ci: migrate to sps

[aryamohanan]

SPS Pipeline Setup

• Create .secrets.baseline
• Create .pipeline-config.yaml
• Configure the existing instana-eng-node-js-tracer-ci toolchain
• Add GitHub repository to the toolchain
• Create and configure the Delivery Pipeline
• Configure pipeline settings, definitions, workers, and environment properties
• Add and validate a manual pipeline trigger
• Run and verify npm install

Compliance & CVE

• Review and finalize files excluded from compliance scanning
• Ensure package-lock.json is not excluded
• Enable required compliance checks
• Fix outstanding CVE reports
• Determine whether CVE PRs can be safely closed or need manual fixes
• Create a script/process to close obsolete CVE PRs
• Fix Docker file warnings

Branch Protection

• Enable branch protection
• Enable required status checks:
  • tekton/code-branch-protection
  • tekton/code-unit-tests
  • tekton/code-vulnerability-scan
  • tekton/code-detect-secrets

Test Migration

• Run core tests without sidecars
• Validate SPS sidecar support and limitations
• Enable and validate Docker-in-Docker (DinD)
• Run Redis sidecar test using DinD
• Validate environment variable handling
• Configure secrets in Secret Manager and read them as environment variables
• Design the pipleine
• Run all test categories:
  • Static tests
  • Database tests
  • Messaging tests
  • Cloud tests
  • Other integration tests

Pipeline Optimization

• Investigate sharing npm cache across tasks
• Evaluate reusing root-level npm install / npm ci
• Investigate Docker image caching
• Check SPS shared registry / pull-through cache options
• Dynamically split tests into parallel groups
• Balance test groups based on execution duration
• Identify reusable test dependencies and sidecars
• Avoid repeatedly downloading existing Docker images

Secrets & Access

• Verify Secret Manager read access
• Update required secrets in Secret Manager
• Validate secrets are correctly consumed by the pipeline

Pipeline Triggers & Automation

• Configure PR pipeline
• Configure weekly pipeline
• Configure production dependency PR bot
• Configure currency bot
• Configure long-running pipeline
• Configure and validate Sonar analysis
• Run and validate the main listener

Cleanup & Documentation

• Remove obsolete Tekton files
• Add README with SPS pipeline documentation

ref: https://ibm.ent.box.com/notes/2405458268781