mirror of
https://github.com/we-promise/sure.git
synced 2026-09-05 23:01:26 +00:00
Remove unfinished Cloudflare Workers PR preview deployments (#3074)
The Cloudflare Containers preview stack was never finished and no open PR carries the `preview-cf` label, so nothing is actively using it. Meanwhile the deploy workflow fires on every completed "Pull Request" run and spins up a runner just to evaluate its gate and skip. Removed entirely: - `workers/preview/` — the Worker (Durable Object container orchestration), wrangler config, npm manifests, and the `deploy/` resolver, config renderer, and log redaction helpers - `Dockerfile.preview` — Rails image with embedded PostgreSQL/Redis and the inline preview entrypoint - `.github/workflows/preview-deploy.yml` and `preview-cleanup.yml` - `bin/preview_deploy_security_check.rb` — CI guard for the above workflows - `test/javascript/preview_deploy/` — tests for the deleted deploy helpers Workflow cleanup: - `pr.yml`: drop the `preview_image` job. Also drop the `labeled` trigger type, which existed only so labelling `preview-cf` re-triggered the build and would otherwise re-run full CI on every label change. - `ci.yml`: drop the preview hardening validation step. - `pipelock.yml`: drop the exclude-paths entries for the deleted files. Deliberately untouched: the per-user preview *feature* gate (`PreviewGateable`, `config/locales/views/preview/`), Cloudflare R2 Active Storage config, and the Cloudflare Workers AI demo banner strings — all unrelated to preview deployments. Claude-Session: https://claude.ai/code/session_017TrvqNZqqzN74X7PmznJ5X Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Juan José Mata
@@ -22,9 +22,6 @@ jobs:
|
||||
- name: Scan for security vulnerabilities in Ruby dependencies
|
||||
run: bin/brakeman --no-pager
|
||||
|
||||
- name: Validate preview deploy workflow hardening
|
||||
run: ruby bin/preview_deploy_security_check.rb
|
||||
|
||||
scan_js:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
|
||||
@@ -30,7 +30,3 @@ jobs:
|
||||
config/locales/views/reports/
|
||||
docs/hosting/ai.md
|
||||
app/models/provider/binance.rb
|
||||
workers/preview/package-lock.json
|
||||
# Preview Dockerfile uses local dev credentials (rails/rails) that are
|
||||
# not real secrets; Dockerfile format does not support inline # pipelock:ignore
|
||||
Dockerfile.preview
|
||||
|
||||
@@ -3,7 +3,7 @@ name: Pull Request
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened, labeled]
|
||||
types: [opened, synchronize, reopened]
|
||||
paths-ignore:
|
||||
- 'charts/**'
|
||||
|
||||
@@ -13,72 +13,3 @@ permissions:
|
||||
jobs:
|
||||
ci:
|
||||
uses: ./.github/workflows/ci.yml
|
||||
|
||||
preview_image:
|
||||
needs: ci
|
||||
if: |
|
||||
contains(github.event.pull_request.labels.*.name, 'preview-cf') &&
|
||||
(github.event.action != 'labeled' || github.event.label.name == 'preview-cf')
|
||||
name: Build Cloudflare preview image
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 30
|
||||
permissions:
|
||||
contents: read
|
||||
env:
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
||||
IMAGE_TAG: sure-preview-pr-${{ github.event.pull_request.number }}:${{ github.event.pull_request.head.sha }}
|
||||
steps:
|
||||
- name: Checkout PR code
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Build preview image without secrets
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
image_archive="$RUNNER_TEMP/sure-preview-image.tar.gz"
|
||||
manifest_file="$RUNNER_TEMP/sure-preview-image.manifest.json"
|
||||
|
||||
docker build \
|
||||
--platform linux/amd64 \
|
||||
--build-arg "BUILD_COMMIT_SHA=${HEAD_SHA}" \
|
||||
-f Dockerfile.preview \
|
||||
-t "${IMAGE_TAG}" \
|
||||
.
