docs: add ADC CI/CD guidance

[kayx23]

Summary

• add a task-oriented guide for managing ADC configuration through CI/CD
• explain ownership scopes, label selectors, protected credentials, pull-request checks, plan artifacts, deployment approvals, drift detection, and rollback
• document a pinned container workflow for CI runners
• link the new guide from the documentation index and the existing declarative workflow guide
• remove an unnecessary upstream name from the introductory workflow example

Why

The existing workflow documentation explains individual ADC commands but does not show how to combine them into a safe production delivery process. Operators need explicit guidance about destructive synchronization scope, credential exposure, plan/deploy consistency, concurrent jobs, non-atomic failures, post-deployment verification, and recovery.

This guide explains that the CI/CD runner runs ADC and connects to the gateway Admin API. Because Argo CD and Flux do not apply adc.yaml files directly, ADC must run in a separate CI job when operators also use a Kubernetes GitOps controller.

User impact

Readers now have one end-to-end operational model for:

1. linting every proposed change without credentials
2. validating trusted changes against a backend
3. preserving and reviewing diff.yaml
4. recalculating the plan immediately before an approved deployment
5. serializing deployments to the same ownership scope
6. detecting drift with scheduled checks
7. rolling back from version-controlled configuration

The guide supports both Apache APISIX and API7 Enterprise while retaining the existing warning that the APISIX backend is experimental and may normalize some resources into persistent diffs.

Validation

• ran Prettier on all three changed Markdown files
• ran git diff --check
• verified the documented ADC 0.29.0 lint, validate, diff, sync, post-sync diff, drift, and rollback workflow against disposable Apache APISIX and licensed API7 Enterprise backends
• verified the navigation and relative documentation links

Review focus

• whether the recommended label-selector ownership boundary is sufficiently prominent
• whether the security guidance matches the intended ADC/API7 Enterprise credential model
• whether the non-atomic synchronization and partial-failure recovery explanation is precise enough
• whether additional provider-specific CI examples belong here or in follow-up pages

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d2627fa-8f76-474d-b286-c84dc3815809

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}