We're excited to announce that Hubcast is now deployed and available for LLNL open-source projects. Hubcast securely enables your github.com/llnl repositories to run CI pipelines on LC machines while maintaining your GitHub-based collaboration workflow. Hubcast replaces the existing GitLab pull mirroring system with faster synchronization, better security through proper LC account mapping, and support for external contributor testing. Migration from pull mirroring is straightforward and uses your existing .gitlab-ci.yml configurations without changes.
Important: Migration Deadline
Projects currently using GitLab pull mirroring will need to migrate to Hubcast within 90 days of this announcement. The legacy pull mirroring system will be disabled after this period. Projects requiring continued use beyond 90 days will need to obtain an exemption from LC's OISSO. Need help migrating? Contact lc-hubcast@llnl.gov
Why is LC Migrating from GitLab Pull Mirroring to Hubcast?
If you're currently using GitLab's standard pull mirroring to sync from GitHub to CZ GitLab, Hubcast provides significant improvements that address the limitations of the legacy polling-based approach:
| Feature | GitLab Pull Mirroring | Hubcast |
|---|---|---|
| Sync Speed | 15-30 minutes (polling) | Seconds (webhooks) |
| Pull Request Support | Only syncs branches | Can sync both branches and specific PR commits after approval from a LLNL project maintainer |
| User Identity | Runs as integration owner | Runs as user who pushed the code to GitHub or an LLNL project maintainer after review and approval |
| CI Status Reporting | Manual configuration | Automatic to GitHub |
| Authentication | Manual token rotation every 30 days | GitHub App (no rotation needed) |
Key Benefits
- Faster feedback for contributors. Webhook-based sync means LC pipelines start within seconds instead of waiting 15-30 minutes.
- Test external contributions safely. Project maintainers can review and approve specific commits from external PRs by writing @lc-hubcast approve via a review comment. Pull mirroring cannot sync external PRs.
- Proper LC account mapping. Each CI job runs under the contributor or approver's LC account for namespace isolation and accurate resource accounting. Pull mirroring runs everything as one account.
- No token rotation. GitHub App authentication eliminates required monthly Personal Access Token rotation.
- Good fit for open source GitHub projects that: need LC HPC testing (Tuolumne, Dane, Tioga), accept external contributions, or use Jacamar CI runners.
Getting Started
- Link your GitHub account to your LC account at https://lc-idm.llnl.gov/github/link
- Install the GitHub App on your repository at https://github.com/apps/lc-hubcast
- Add a config file (.github/hubcast.yml) to your GitHub repo to point to your CZ GitLab repository
- Disable pull mirroring if you're migrating from the legacy system
For detailed instructions:
- Setup Guide on dev.llnl.gov
- User Guide for configuration options and bot commands
Questions or issues:
- Email lc-hubcast@llnl.gov
- File issues or feature requests at github.com/LLNL/hubcast/issues