Issues/442 prod pipeline - #56
Open
godsonten wants to merge 3 commits into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe pull request adds a manual production deployment workflow for ChangesProduction deployment
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant BuildJob as GitHub Actions build job
participant IaaS as shared iaas deployment script
participant Artifact as GitHub artifact store
participant DeployJob as zsoftly-yow deployment job
participant Docs as docs site
Maintainer->>BuildJob: Dispatch with source_ref
BuildJob->>IaaS: Prepare and build selected release
BuildJob->>Artifact: Upload artifact and resolved source commit
DeployJob->>Artifact: Download artifact
DeployJob->>IaaS: Prepare source and deploy docs site
IaaS->>Docs: Deploy documentation and run smoke test
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/40-deploy-prod.yml (1)
37-45: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse
[ERROR]instead of[FAIL].These messages use
[FAIL]. The workflow guideline permits[ERROR], not[FAIL]. Replace each[FAIL]marker.Also applies to: 60-60, 163-164
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/40-deploy-prod.yml around lines 37 - 45, Update the validation error messages in the production deploy workflow, including the checks around SOURCE_REF and the additional occurrences at the referenced locations, to use the “[ERROR]” prefix instead of “[FAIL]”; keep the existing messages and validation behavior unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/40-deploy-prod.yml:
- Around line 40-47: Update the production workflow validation around SOURCE_REF
to require immutable staging provenance, such as a staging promotion record,
workflow run, or commit SHA, and verify that the successful staging deployment
corresponds to the exact commit selected for production rather than only
validating a movable release/* branch. Update docs/release-process.md lines
30-31 to document promoting the exact validated commit; both listed sites
require changes.
- Around line 53-54: Update the build and deploy jobs in the workflow so the
IaaS repository revision is resolved to one commit SHA during the build, exposed
as a job output, and consumed by the deploy job. Replace the deploy job’s
IAAS_REF main reference with that immutable SHA and ensure checkout validates or
uses the same revision before running deployment scripts.
---
Nitpick comments:
In @.github/workflows/40-deploy-prod.yml:
- Around line 37-45: Update the validation error messages in the production
deploy workflow, including the checks around SOURCE_REF and the additional
occurrences at the referenced locations, to use the “[ERROR]” prefix instead of
“[FAIL]”; keep the existing messages and validation behavior unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5f269eb3-942b-49ee-8dab-7807fb97b9e2
📒 Files selected for processing (3)
.github/actionlint.yaml.github/workflows/40-deploy-prod.ymldocs/release-process.md
Comment on lines
+40
to
+47
| if [[ "$SOURCE_REF" != release/* ]]; then | ||
| echo "[FAIL] source_ref must start with release/ (got: $SOURCE_REF)" | ||
| exit 1 | ||
| fi | ||
| if ! git check-ref-format --branch "$SOURCE_REF" >/dev/null 2>&1; then | ||
| echo "[FAIL] source_ref must be a valid branch name (got: $SOURCE_REF)" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Require immutable staging provenance before production deployment.
The workflow accepts any syntactically valid release/* branch. It does not verify a successful staging deployment or identify the staged commit. A branch ref can move after staging.
.github/workflows/40-deploy-prod.yml#L40-L47: require a staging promotion record, workflow run, or commit SHA, and verify that its successful staging deployment matches the commit selected for production.docs/release-process.md#L30-L31: document promotion of the exact validated commit instead of promotion of the same branch ref.
📍 Affects 2 files
.github/workflows/40-deploy-prod.yml#L40-L47(this comment)docs/release-process.md#L30-L31
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/40-deploy-prod.yml around lines 40 - 47, Update the
production workflow validation around SOURCE_REF to require immutable staging
provenance, such as a staging promotion record, workflow run, or commit SHA, and
verify that the successful staging deployment corresponds to the exact commit
selected for production rather than only validating a movable release/* branch.
Update docs/release-process.md lines 30-31 to document promoting the exact
validated commit; both listed sites require changes.
Collaborator
Author
|
Addressed the actionable workflow comments in this branch:
For the staging provenance suggestion: the workflow now pins the selected release commit during prod and fails if the release branch moves between build and deploy. Verifying that the same commit came from a specific successful staging workflow run is a larger promotion-record feature, so I recommend tracking that separately instead of expanding this PR. |
Run the shared iaas deploy script with PHASE=dry_run before the real production deploy while keeping the public docs build on GitHub-hosted runners and deploy secrets on the YOW production job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
Summary by CodeRabbit
New Features
Documentation