|
||||
|
||||
docker image inspect "${IMAGE_TAG}" >/dev/null
|
||||
docker save "${IMAGE_TAG}" | gzip -1 > "$image_archive"
|
||||
archive_sha256="$(sha256sum "$image_archive" | awk '{print $1}')"
|
||||
image_id="$(docker image inspect --format '{{.Id}}' "${IMAGE_TAG}")"
|
||||
|
||||
printf '%s\n' "$archive_sha256" > "$RUNNER_TEMP/sure-preview-image.sha256"
|
||||
ARCHIVE_SHA256="$archive_sha256" IMAGE_ID="$image_id" node - "$manifest_file" <<'NODE'
|
||||
const fs = require('node:fs');
|
||||
|
||||
const manifestPath = process.argv[2];
|
||||
const manifest = {
|
||||
artifactVersion: 1,
|
||||
archivePath: 'sure-preview-image.tar.gz',
|
||||
archiveSha256: process.env.ARCHIVE_SHA256,
|
||||
headSha: process.env.HEAD_SHA,
|
||||
imageId: process.env.IMAGE_ID,
|
||||
imageTag: process.env.IMAGE_TAG,
|
||||
prNumber: process.env.PR_NUMBER,
|
||||
};
|
||||
|
||||
fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
|
||||
NODE
|
||||
jq -e . "$manifest_file" >/dev/null
|
||||
|
||||
- name: Upload preview image artifact
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: preview-image-pr-${{ env.PR_NUMBER }}-${{ env.HEAD_SHA }}
|
||||
path: |
|
||||
${{ runner.temp }}/sure-preview-image.tar.gz
|
||||
${{ runner.temp }}/sure-preview-image.sha256
|
||||
${{ runner.temp }}/sure-preview-image.manifest.json
|
||||
if-no-files-found: error
|
||||
retention-days: 3
|
||||
|
||||
@@ -1,249 +0,0 @@
|
||||
name: Cleanup PR Previews
|
||||
|
||||
on:
|
||||
# Run hourly to check for expired previews
|
||||
schedule:
|
||||
- cron: '0 * * * *'
|
||||
|
||||
# Immediately cleanup when PR is closed
|
||||
pull_request:
|
||||
types: [closed, unlabeled]
|
||||
|
||||
# Allow manual trigger
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: 'PR number to cleanup (optional, cleans all expired if empty)'
|
||||
required: false
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
deployments: write
|
||||
|
||||
jobs:
|
||||
cleanup-on-close:
|
||||
name: Cleanup closed PR preview
|
||||
if: |
|
||||
github.event_name == 'pull_request' &&
|
||||
(
|
||||
(github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'preview-cf')) ||
|
||||
(github.event.action == 'unlabeled' && github.event.label.name == 'preview-cf')
|
||||
)
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Delete preview Worker
|
||||
env:
|
||||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
|
||||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
WORKER_NAME="sure-preview-${{ github.event.pull_request.number }}"
|
||||
echo "Deleting Worker: $WORKER_NAME"
|
||||
|
||||
if [ -z "${CLOUDFLARE_API_TOKEN:-}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID:-}" ]; then
|
||||
echo "Missing Cloudflare credentials; refusing to mark preview cleanup as successful"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Delete the worker (this also stops any running containers)
|
||||
response_file="$(mktemp)"
|
||||
http_status="$(curl -sS -o "$response_file" -w "%{http_code}" -X DELETE \
|
||||
"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/scripts/$WORKER_NAME?force=true" \
|
||||
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
|
||||
-H "Content-Type: application/json")" || {
|
||||
echo "Failed to delete preview Worker via Cloudflare API"
|
||||
exit 1
|
||||
}
|
||||
response="$(cat "$response_file")"
|
||||
|
||||
if [ -z "$response" ] && [[ "$http_status" =~ ^2 ]]; then
|
||||
echo "Deleted Worker: $WORKER_NAME"
|
||||
elif [ -n "$response" ] && echo "$response" | jq -e '.success == true' >/dev/null; then
|
||||
echo "Deleted Worker: $WORKER_NAME"
|
||||
elif [ -n "$response" ] && echo "$response" | jq -e '[.errors[]?.code] | index(10007)' >/dev/null; then
|
||||
echo "$response" | jq -c '.errors'
|
||||
echo "Worker may not exist"
|
||||
else
|
||||
echo "Cloudflare API failed to delete preview Worker (HTTP $http_status)"
|
||||
if [ -n "$response" ]; then
|
||||
echo "$response" | jq -c '.errors // .' || printf '%s\n' "$response"
|
||||
else
|
||||
echo "No response body"
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Delete GitHub Deployment
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const environment = `preview-pr-${{ github.event.pull_request.number }}`;
|
||||
const description = context.payload.action === 'closed'
|
||||
? 'PR closed - preview deleted'
|
||||
: 'preview-cf label removed - preview deleted';
|
||||
|
||||
try {
|
||||
// Get deployments for this environment
|
||||
const { data: deployments } = await github.rest.repos.listDeployments({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
environment: environment
|
||||
});
|
||||
|
||||
// Mark all deployments as inactive
|
||||
for (const deployment of deployments) {
|
||||
await github.rest.repos.createDeploymentStatus({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
deployment_id: deployment.id,
|
||||
state: 'inactive',
|
||||
description
|
||||
});
|
||||
}
|
||||
|
||||
console.log(`Marked ${deployments.length} deployments as inactive`);
|
||||
} catch (error) {
|
||||
console.log('No deployments to cleanup or error:', error.message);
|
||||
}
|
||||
|
||||
cleanup-expired:
|
||||
name: Cleanup expired previews
|
||||
if: github.repository == 'we-promise/sure' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
|
||||
with:
|
||||
node-version: "24"
|
||||
|
||||
- name: Install Wrangler
|
||||
run: npm install -g wrangler
|
||||
|
||||
- name: Cleanup expired previews
|
||||
env:
|
||||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
||||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
PR_INPUT: ${{ inputs.pr_number }}
|
||||
run: |
|
||||
# If specific PR number provided, only cleanup that one
|
||||
if [ -n "$PR_INPUT" ]; then
|
||||
if [[ "$PR_INPUT" =~ ^[1-9][0-9]*$ ]]; then
|
||||
PR_NUM="$PR_INPUT"
|
||||
WORKER_NAME="sure-preview-$PR_NUM"
|
||||
echo "Manually deleting Worker: $WORKER_NAME"
|
||||
wrangler delete --name "$WORKER_NAME" --force || echo "Worker may not exist"
|
||||
|
||||
# Cleanup GitHub deployment for this PR
|
||||
echo "Cleaning up GitHub deployment for PR #$PR_NUM"
|
||||
gh api \
|
||||
-X GET "/repos/${{ github.repository }}/deployments?environment=preview-pr-$PR_NUM" \
|
||||
--jq '.[].id' 2>/dev/null | while read -r DEPLOY_ID; do
|
||||
if [ -n "$DEPLOY_ID" ]; then
|
||||
gh api \
|
||||
-X POST "/repos/${{ github.repository }}/deployments/$DEPLOY_ID/statuses" \
|
||||
-f state=inactive \
|
||||
-f description="Preview manually deleted" || true
|
||||
fi
|
||||
done || echo "No deployments to cleanup or error occurred"
|
||||
else
|
||||
echo "Invalid PR number input '$PR_INPUT'; skipping manual cleanup"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get list of all preview workers
|
||||
echo "Fetching list of preview workers..."
