Merge pull request #783 from notch8/deploy-in-ci

🔧 Deploy and publish from the push's own CI run

Author: maxkadel

.github/workflows/build-test-lint.yaml

@@ -49,4 +49,28 @@ jobs:
   reports:
     if: always()
     needs: [test, lint]
-    uses: notch8/actions/.github/workflows/report.yaml@v1.0.11
+    uses: notch8/actions/.github/workflows/report.yaml@v1.0.11
+
+  # Deploying from this run (not a separate workflow_run-triggered Deploy) keeps the run on the
+  # pushed commit: GitHub shows a workflow_run's SHA and branch as the default branch's.
+  deploy:
+    needs: [test, lint]
+    if: ${{ github.event_name == 'push' }}
+    concurrency:
+      group: deploy-${{ github.ref_name == 'main' && 'dev' || github.ref_name }}
+      cancel-in-progress: false
+    uses: notch8/actions/.github/workflows/deploy.yaml@v1.0.12
+    secrets: inherit
+    with:
+      environment: ${{ github.ref_name == 'main' && 'dev' || github.ref_name }}
+
+  publish-release:
+    needs: deploy
+    if: ${{ github.ref_name == 'production' }}
+    permissions:
+      actions: read
+      contents: write
+    uses: notch8/actions/.github/workflows/publish-release.yaml@v1.0.13
+    with:
+      sha: ${{ github.sha }}
+      deploy-run-id: ${{ github.run_id }}

.github/workflows/deploy.yaml

@@ -1,13 +1,8 @@
 name: "Deploy"
-run-name: Deploy (${{ github.event.workflow_run.head_branch || github.ref_name }} -> ${{ inputs.environment || (github.event.workflow_run.head_branch == 'main' && 'dev') || github.event.workflow_run.head_branch }}) by @${{ github.actor }}
+# Ad-hoc deploys and rollbacks. Pushes to main, staging and production deploy from their
+# Build Test Lint run instead.
+run-name: Deploy (${{ github.ref_name }} -> ${{ inputs.environment }}) by @${{ github.actor }}
 on:
-  workflow_run:
-    workflows: ["Build Test Lint"]
-    types: [completed]
-    branches:
-      - main
-      - staging
-      - production
   workflow_dispatch:
     inputs:
       environment:
@@ -25,36 +20,13 @@ on:
         required: false
         default: false
 
-jobs:
-  determine-environment:
-    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push') }}
-    runs-on: ubuntu-latest
-    outputs:
-      environment: ${{ steps.set.outputs.environment }}
-    steps:
-      - id: set
-        name: Map branch/input to target environment
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          INPUT_ENVIRONMENT: ${{ inputs.environment }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-        run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
-            echo "environment=$INPUT_ENVIRONMENT" >> "$GITHUB_OUTPUT"
-          else
-            case "$HEAD_BRANCH" in
-              main) echo "environment=dev" >> "$GITHUB_OUTPUT" ;;
-              staging) echo "environment=staging" >> "$GITHUB_OUTPUT" ;;
-              production) echo "environment=production" >> "$GITHUB_OUTPUT" ;;
-            esac
-          fi
 
+jobs:
   deploy:
-    needs: determine-environment
     concurrency:
-      group: deploy-${{ needs.determine-environment.outputs.environment }}
+      group: deploy-${{ inputs.environment }}
       cancel-in-progress: false
     uses: notch8/actions/.github/workflows/deploy.yaml@v1.0.12
     secrets: inherit
     with:
-      environment: ${{ needs.determine-environment.outputs.environment }}
+      environment: ${{ inputs.environment }}

.github/workflows/publish-release.yml

@@ -239,7 +239,7 @@ Promotion is GitLab Flow: merge-commit PRs `main` -> `staging` -> `production`.
 | `production` | production | `r2-besties` | `palni-palci-knapsack-production` |
 
 - Production window: Thursdays 3-5pm Pacific. Never on a Friday.
-- Release tags continue the `v0.2.x` line. Pushes to `staging` and `production` draft `v<next>-rc` and `v<next>`; after a verified production deploy, approving the Publish Release run publishes the stable draft at the deployed commit. Each draft records the pinned Hyku version and SHA.
+- Release tags continue the `v0.2.x` line. Pushes to `staging` and `production` draft `v<next>-rc` and `v<next>`; after a verified production deploy, approving the `publish-release` job in the production Build Test Lint run publishes the stable draft at the deployed commit. Each draft records the pinned Hyku version and SHA.
 - Production deploys wait for approval from `@notch8/hyku-knapsack-owners` on the `production` environment.
 - Before merging a promotion PR, capture the tenant regression baseline.
 - Announcement channel: **#n8-palni-palci**, the client's channel, so write for the client