ci: decommission CircleCI (#7677)

[Hugo Dupras (jabesq)]

Bye Bye CircleCI

Proposed changes

• Remove the CircleCI configuration — deletes the 5 files under .circleci/ (config.yml, vars.yml, templates/dynamic.yml.j2, scripts/generate_ci.py, scripts/requirements.txt, −639 lines). Since ci: decommission CircleCI build and notification jobs now that GitHub Actions publishes images #7460 all Docker build, manifest and release jobs were already commented out, leaving only ensure_formatting, base_linter, linter and test — each one fully duplicated by .github/workflows/ci-lint-format.yml and ci-tests-connectors.yml. Keeping both systems alive duplicated compute and doubled the signal on every pull request.
• Refresh stale CircleCI references in the release workflows (build-manifest.yml, release-connector.yml, release-bulk-connectors.yml) — the manifest-only release mode is retained but re-justified without CircleCI: on a platform CalVer tag push, build-all-connectors.yml triggers on that same tag and builds and pushes every connector image, so skipping the Docker build in the bulk release is precisely what avoids building each image twice. Tag, GitHub Release, manifest fragment and container_version commit-back are still fully produced.
• Describe the GitHub Actions pipeline instead of CircleCI in the documentation — README.md swaps the CircleCI badge for the build-all-connectors.yml build badge, and .github/copilot-instructions.md now lists the actual workflows (lint/format, tests, manifest, Alpine/UBI9 builds, releases). It also documents that FIPS variants are derived from the presence of a Dockerfile_fips and Python versions from each connector's own Dockerfile, now that the central .circleci/vars.yml list is gone.
• Re-point stale CircleCI comments in connector and tooling files — the pycti / connectors-sdk git-ref rewriting formerly done by the CircleCI dynamic templates is reproduced by .github/actions/build-connector-image, so the portspoof and export-file-ods Dockerfiles still genuinely need git at install time; their comments are re-pointed to the composite action rather than dropped, to keep that requirement documented. The remaining mentions in the test-requirements.txt detection hints and in generate_connectors_config_json_schemas.sh are made CI-agnostic.

Related issues

• Closes ci: decommission CircleCI and remove the .circleci directory #7677

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

Further comments

Why "tested with different use cases" is unchecked. This change removes a CI configuration and refreshes comments; no runtime connector code path is modified (hence no refactoring box either). It was verified statically rather than exercised at runtime:

• .github/scripts/ and .github/actions/ contain no reference to .circleci/ or vars.yml.
• FIPS variants are derived from the presence of a Dockerfile_fips (build_alpine_matrix.py), not from .circleci/vars.yml.
• Python versions come from each connector's own Dockerfile, not from .circleci/vars.yml.
• No repository or organization ruleset requires the ci/circleci: * status checks, so removing them cannot block merges.
• shared/tools/ci/detect-base-branch.sh is shared by both CI systems and is kept.
• The four GitHub Actions jobs replacing CircleCI were confirmed present and equivalent (isort + black, flake8 --ignore=E,W, the linter_stix_id_generator pylint plugin, and run_test.sh).

On signing: all four commits are signed — with an SSH key rather than a GPG key — and show as Verified on GitHub.

⚠️ Action required outside this repository (maintainers). Deleting .circleci/config.yml does not stop CircleCI on its own: the GitHub webhook survives, so pipelines keep being triggered and keep failing. After merge, the project must also be disconnected in the CircleCI application:

• Project Settings → Stop Building (cancels running workflows, removes followers, deletes the webhook and the deploy key), or DELETE /api/v2/project/<project-slug>;
• remove the repository from VCS Connections → Manage GitHub Checks if GitHub Checks were enabled.

Deliberately deferred. CIRCLE_BRANCH / CIRCLE_TAG are intentionally kept as CI-agnostic shims in run_test.sh and in the config schema generation scripts — they keep working under GitHub Actions (build-manifest.yml sets them explicitly so the script takes its intended diff path). Renaming them is a conscious follow-up, tracked by a TODO referencing #7677, not an oversight.

[Copilot]

Pull request overview

This PR decommissions CircleCI and aligns CI documentation, workflows, and references with GitHub Actions.

Changes:

• Removes obsolete CircleCI configuration and tooling.
• Updates release workflow rationale and CI-related comments.
• Refreshes badges, pipeline documentation, and build/test references.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Reviewed change
shared/tools/composer/generate_connectors_config_schemas/generate_connectors_config_json_schemas.sh	Makes CI references CI-agnostic.
README.md	Replaces the CircleCI badge with a GitHub Actions badge.
internal-export-file/export-file-ods/Dockerfile	Updates the build-action dependency comment.
external-import/tenable-security-center/tests/test-requirements.txt	Updates the CI test-runner reference.
external-import/portspoof/Dockerfile	Updates the build-action dependency comment.
connectors-sdk/tests/test-requirements.txt	Updates the CI test-runner reference.
.github/workflows/release-connector.yml	Reframes manifest-only release behavior.
.github/workflows/release-bulk-connectors.yml	Updates GitHub Actions release documentation.
.github/workflows/build-manifest.yml	Updates legacy CI variable documentation.
.github/copilot-instructions.md	Documents the active GitHub Actions pipeline; a minor nit requests qualification of Python-version guidance for UBI9.
.circleci/vars.yml	Removes obsolete CircleCI settings.
.circleci/templates/dynamic.yml.j2	Removes the obsolete CircleCI template.
.circleci/scripts/requirements.txt	Removes obsolete generator dependencies.
.circleci/scripts/generate_ci.py	Removes the obsolete CI generator.
.circleci/config.yml	Removes the obsolete CircleCI workflow configuration.

Suppressed comments (1)

.github/copilot-instructions.md:160

• This statement is too broad for the UBI9 path: build-ubi9.yml passes the shared root Dockerfile_ubi9, which hard-codes python3.12, rather than using each connector's Dockerfile. Please qualify the per-connector Python-version rule to Alpine/default builds and document the shared UBI9 Dockerfile so contributors do not look in the wrong file when changing that image.

Build variants are derived from the connector directory itself: a **FIPS** image is built when a `Dockerfile_fips` exists alongside the `Dockerfile`, and the Python version comes from the connector's own `Dockerfile`.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.