|
||||
|
||||
# Use Cloudflare API to list workers and read modified_on from the list response.
|
||||
# The per-script endpoint returns raw script content, not JSON metadata.
|
||||
WORKERS_RESPONSE=$(curl -fsS -X GET \
|
||||
"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/scripts" \
|
||||
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
|
||||
-H "Content-Type: application/json") || {
|
||||
echo "Failed to fetch preview worker list from Cloudflare"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if ! echo "$WORKERS_RESPONSE" | jq -e '.success == true and (.result | type == "array")' >/dev/null 2>&1; then
|
||||
echo "Cloudflare API returned an invalid worker list response"
|
||||
echo "$WORKERS_RESPONSE" | jq -c '.errors // .'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WORKERS=$(echo "$WORKERS_RESPONSE" | jq -r '
|
||||
.result[]
|
||||
| select(.id | startswith("sure-preview-"))
|
||||
| [.id, (.modified_on // "")]
|
||||
| @tsv
|
||||
')
|
||||
|
||||
if [ -z "$WORKERS" ]; then
|
||||
echo "No preview workers found"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Found preview workers:"
|
||||
echo "$WORKERS" | cut -f1
|
||||
|
||||
# Check each worker's deployment time
|
||||
CUTOFF_TIME=$(date -d '24 hours ago' +%s)
|
||||
|
||||
while IFS=$'\t' read -r WORKER MODIFIED_ON; do
|
||||
[ -n "$WORKER" ] || continue
|
||||
echo "Checking $WORKER..."
|
||||
|
||||
if [ -z "$MODIFIED_ON" ]; then
|
||||
echo "No modified_on timestamp for $WORKER; skipping"
|
||||
continue
|
||||
fi
|
||||
|
||||
if ! MODIFIED_TS=$(date -d "$MODIFIED_ON" +%s 2>/dev/null); then
|
||||
echo "Invalid modified_on timestamp for $WORKER ($MODIFIED_ON); skipping"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ "$MODIFIED_TS" -lt "$CUTOFF_TIME" ]; then
|
||||
echo "Worker $WORKER is older than 24 hours, deleting..."
|
||||
if wrangler delete --name "$WORKER" --force; then
|
||||
# Extract PR number and cleanup GitHub deployment
|
||||
PR_NUM="${WORKER#sure-preview-}"
|
||||
if [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]]; then
|
||||
echo "Cleaning up GitHub deployment for PR #$PR_NUM"
|
||||
gh api \
|
||||
-X GET "/repos/${{ github.repository }}/deployments?environment=preview-pr-$PR_NUM" \
|
||||
--jq '.[].id' 2>/dev/null | while read -r DEPLOY_ID; do
|
||||
gh api \
|
||||
-X POST "/repos/${{ github.repository }}/deployments/$DEPLOY_ID/statuses" \
|
||||
-f state=inactive \
|
||||
-f description="Preview expired after 24 hours" || true
|
||||
done || echo "No deployments to cleanup or error occurred"
|
||||
else
|
||||
echo "Could not extract a valid PR number from $WORKER; skipping deployment cleanup"
|
||||
fi
|
||||
else
|
||||
echo "Failed to delete $WORKER; skipping deployment status update"
|
||||
fi
|
||||
else
|
||||
echo "Worker $WORKER is still within 24-hour window, keeping..."
|
||||
fi
|
||||
done <<< "$WORKERS"
|
||||
|
||||
echo "Cleanup complete"
|
||||
@@ -1,636 +0,0 @@
|
||||
name: Deploy PR Preview
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Pull Request"]
|
||||
types: [completed]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
preview-gate:
|
||||
if: |
|
||||
github.event.workflow_run.event == 'pull_request' &&
|
||||
github.event.workflow_run.conclusion == 'success'
|
||||
name: Validate preview deployment gates
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
pull-requests: read
|
||||
outputs:
|
||||
artifact_name: ${{ steps.preview.outputs.artifact_name }}
|
||||
head_sha: ${{ steps.preview.outputs.head_sha }}
|
||||
is_fork: ${{ steps.preview.outputs.is_fork }}
|
||||
pr_number: ${{ steps.preview.outputs.pr_number }}
|
||||
resolution_source: ${{ steps.preview.outputs.resolution_source }}
|
||||
should_deploy: ${{ steps.preview.outputs.should_deploy }}
|
||||
|
||||
steps:
|
||||
- name: Checkout trusted preview resolver
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
|
||||
with:
|
||||
ref: ${{ github.event.repository.default_branch }}
|
||||
path: trusted-preview-resolver
|
||||
persist-credentials: false
|
||||
sparse-checkout: |
|
||||
workers/preview/deploy
|
||||
|
||||
- name: Resolve preview request
|
||||
id: preview
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const { resolvePreviewRequest } = require('./trusted-preview-resolver/workers/preview/deploy/resolve_preview_request.cjs');
|
||||
await resolvePreviewRequest({ github, context, core });
|
||||
|
||||
deployment_record:
|
||||
needs: preview-gate
|
||||
if: needs.preview-gate.outputs.should_deploy == 'true'
|
||||
name: Create GitHub Deployment
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
permissions:
|
||||
contents: read
|
||||
deployments: write
|
||||
outputs:
|
||||
deployment_id: ${{ steps.deployment.outputs.result }}
