Artefact validations#

The SKA CI/CD Artefact Validations service — part of Marvin (marvin-42-service) — automatically checks every artefact published to the Central Artefact Repository against the SKAO naming, versioning, and metadata conventions. Non-compliant artefacts are quarantined (Nexus) or held back from production (Harbor), and Marvin opens a GitLab merge request that lists each failed check and how to fix it, assigned to the developer who published the artefact.

How it fits the SKAO workflow#

Validation runs at publish time, so the Central Artefact Repository stays compliant without a human gatekeeper:

  • Naming, versioning, and metadata checks run against the conventions described in How the Central Artefact Repositories work and ADR-25.

  • Vulnerability and signature gates control the promotion of Harbor images from staging to production, keeping vulnerable or unverified images out of production.

  • Feedback reaches you as a merge request raised by Marvin (see Merge request quality checks), rather than a silent failure.

The System Team maintains this service. If you think a validation result is wrong, contact the System Team Support Desk.

Product documentation#

The service is documented and maintained in its own ska-cicd-artefact-validations project. documentation is the source of truth — refer to it directly so you always get the behaviour that matches the current release.

📚

Tutorial

Validate compliant and non-compliant artefacts, then test the OCI signature flow from staging to production.
⚙️

How-to

Develop and run the service, deploy it, configure webhooks and feature toggles, and investigate validation failures.
⚡

Reference

Endpoints, feature toggles, configuration, environment variables, metrics, checks, retry policies, and audit records.
📊

Explanation

Architecture, promotion gates, SBOM signing, Vault PKI, and the reasoning behind the validation workflow.
Was this page helpful?