Skip to content

Harden production promotion image copy and readiness #356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justin808 merged 9 commits into from
Jun 3, 2026
Merged

Harden production promotion image copy and readiness #356

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
48f8ade
Use native Control Plane image copy in promotion workflow
justin808 Jun 2, 2026
81c3f99
Use staging token directly for promotion image copy source
justin808 Jun 2, 2026
59e1dfc
Harden production promotion image copy template
justin808 Jun 2, 2026
1d85351
Merge remote-tracking branch 'origin/main' into jg-codex/use-native-p…
justin808 Jun 2, 2026
8b89d21
Update generated command docs
justin808 Jun 2, 2026
ca0468f
Address promotion copy review feedback
justin808 Jun 2, 2026
ee11d62
Harden promotion env and readiness checks
justin808 Jun 3, 2026
f50e284
Pin Buildx action in promotion workflow
justin808 Jun 3, 2026
6cd8225
Handle digest-pinned staging image refs
justin808 Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions .github/actions/cpflow-wait-for-health/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
name: Wait for Control Plane workload health
description: >-
Polls the workload's status endpoint with curl and exits success when the
HTTP response status is in the accepted list. Fails non-zero (and reports
`healthy=false`) once retries are exhausted.
Polls Control Plane until the latest workload version is ready, then checks
the workload endpoint with curl. Exits success when the HTTP response status
is in the accepted list. Fails non-zero (and reports `healthy=false`) once
retries are exhausted.

inputs:
workload_name:
Expand Down Expand Up @@ -68,8 +69,14 @@ runs:
exit 1
fi

workload_ready="$(echo "${workload_json}" | jq -r '.status.ready // false')"
latest_ready="$(echo "${workload_json}" | jq -r '.status.readyLatest // false')"
readiness_status="$(echo "${workload_json}" | jq -r '.health.readiness // "unknown"')"

@claude claude Bot Jun 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Likely wrong JSON path — will always show "unknown"

The Control Plane workload object returned by cpln workload get -o json does not have a top-level .health key. Health/readiness state lives under .status (e.g. .status.ready, .status.readyLatest). The .health.readiness path will resolve to null on every poll, so the // "unknown" fallback always fires.

This only affects the log line (not the readiness gate), but it makes the "waiting for latest deployment" message permanently say readiness=unknown and removes a useful diagnostic signal. Consider dropping this field until the correct path is confirmed from a real cpln workload response, or verify the path against the API and correct it.

Suggested change
readiness_status="$(echo "${workload_json}" | jq -r '.health.readiness // "unknown"')"
readiness_status="$(echo "${workload_json}" | jq -r '.status.readyLatest // "unknown"')"

endpoint="$(echo "${workload_json}" | jq -r '.status.endpoint // empty')"
if [[ -n "${endpoint}" ]]; then

if [[ "${workload_ready}" != "true" || "${latest_ready}" != "true" ]]; then
echo "Workload status: ready=${workload_ready}, readyLatest=${latest_ready}, readiness=${readiness_status}; waiting for latest deployment."
elif [[ -n "${endpoint}" ]]; then
http_status="$(curl -s -o /dev/null -w '%{http_code}' --max-time "${CPFLOW_CURL_MAX_TIME}" "${endpoint}" 2>/dev/null || echo 000)"
echo "Endpoint: ${endpoint}, HTTP status: ${http_status}"

Expand Down
Loading
Loading