|
||||
env:
|
||||
HEAD_SHA: ${{ needs.preview-gate.outputs.head_sha }}
|
||||
IS_FORK: ${{ needs.preview-gate.outputs.is_fork }}
|
||||
PR_NUMBER: ${{ needs.preview-gate.outputs.pr_number }}
|
||||
|
||||
steps:
|
||||
- name: Create GitHub Deployment
|
||||
if: env.IS_FORK == 'false'
|
||||
id: deployment
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const prNumber = process.env.PR_NUMBER;
|
||||
const headSha = process.env.HEAD_SHA;
|
||||
const deployment = await github.rest.repos.createDeployment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
ref: headSha,
|
||||
environment: `preview-pr-${prNumber}`,
|
||||
auto_merge: false,
|
||||
required_contexts: [],
|
||||
description: 'PR Preview Deployment'
|
||||
});
|
||||
return deployment.data.id;
|
||||
result-encoding: string
|
||||
|
||||
deploy-preview:
|
||||
needs: [preview-gate, deployment_record]
|
||||
if: |
|
||||
always() &&
|
||||
needs.preview-gate.outputs.should_deploy == 'true' &&
|
||||
(needs.deployment_record.result == 'success' || needs.deployment_record.result == 'skipped')
|
||||
name: Deploy to Cloudflare Containers
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
concurrency:
|
||||
group: preview-deploy-${{ needs.preview-gate.outputs.pr_number }}
|
||||
cancel-in-progress: true
|
||||
environment: preview
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
outputs:
|
||||
preview_url: ${{ steps.deploy.outputs.preview_url }}
|
||||
env:
|
||||
ARTIFACT_NAME: ${{ needs.preview-gate.outputs.artifact_name }}
|
||||
HEAD_SHA: ${{ needs.preview-gate.outputs.head_sha }}
|
||||
IS_FORK: ${{ needs.preview-gate.outputs.is_fork }}
|
||||
PR_NUMBER: ${{ needs.preview-gate.outputs.pr_number }}
|
||||
RESOLUTION_SOURCE: ${{ needs.preview-gate.outputs.resolution_source }}
|
||||
|
||||
steps:
|
||||
- name: Checkout trusted preview tooling
|
||||
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
|
||||
with:
|
||||
ref: ${{ github.event.repository.default_branch }}
|
||||
path: trusted
|
||||
persist-credentials: false
|
||||
sparse-checkout: |
|
||||
workers/preview
|
||||
|
||||
- name: Download preview image artifact
|
||||
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
|
||||
with:
|
||||
name: ${{ env.ARTIFACT_NAME }}
|
||||
run-id: ${{ github.event.workflow_run.id }}
|
||||
github-token: ${{ github.token }}
|
||||
path: ${{ runner.temp }}/preview-image
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
||||
with:
|
||||
node-version: "24"
|
||||
|
||||
- name: Verify preview image artifact checksum
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
image_archive="$RUNNER_TEMP/preview-image/sure-preview-image.tar.gz"
|
||||
checksum_file="$RUNNER_TEMP/preview-image/sure-preview-image.sha256"
|
||||
manifest_file="$RUNNER_TEMP/preview-image/sure-preview-image.manifest.json"
|
||||
expected_files="$(mktemp)"
|
||||
actual_files="$(mktemp)"
|
||||
|
||||
test -f "$image_archive"
|
||||
test -f "$checksum_file"
|
||||
test -f "$manifest_file"
|
||||
|
||||
printf '%s\n' \
|
||||
sure-preview-image.manifest.json \
|
||||
sure-preview-image.sha256 \
|
||||
sure-preview-image.tar.gz | sort > "$expected_files"
|
||||
find "$RUNNER_TEMP/preview-image" -maxdepth 1 -type f -printf '%f\n' | sort > "$actual_files"
|
||||
|
||||
if ! diff -u "$expected_files" "$actual_files"; then
|
||||
echo "Preview image artifact contained unexpected files" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
expected_checksum="$(tr -d '[:space:]' < "$checksum_file")"
|
||||
actual_checksum="$(sha256sum "$image_archive" | awk '{print $1}')"
|
||||
|
||||
if [ "$expected_checksum" != "$actual_checksum" ]; then
|
||||
echo "Preview image artifact checksum mismatch" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
node - "$manifest_file" "$expected_checksum" <<'NODE'
|
||||
const fs = require('node:fs');
|
||||
|
||||
const manifestPath = process.argv[2];
|
||||
const expectedChecksum = process.argv[3];
|
||||
const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
|
||||
const expectedImageTag = `sure-preview-pr-${process.env.PR_NUMBER}:${process.env.HEAD_SHA}`;
|
||||
const expected = {
|
||||
artifactVersion: 1,
|
||||
archivePath: 'sure-preview-image.tar.gz',
|
||||
archiveSha256: expectedChecksum,
|
||||
headSha: process.env.HEAD_SHA,
|
||||
imageTag: expectedImageTag,
|
||||
prNumber: process.env.PR_NUMBER,
|
||||
};
|
||||
|
||||
for (const [key, value] of Object.entries(expected)) {
|
||||
if (manifest[key] !== value) {
|
||||
throw new Error(`Preview image manifest ${key} mismatch`);
|
||||
}
|
||||
}
|
||||
|
||||
if (!/^sha256:[a-f0-9]{64}$/.test(manifest.imageId || '')) {
|
||||
throw new Error('Preview image manifest imageId is invalid');
|
||||
}
|
||||
NODE
|
||||
|
||||
