feat: 实现 Agent Query Sink #325
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Preview application | ||
|
Check warning on line 1 in .github/workflows/preview-deploy.yml
|
||
| on: | ||
| pull_request_target: | ||
| types: | ||
| - opened | ||
| - reopened | ||
| - synchronize | ||
| - closed | ||
| permissions: | ||
| checks: read | ||
| contents: read | ||
| pull-requests: read | ||
| concurrency: | ||
| group: preview-application-pr-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| deploy: | ||
| if: >- | ||
| github.event.action != 'closed' && | ||
| github.event.pull_request.head.repo.full_name == github.repository | ||
| runs-on: ubuntu-latest | ||
| environment: preview | ||
| steps: | ||
| - name: Checkout trusted delivery implementation | ||
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
| with: | ||
| ref: ${{ github.workflow_sha }} | ||
| path: .delivery | ||
| persist-credentials: false | ||
| - name: Verify exact pull request head | ||
| uses: ./.delivery/.github/actions/preview-verify | ||
| with: | ||
| github_token: ${{ github.token }} | ||
| head_sha: ${{ github.event.pull_request.head.sha }} | ||
| pr_number: ${{ github.event.pull_request.number }} | ||
| - name: Checkout isolated pull request source | ||
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| path: source | ||
| persist-credentials: false | ||
| - name: Set up frozen Extension preview tooling | ||
| uses: pdm-project/setup-pdm@973541a5febeafcfdadf8a51211435be6ecfd90f # v4.5 | ||
| with: | ||
| python-version-file: source/.python-version | ||
| version: 2.28.0 | ||
| cache: true | ||
| cache-dependency-path: source/pdm.lock | ||
| - name: Install frozen Extension preview tooling | ||
| working-directory: source | ||
| run: >- | ||
| pdm install --no-default --group extension-preview --frozen-lockfile | ||
| - name: Build exact-head Extension wheels and sibling Registry facade | ||
| env: | ||
| PAGES_PROJECT: ${{ vars.CLOUDFLARE_EXTENSION_PREVIEW_PROJECT }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| working-directory: source | ||
| run: bash scripts/automation/preview_workflow.sh build-extensions | ||
| - name: Build peer transport images without deployment secrets | ||
| env: | ||
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | ||
| SOURCE_DIRECTORY: ${{ github.workspace }}/source | ||
| run: bash source/scripts/automation/preview_workflow.sh build-images | ||
| - name: Reverify preview authority before delivery | ||
| uses: ./.delivery/.github/actions/preview-verify | ||
| with: | ||
| github_token: ${{ github.token }} | ||
| head_sha: ${{ github.event.pull_request.head.sha }} | ||
| pr_number: ${{ github.event.pull_request.number }} | ||
| - name: Deploy exact-head sibling Registry to isolated Pages branch | ||
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | ||
| with: | ||
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| packageManager: npm | ||
| wranglerVersion: 4.120.0 | ||
| workingDirectory: .extension-preview-registry | ||
| command: >- | ||
| pages deploy . | ||
| --project-name=${{ vars.CLOUDFLARE_EXTENSION_PREVIEW_PROJECT }} | ||
| --branch=pr-${{ github.event.pull_request.number }} | ||
| --commit-hash=${{ github.event.pull_request.head.sha }} | ||
| --commit-dirty=false | ||
| - name: Reverify preview authority before Heroku delivery | ||
| uses: ./.delivery/.github/actions/preview-verify | ||
| with: | ||
| github_token: ${{ github.token }} | ||
| head_sha: ${{ github.event.pull_request.head.sha }} | ||
| pr_number: ${{ github.event.pull_request.number }} | ||
| - name: Deliver preview | ||
| uses: ./.delivery/.github/actions/preview-delivery | ||
| with: | ||
| core_database_password: ${{ secrets.CORE_DATABASE_PASSWORD }} | ||
| extension_registry_url: >- | ||
| https://pr-${{ github.event.pull_request.number }}.${{ vars.CLOUDFLARE_EXTENSION_PREVIEW_PROJECT }}.pages.dev | ||
| head_sha: ${{ github.event.pull_request.head.sha }} | ||
| heroku_api_key: ${{ secrets.HEROKU_API_KEY }} | ||
| neon_api_key: ${{ secrets.NEON_API_KEY }} | ||
| neon_project_id: ${{ vars.NEON_PROJECT_ID }} | ||
| postgrest_database_password: ${{ secrets.POSTGREST_DATABASE_PASSWORD }} | ||
| jwt_secret: ${{ secrets.JWT_SECRET }} | ||
| pr_number: ${{ github.event.pull_request.number }} | ||
| cleanup: | ||
| name: Retire preview resources | ||
| if: >- | ||
| github.event.action == 'closed' && | ||
| github.event.pull_request.head.repo.full_name == github.repository | ||
| runs-on: ubuntu-latest | ||
| environment: preview | ||
| steps: | ||
| - name: Checkout trusted cleanup controller | ||
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | ||
| with: | ||
| ref: ${{ github.workflow_sha }} | ||
| path: .delivery | ||
| persist-credentials: false | ||
| - name: Install pinned Heroku CLI | ||
| run: npm install --global heroku@11.8.1 | ||
| - name: Verify sibling Registry cleanup identity | ||
| env: | ||
| PAGES_PROJECT: ${{ vars.CLOUDFLARE_EXTENSION_PREVIEW_PROJECT }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| run: bash .delivery/scripts/automation/preview_workflow.sh validate-identity | ||
| - name: Replace sibling Registry alias with trusted tombstone | ||
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0 | ||
| with: | ||
| apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| packageManager: npm | ||
| wranglerVersion: 4.120.0 | ||
| workingDirectory: .delivery/.github/pages-preview-closed | ||
| command: >- | ||
| pages deploy . | ||
| --project-name=${{ vars.CLOUDFLARE_EXTENSION_PREVIEW_PROJECT }} | ||
| --branch=pr-${{ github.event.pull_request.number }} | ||
| --commit-hash=${{ github.workflow_sha }} | ||
| --commit-dirty=false | ||
| - name: Delete exact deterministic apps | ||
| env: | ||
| HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| run: bash .delivery/scripts/automation/preview_workflow.sh cleanup-apps | ||
