budgets and release evidence.

POST/api/v1/test-runsStart a test run against a suite.
POST/api/v1/quality-gates/evaluateEvaluate a release against quality gates.
POST/api/v1/flaky-tests/{id}/quarantineQuarantine a detected flaky test.
GET/api/v1/evidence/{release}Pull the signed quality-evidence bundle for a release.
POST/api/v1/device-farm/reservationsReserve a physical device for a session.

Registry SS-04

14 operations

Signing container registry — projects, artifacts, mandatory admission, scans, exceptions and proxy-cache.

POST/api/v1/admissionAdmit an image: verify signature, SBOM and scan verdict.
POST/api/v1/projects/{project}/artifacts/{repo}/{tag}/scanScan an artifact for vulnerabilities.
POST/api/v1/exceptionsRecord a time-boxed, audited admission exception.
POST/api/v1/proxy-cache/{project}/resolveResolve an upstream image through the proxy cache.

A signed artifact, gated end to end

A build runs under policy, produces a signed attestation, and cannot serve until the registry admits it — the same admission SkyForge enforces inside its deploy saga.

Start the runPOST/api/v1/runs

Factory classifies the change and applies the matching policy class.

Gate itPOST/api/v1/runs/{id}/gates

Test %, vuln ceilings and signature requirement must pass or the run stops.

AttestPOST/api/v1/runs/{id}/attest

A Vault-signed attestation binds the artifact to its provenance.

AdmitPOST/api/v1/admission

Registry refuses any unsigned, unscanned or non-compliant image at admission.

Where it sits in the platform.

Containers, CI/CD & Delivery does not reimplement the platform — it composes it. These are the services it leans on and the seams between them.

Factory (SS-31) / AppForge (SS-48)

The build planes — classified runs and multi-target pipelines producing signed artifacts.

Registry (SS-04)

The single admission chokepoint; every rollout on the platform passes through it.

TestGrid (SS-53)

Quality gates and signed evidence bundles feed the release decision.

Vault (SS-05)

Transit signs attestations and the audit-chain entries for every build decision.