- name: Prepare trusted preview deploy workspace
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
preview_dir="$RUNNER_TEMP/sure-preview-worker"
|
||||
rm -rf "$preview_dir"
|
||||
mkdir -p "$preview_dir"
|
||||
|
||||
cp trusted/workers/preview/package.json "$preview_dir/package.json"
|
||||
cp trusted/workers/preview/package-lock.json "$preview_dir/package-lock.json"
|
||||
cp trusted/workers/preview/tsconfig.json "$preview_dir/tsconfig.json"
|
||||
cp trusted/workers/preview/wrangler.toml "$preview_dir/wrangler.toml"
|
||||
cp -R trusted/workers/preview/src "$preview_dir/src"
|
||||
mkdir -p "$preview_dir/deploy"
|
||||
cp trusted/workers/preview/deploy/redact_preview_log.sh "$preview_dir/deploy/redact_preview_log.sh"
|
||||
cp trusted/workers/preview/deploy/render_preview_config.cjs "$preview_dir/deploy/render_preview_config.cjs"
|
||||
chmod 0755 "$preview_dir/deploy/redact_preview_log.sh"
|
||||
|
||||
diagnostics_nonce="$(openssl rand -hex 32)"
|
||||
sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/wrangler.toml"
|
||||
sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/src/index.ts"
|
||||
sed -i "s/\${PREVIEW_DIAGNOSTICS_NONCE}/${diagnostics_nonce}/g" "$preview_dir/src/index.ts"
|
||||
cp "$preview_dir/wrangler.toml" "$preview_dir/wrangler.source.toml"
|
||||
|
||||
if grep -F "\${PREVIEW_DIAGNOSTICS_NONCE}" "$preview_dir/src/index.ts" >/dev/null; then
|
||||
echo "Preview diagnostics nonce placeholder was not replaced" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$preview_dir"
|
||||
npm ci --ignore-scripts --no-audit --no-fund
|
||||
|
||||
- name: Load preview image artifact
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
image_archive="$RUNNER_TEMP/preview-image/sure-preview-image.tar.gz"
|
||||
manifest_file="$RUNNER_TEMP/preview-image/sure-preview-image.manifest.json"
|
||||
expected_image="sure-preview-pr-${PR_NUMBER}:${HEAD_SHA}"
|
||||
|
||||
gzip -dc "$image_archive" | docker load
|
||||
docker image inspect "$expected_image" >/dev/null
|
||||
expected_image_id="$(node -e 'const fs = require("node:fs"); process.stdout.write(JSON.parse(fs.readFileSync(process.argv[1], "utf8")).imageId);' "$manifest_file")"
|
||||
actual_image_id="$(docker image inspect --format '{{.Id}}' "$expected_image")"
|
||||
|
||||
if [ "$expected_image_id" != "$actual_image_id" ]; then
|
||||
echo "Loaded preview image ID did not match artifact manifest" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Push preview image to Cloudflare registry
|
||||
id: image
|
||||
env:
|
||||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
cd "$RUNNER_TEMP/sure-preview-worker"
|
||||
source_config="$RUNNER_TEMP/sure-preview-worker/wrangler.source.toml"
|
||||
config_path="$RUNNER_TEMP/sure-preview-worker/wrangler.toml"
|
||||
image_tag="sure-preview-pr-${PR_NUMBER}:${HEAD_SHA}"
|
||||
temporary_image_ref="registry.cloudflare.com/${CLOUDFLARE_ACCOUNT_ID}/${image_tag}"
|
||||
push_log="$RUNNER_TEMP/wrangler-containers-push.log"
|
||||
clean_log="$RUNNER_TEMP/wrangler-containers-push.clean.log"
|
||||
push_status=0
|
||||
|
||||
# wrangler containers push validates wrangler.toml, so point the trusted
|
||||
# config at a registry-shaped ref while it pushes the verified local image.
|
||||
PREVIEW_IMAGE_REF="$temporary_image_ref" node ./deploy/render_preview_config.cjs render "$source_config" "$config_path"
|
||||
cp "$config_path" "$RUNNER_TEMP/wrangler-push.toml"
|
||||
|
||||
set +e
|
||||
./node_modules/.bin/wrangler containers push "$image_tag" 2>&1 | tee "$push_log" | ./deploy/redact_preview_log.sh
|
||||
push_status=${PIPESTATUS[0]}
|
||||
set -e
|
||||
perl -pe 's/\e\[[0-9;]*[A-Za-z]//g' "$push_log" > "$clean_log"
|
||||
|
||||
if [ "$push_status" -ne 0 ]; then
|
||||
exit "$push_status"
|
||||
fi
|
||||
|
||||
image_ref="$(node ./deploy/render_preview_config.cjs find "$clean_log")"
|
||||
|
||||
if [ -z "$image_ref" ]; then
|
||||
echo "Could not find Cloudflare registry image reference in wrangler output" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "image_ref=${image_ref}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Configure trusted preview image reference
|
||||
env:
|
||||
IMAGE_REF: ${{ steps.image.outputs.image_ref }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
source_config="$RUNNER_TEMP/sure-preview-worker/wrangler.source.toml"
|
||||
config_path="$RUNNER_TEMP/sure-preview-worker/wrangler.toml"
|
||||
# Render from the preserved trusted source template so the push-time
|
||||
# registry ref cannot make the final deploy rewrite stateful.
|
||||
PREVIEW_IMAGE_REF="$IMAGE_REF" node "$RUNNER_TEMP/sure-preview-worker/deploy/render_preview_config.cjs" render "$source_config" "$config_path"
|
||||
cp "$config_path" "$RUNNER_TEMP/wrangler-final.toml"
