core-py deployment #241
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Production application | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Publish runtime artifact | |
| types: | |
| - completed | |
| workflow_dispatch: | |
| permissions: | |
| checks: read | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: production-application | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Deploy exact main artifact | |
| if: >- | |
| (github.event_name == 'workflow_run' && | |
| github.event.workflow_run.conclusion == 'success' && | |
| github.event.workflow_run.head_branch == 'main') || | |
| (github.event_name == 'workflow_dispatch' && | |
| github.ref == 'refs/heads/main') | |
| runs-on: ubuntu-latest | |
| environment: production | |
| steps: | |
| - name: Checkout exact main source | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| fetch-depth: 2 | |
| persist-credentials: false | |
| - name: Select normal Core release or manual recovery | |
| id: selection | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| if [ "$EVENT_NAME" = workflow_dispatch ]; then | |
| echo "selected=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "selected=$(python3 scripts/release.py version-changed --project core --base HEAD^)" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Record unchanged Core no-op | |
| if: steps.selection.outputs.selected != 'true' | |
| run: echo "Core version is unchanged; normal production delivery is a no-op." | |
| - name: Verify exact main commit | |
| if: steps.selection.outputs.selected == 'true' | |
| uses: ./.github/actions/production-verify | |
| with: | |
| github_token: ${{ github.token }} | |
| head_sha: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| - name: Pull exact published core service | |
| if: steps.selection.outputs.selected == 'true' | |
| id: core | |
| env: | |
| GHCR_TOKEN: ${{ github.token }} | |
| HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| run: bash scripts/automation/runtime_artifact.sh pull-production | |
| - name: Build release guard and PostgREST without deployment secrets | |
| if: steps.selection.outputs.selected == 'true' | |
| env: | |
| HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| run: bash scripts/automation/runtime_artifact.sh build-production-transports | |
| - name: Deliver production | |
| if: steps.selection.outputs.selected == 'true' | |
| uses: ./.github/actions/production-delivery | |
| with: | |
| core_database_password: ${{ secrets.CORE_DATABASE_PASSWORD }} | |
| core_image_digest: ${{ steps.core.outputs.digest_ref }} | |
| head_sha: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| heroku_api_key: ${{ secrets.HEROKU_API_KEY }} | |
| heroku_app_name: ${{ vars.HEROKU_APP_NAME }} | |
| jwt_secret: ${{ secrets.JWT_SECRET }} | |
| neon_api_key: ${{ secrets.NEON_API_KEY }} | |
| neon_branch_id: ${{ vars.NEON_BRANCH_ID }} | |
| neon_project_id: ${{ vars.NEON_PROJECT_ID }} | |
| postgrest_app_name: ${{ vars.POSTGREST_HEROKU_APP_NAME }} | |
| postgrest_database_password: ${{ secrets.POSTGREST_DATABASE_PASSWORD }} | |
| - name: Move production-admitted stable channel | |
| if: steps.selection.outputs.selected == 'true' | |
| env: | |
| GHCR_TOKEN: ${{ github.token }} | |
| HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} | |
| IMMUTABLE_CORE_IMAGE: ${{ steps.core.outputs.digest_ref }} | |
| run: bash scripts/automation/runtime_artifact.sh promote-stable |