This document describes the CI/CD infrastructure for the Angular monorepo, which utilizes GitHub Actions to orchestrate testing, building, and deployment across the framework's ecosystem. The system manages complex workflows for framework packages, documentation (adev), DevTools, and internal Google synchronization. It covers workflow architecture, job execution patterns, Bazel integration with Remote Build Execution (RBE), and security models.
For information about the build system itself, see 3.3 Bazel Build System For npm script definitions, see 3.1 Package.json Scripts and Build Commands
The Angular repository's CI/CD system is built on GitHub Actions with tight integration to Bazel for build orchestration. The architecture separates concerns across multiple workflow files, each triggered by specific events.
The following diagram maps high-level CI/CD system components to their implementation files and specific job identifiers used in the codebase.
Sources: .github/workflows/ci.yml1-11 .github/workflows/pr.yml1-9 .github/workflows/adev-preview-build.yml10-12 .github/workflows/adev-preview-deploy.yml10-13 .github/workflows/google-internal-tests.yml3-5 .github/workflows/benchmark-compare.yml3-5
The lint job is the primary quality gate for both push and PR events. It executes a suite of validations that do not require full Bazel builds.
| Check | Command / Action | File Reference |
|---|---|---|
| Code Linting | pnpm tslint | .github/workflows/ci.yml28 |
| Circular Dependencies | pnpm ts-circular-deps:check | .github/workflows/ci.yml30 |
| PullApprove Config | pnpm ng-dev pullapprove verify | .github/workflows/ci.yml32 |
| Angular Robot Config | pnpm ng-dev ngbot verify | .github/workflows/ci.yml34 |
| Tooling Setup | pnpm check-tooling-setup | .github/workflows/ci.yml38 |
| Commit Messages | pnpm ng-dev commit-message validate-range | .github/workflows/pr.yml37-38 |
| Code Formatting | pnpm ng-dev format changed --check | .github/workflows/pr.yml39-40 |
Sources: .github/workflows/ci.yml20-38 .github/workflows/pr.yml18-45
The test and integration-tests jobs utilize Bazel with Remote Build Execution (RBE) to run the framework's extensive test suite.
Sources: .github/workflows/ci.yml68-83 .github/workflows/ci.yml84-98
Remote Execution Configuration:
secrets.RBE_TRUSTED_BUILDS_USER to allow read/write access to the remote cache .github/workflows/ci.yml78The documentation site (angular.dev) has a dedicated pipeline for testing, building, and deployment.
adev job runs tests using pnpm bazel test //adev/... and performs a fast-mode build to ensure buildability .github/workflows/ci.yml100-117adev: preview label .github/workflows/adev-preview-build.yml20adev-build job generates a production build with snapshot-build stamping .github/workflows/adev-preview-build.yml33adev-preview-deploy.yml workflow reacts to the completion of the build and uploads artifacts to Firebase Hosting using secrets.FIREBASE_PREVIEW_SERVICE_TOKEN .github/workflows/adev-preview-deploy.yml11-52Sources: .github/workflows/ci.yml100-117 .github/workflows/adev-preview-build.yml1-40 .github/workflows/adev-preview-deploy.yml1-53
pnpm devtools:test), build tests (pnpm devtools:build:chrome), and Cypress E2E tests using the cypress-io/github-action .github/workflows/ci.yml40-66pnpm bazel test //vscode-ng-language-service/... .github/workflows/ci.yml119-134Sources: .github/workflows/ci.yml40-66 .github/workflows/ci.yml152-180 .github/workflows/ci.yml119-134
The repository follows a strict security model for GitHub Actions to prevent "pwn request" attacks where untrusted PRs might leak secrets.
The separation of adev-preview-build.yml and adev-preview-deploy.yml is a security measure. The build runs in the context of the PR (untrusted), while the deployment runs in the context of the main branch (trusted) after the build completes, allowing access to Firebase secrets .github/workflows/adev-preview-deploy.yml1-6
Workflows define explicit, minimal permissions:
permissions: {} (No access) .github/workflows/ci.yml13pull-requests: write, contents: read, actions: read .github/workflows/adev-preview-deploy.yml15-21pull-requests: read, statuses: write .github/workflows/google-internal-tests.yml11-13dev-infra.yml workflow automatically labels PRs and issues using the angular-robot .github/workflows/dev-infra.yml14-37assistant-to-the-branch-manager.yml uses a specialized action to manage branch health and synchronization .github/workflows/assistant-to-the-branch-manager.yml13-23Sources: .github/workflows/dev-infra.yml1-37 .github/workflows/assistant-to-the-branch-manager.yml1-23 .github/workflows/merge-ready-status.yml1-15
The perf.yml workflow tracks framework performance by executing a matrix of benchmark workflows. It uses OpenID Connect (OIDC) via google-github-actions/auth to securely upload measurements to Google Cloud without long-lived secrets .github/workflows/perf.yml17-54
Sources: .github/workflows/perf.yml1-54
Team members can trigger side-by-side performance comparisons by commenting /benchmark-compare on a PR. The benchmark-compare.yml workflow:
pnpm benchmarks prepare-for-github-action .github/workflows/benchmark-compare.yml62Sources: .github/workflows/benchmark-compare.yml1-82
On successful CI completion for main branches, the publish-snapshots job:
secrets.SNAPSHOT_BUILDS_GITHUB_TOKEN .github/workflows/ci.yml148pnpm build .github/workflows/ci.yml149./scripts/ci/publish-snapshot-build-artifacts.sh to push the built artifacts to the snapshot repository .github/workflows/ci.yml150Sources: .github/workflows/ci.yml136-150
Refresh this wiki