|
||||
|
||||
# Print a redacted copy for logs without mutating the config used by deploy.
|
||||
redacted_config="$RUNNER_TEMP/wrangler-redacted.toml"
|
||||
"$RUNNER_TEMP/sure-preview-worker/deploy/redact_preview_log.sh" < "$config_path" > "$redacted_config"
|
||||
cat "$redacted_config"
|
||||
|
||||
- name: Deploy to Cloudflare Containers
|
||||
id: deploy
|
||||
env:
|
||||
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
||||
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
|
||||
CLOUDFLARE_WORKERS_SUBDOMAIN: ${{ secrets.CLOUDFLARE_WORKERS_SUBDOMAIN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
cd "$RUNNER_TEMP/sure-preview-worker"
|
||||
deploy_log="$RUNNER_TEMP/wrangler-deploy.log"
|
||||
clean_deploy_log="$RUNNER_TEMP/wrangler-deploy.clean.log"
|
||||
|
||||
deploy_once() {
|
||||
set +e
|
||||
./node_modules/.bin/wrangler deploy --config wrangler.toml --var "PR_NUMBER:${PR_NUMBER}" 2>&1 | tee "$deploy_log" | ./deploy/redact_preview_log.sh
|
||||
local deploy_status=${PIPESTATUS[0]}
|
||||
set -e
|
||||
return "$deploy_status"
|
||||
}
|
||||
|
||||
if ! deploy_once; then
|
||||
perl -pe 's/\e\[[0-9;]*[A-Za-z]//g' "$deploy_log" > "$clean_deploy_log"
|
||||
|
||||
if grep -F "associated with a different durable object namespace" "$clean_deploy_log" >/dev/null; then
|
||||
echo "Detected stale Cloudflare container app state for PR ${PR_NUMBER}; deleting preview Worker and retrying once."
|
||||
if ! ./node_modules/.bin/wrangler delete --name "sure-preview-${PR_NUMBER}" --force; then
|
||||
echo "Preview Worker delete failed; continuing to the single retry so wrangler deploy reports the final error if the stale state remains." >&2
|
||||
fi
|
||||
deploy_once
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Get the deployment URL
|
||||
PREVIEW_URL="https://sure-preview-${PR_NUMBER}.${CLOUDFLARE_WORKERS_SUBDOMAIN}.workers.dev"
|
||||
echo "preview_url=${PREVIEW_URL}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Warm preview container
|
||||
env:
|
||||
PREVIEW_URL: ${{ steps.deploy.outputs.preview_url }}
|
||||
run: |
|
||||
echo "Triggering preview wake-up..."
|
||||
curl -fsS --connect-timeout 5 --max-time 15 "$PREVIEW_URL/_container_status" >/dev/null || true
|
||||
|
||||
- name: Collect preview diagnostics
|
||||
if: success()
|
||||
env:
|
||||
PREVIEW_URL: ${{ steps.deploy.outputs.preview_url }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
diagnostics_dir="$RUNNER_TEMP/preview-diagnostics"
|
||||
diagnostics_file="$diagnostics_dir/preview-diagnostics.json"
|
||||
latest_metrics_file="$diagnostics_dir/latest-metrics.json"
|
||||
polls_log="$diagnostics_dir/metrics-polls.log"
|
||||
summary_file="$diagnostics_dir/summary.md"
|
||||
last_error=""
|
||||
mkdir -p "$diagnostics_dir"
|
||||
|
||||
# ~100 polls x ~3.5s = up to ~6 min. The preview must cold-start the
|
||||
# container (≈1.3 GB image pull + sandbox init) and generate the full
|
||||
# demo dataset before previewReady flips. A real Cloudflare standard-1
|
||||
# run measured previewReady at ~195s (rails ~46s, demo data ~149s) —
|
||||
# the old 40-poll (~140s) budget would have failed a working preview.
|
||||
# Keep generous headroom; the loop still breaks early on ready/failed.
|
||||
for attempt in $(seq 1 100); do
|
||||
if curl -fsS --connect-timeout 5 --max-time 15 "$PREVIEW_URL/_container_status" -o "$diagnostics_file"; then
|
||||
if jq -e . "$diagnostics_file" >/dev/null 2>&1; then
|
||||
jq -c --argjson attempt "$attempt" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||||
'{attempt: $attempt, at: $at, previewReady: (.previewReady // false), previewFailed: (.previewFailed // false), progress: (.progress // {}), timings: (.timings // {})}' \
|
||||
"$diagnostics_file" >> "$polls_log"
|
||||
jq '{previewReady: (.previewReady // false), previewFailed: (.previewFailed // false), progress: (.progress // {}), timings: (.timings // {})}' "$diagnostics_file" > "$latest_metrics_file"
|
||||
|
||||
if jq -e '.previewReady == true or .previewFailed == true' "$diagnostics_file" >/dev/null; then
|
||||
break
|
||||
fi
|
||||
else
|
||||
last_error="invalid diagnostics JSON on attempt ${attempt}"
|
||||
raw_snippet="$(head -c 2048 "$diagnostics_file")"
|
||||
latest_metrics_snapshot="none"
|
||||
if [ -f "$latest_metrics_file" ]; then
|
||||
latest_metrics_snapshot="$(head -c 2048 "$latest_metrics_file")"
|
||||
fi
|
||||
jq -nc --argjson attempt "$attempt" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg error "$last_error" --arg latestMetrics "$latest_metrics_snapshot" --arg rawSnippet "$raw_snippet" \
|
||||
'{attempt: $attempt, at: $at, error: $error, latestMetrics: $latestMetrics, rawSnippet: $rawSnippet}' >> "$polls_log"
|
||||
fi
|
||||
else
|
||||
last_error="curl failed on attempt ${attempt}"
|
||||
jq -nc --argjson attempt "$attempt" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg error "$last_error" \
|
||||
'{attempt: $attempt, at: $at, error: $error}' >> "$polls_log"
|
||||
fi
|
||||
|
||||
sleep 3
|
||||
done
|
||||
|
||||
if [ ! -s "$diagnostics_file" ] || ! jq -e . "$diagnostics_file" >/dev/null 2>&1; then
|
||||
jq -n --arg error "${last_error:-preview diagnostics unavailable}" \
|
||||
--arg url "$PREVIEW_URL" \
|
||||
'{previewReady: false, previewFailed: false, error: $error, previewUrl: $url}' > "$diagnostics_file"
|
||||
fi
|
||||
|
||||
jq '{previewReady: (.previewReady // false), previewFailed: (.previewFailed // false), progress: (.progress // {}), timings: (.timings // {}), error: (.error // null)}' "$diagnostics_file" > "$latest_metrics_file"
|
||||
{
|
||||
echo "# Preview diagnostics"
|
||||
echo
|
||||
echo "- PR: ${PR_NUMBER}"
|
||||
echo "- Commit: ${HEAD_SHA}"
|
||||
echo "- Preview URL: ${PREVIEW_URL}"
|
||||
echo "- Preview ready: $(jq -r '.previewReady // false' "$diagnostics_file")"
|
||||
echo "- Preview failed: $(jq -r '.previewFailed // false' "$diagnostics_file")"
|
||||
echo "- Phase: $(jq -r '.progress.phase // "unknown"' "$diagnostics_file")"
|
||||
echo "- Stage: $(jq -r '.progress.stage // "unknown"' "$diagnostics_file")"
|
||||
echo "- Seconds to Rails ready: $(jq -r '.timings.secondsToRailsReady // "unknown"' "$diagnostics_file")"
|
||||
echo "- Seconds to demo data ready: $(jq -r '.timings.secondsToDemoDataReady // "unknown"' "$diagnostics_file")"
|
||||
echo "- Seconds to preview ready: $(jq -r '.timings.secondsToPreviewReady // "unknown"' "$diagnostics_file")"
|
||||
} > "$summary_file"
|
||||
|
||||
jq -c . "$diagnostics_file"
|
||||
|
||||
if jq -e '.previewFailed == true' "$diagnostics_file" >/dev/null; then
|
||||
echo "Preview diagnostics from _container_status reported previewFailed=true:" >&2
|
||||
jq -c . "$diagnostics_file" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! jq -e '.previewReady == true' "$diagnostics_file" >/dev/null; then
|
||||
echo "Preview diagnostics from _container_status did not reach previewReady=true:" >&2
|
||||
jq -c . "$diagnostics_file" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! jq -e '.timings.previewReadyAt != null and .timings.secondsToPreviewReady != null' "$diagnostics_file" >/dev/null; then
|
||||
echo "Preview diagnostics are missing readiness timing fields:" >&2
|
||||
jq -c . "$diagnostics_file" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Upload preview diagnostics
|
||||
if: always() && steps.deploy.outputs.preview_url != ''
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: preview-diagnostics-pr-${{ env.PR_NUMBER }}-${{ env.HEAD_SHA }}
|
||||
path: ${{ runner.temp }}/preview-diagnostics
|
||||
if-no-files-found: error
|
||||
retention-days: 3
|
||||
|
||||
- name: Collect preview failure diagnostics
|
||||
if: failure()
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
diagnostics_dir="$RUNNER_TEMP/preview-failure-diagnostics"
|
||||
manifest_file="$RUNNER_TEMP/preview-image/sure-preview-image.manifest.json"
|
||||
redaction_helper="$RUNNER_TEMP/sure-preview-worker/deploy/redact_preview_log.sh"
|
||||
mkdir -p "$diagnostics_dir"
|
||||
|
||||
jq -n \
|
||||
--arg artifactName "$ARTIFACT_NAME" \
|
||||
--arg headSha "$HEAD_SHA" \
|
||||
--arg isFork "$IS_FORK" \
|
||||
--arg prNumber "$PR_NUMBER" \
|
||||
--arg resolutionSource "$RESOLUTION_SOURCE" \
|
||||
'{
|
||||
artifactName: $artifactName,
|
||||
headSha: $headSha,
|
||||
isFork: $isFork,
|
||||
prNumber: $prNumber,
|
||||
resolutionSource: $resolutionSource
|
||||
}' > "$diagnostics_dir/preview-request.json"
|
||||
|
||||
sanitize_copy() {
|
||||
local source="$1"
|
||||
local destination="$2"
|
||||
if [ -f "$source" ]; then
|
||||
if [ -x "$redaction_helper" ]; then
|
||||
"$redaction_helper" < "$source" > "$destination"
|
||||
else
|
||||
cp "$source" "$destination"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
if [ -f "$manifest_file" ]; then
|
||||
jq '{
|
||||
artifactVersion,
|
||||
archivePath,
|
||||
archiveSha256,
|
||||
headSha,
|
||||
imageId,
|
||||
imageTag,
|
||||
prNumber
|
||||
}' "$manifest_file" > "$diagnostics_dir/preview-image-manifest.json"
|
||||
fi
|
||||
|
||||
sanitize_copy "$RUNNER_TEMP/sure-preview-worker/wrangler.source.toml" "$diagnostics_dir/wrangler-source.toml"
|
||||
sanitize_copy "$RUNNER_TEMP/wrangler-push.toml" "$diagnostics_dir/wrangler-push.toml"
|
||||
sanitize_copy "$RUNNER_TEMP/wrangler-final.toml" "$diagnostics_dir/wrangler-final.toml"
|
||||
sanitize_copy "$RUNNER_TEMP/sure-preview-worker/wrangler.toml" "$diagnostics_dir/wrangler.toml"
|
||||
sanitize_copy "$RUNNER_TEMP/wrangler-containers-push.clean.log" "$diagnostics_dir/wrangler-containers-push.log"
|
||||
if [ -f "$RUNNER_TEMP/wrangler-deploy.clean.log" ]; then
|
||||
sanitize_copy "$RUNNER_TEMP/wrangler-deploy.clean.log" "$diagnostics_dir/wrangler-deploy.log"
|
||||
else
|
||||
sanitize_copy "$RUNNER_TEMP/wrangler-deploy.log" "$diagnostics_dir/wrangler-deploy.log"
|
||||
fi
|
||||
|
||||
find "$diagnostics_dir" -maxdepth 1 -type f -print
|
||||
|
||||
- name: Upload preview failure diagnostics
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: preview-failure-diagnostics-pr-${{ env.PR_NUMBER }}-${{ env.HEAD_SHA }}
|
||||
path: ${{ runner.temp }}/preview-failure-diagnostics
|
||||
if-no-files-found: error
|
||||
retention-days: 3
|
||||
|
||||
- name: Prepare cleanup metadata
|
||||
if: success()
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
metadata_dir="$RUNNER_TEMP/preview-cleanup-metadata"
|
||||
mkdir -p "$metadata_dir"
|
||||
"$RUNNER_TEMP/sure-preview-worker/deploy/redact_preview_log.sh" \
|
||||
< "$RUNNER_TEMP/sure-preview-worker/wrangler.toml" \
|
||||
> "$metadata_dir/wrangler.toml"
|
||||
|
||||
- name: Store cleanup metadata
|
||||
if: success()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: preview-cleanup-pr-${{ env.PR_NUMBER }}
|
||||
path: ${{ runner.temp }}/preview-cleanup-metadata/wrangler.toml
|
||||
retention-days: 2
|
||||
|
||||
deployment_status:
|
||||
needs: [preview-gate, deployment_record, deploy-preview]
|
||||
if: |
|
||||
always() &&
|
||||
needs.preview-gate.outputs.should_deploy == 'true' &&
|
||||
needs.preview-gate.outputs.is_fork == 'false' &&
|
||||
needs.deployment_record.result == 'success'
|
||||
name: Update GitHub Deployment Status
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
permissions:
|
||||
contents: read
|
||||
deployments: write
|
||||
env:
|
||||
DEPLOYMENT_ID: ${{ needs.deployment_record.outputs.deployment_id }}
|
||||
DEPLOY_RESULT: ${{ needs.deploy-preview.result }}
|
||||
PREVIEW_URL: ${{ needs.deploy-preview.outputs.preview_url }}
|
||||
|
||||
steps:
|
||||
- name: Update Deployment Status
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const state = process.env.DEPLOY_RESULT === 'success' ? 'success' : 'failure';
|
||||
const previewUrl = process.env.PREVIEW_URL || undefined;
|
||||
await github.rest.repos.createDeploymentStatus({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
deployment_id: Number(process.env.DEPLOYMENT_ID),
|
||||
state: state,
|
||||
environment_url: state === 'success' ? previewUrl : undefined,
|
||||
description: state === 'success' ? 'Preview deployed successfully' : 'Preview deployment failed'
|
||||
});
|
||||
|
||||
preview_comment:
|
||||
needs: [preview-gate, deploy-preview]
|
||||
if: needs.deploy-preview.result == 'success'
|
||||
name: Comment on PR
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
env:
|
||||
HEAD_SHA: ${{ needs.preview-gate.outputs.head_sha }}
|
||||
PR_NUMBER: ${{ needs.preview-gate.outputs.pr_number }}
|
||||
PREVIEW_URL: ${{ needs.deploy-preview.outputs.preview_url }}
|
||||
|
||||
steps:
|
||||
- name: Comment on PR
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
script: |
|
||||
const previewUrl = process.env.PREVIEW_URL;
|
||||
const issueNumber = Number(process.env.PR_NUMBER);
|
||||
const headSha = process.env.HEAD_SHA;
|
||||
const commentBody = [
|
||||
'## 🚀 Preview Deployment Ready',
|
||||
'',
|
||||
"Your preview environment has been deployed to Cloudflare Containers with the PR's Docker image.",
|
||||
'',
|
||||
`**Preview URL:** ${previewUrl}`,
|
||||
'',
|
||||
'> ⏰ This preview is intended to be cleaned up after **24 hours** of the last deployment once the cleanup workflow is live on the default branch.',
|
||||
'> 💤 The container will sleep after 30 minutes of inactivity and wake on the next request.',
|
||||
'',
|
||||
'---',
|
||||
`<sub>Deployed from commit ${headSha}</sub>`,
|
||||
].join('\n');
|
||||
|
||||
// Find existing comment
|
||||
const { data: comments } = await github.rest.issues.listComments({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: issueNumber
|
||||
});
|
||||
|
||||
const botComment = comments.find(comment =>
|
||||
comment.user.type === 'Bot' &&
|
||||
comment.body.includes('Preview Deployment Ready')
|
||||
);
|
||||
|
||||
if (botComment) {
|
||||
await github.rest.issues.updateComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
comment_id: botComment.id,
|
||||
body: commentBody
|
||||
});
|
||||
} else {
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: issueNumber,
|
||||
body: commentBody
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user