ci(router): deploy the router only after this commit's web deploy succeeds

[khaliqgant]

Why

When #150 merged at 01:30Z, Deploy Router finished before Deploy Web. The new router rewrote arelay.to/agent-relay onto /u/agent-relay before the web deploy had created that page, so our agent's public page returned 404 for about 10 minutes. The founder had just sent an agent to that URL.

Change

deploy-router.yml gets a first step on push:

• it polls the Deploy Web (Cloudflare) run for the same commit (actions/workflows/deploy.yml/runs?head_sha=…), every 30 s for up to 40 min;
• it continues only on completed success;
• it fails the router deploy if the web deploy failed or never finished, so the router never ships routes to pages that weren't deployed.

Deploy Web runs on every push to main, so a run always exists for the commit. Manual workflow_dispatch skips the wait. Permissions: adds actions: read.

Validation

actionlint clean. It takes effect on the first router change after merge. #151 (registry router) is the next one.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only ordering change in GitHub Actions; no application runtime, auth, or data-path changes.

Overview
Prevents router deploys from racing ahead of the web app on the same commit, which previously caused public URLs like arelay.to/<handle> to 404 until the web deploy caught up.

deploy-router.yml now runs a push-only gate before checkout: it polls the Deploy Web (Cloudflare) workflow (deploy.yml) for the current GITHUB_SHA via the GitHub API every 30 seconds (up to ~2 hours). The router job proceeds only when that run is completed success; it fails if the web deploy finished with any other conclusion, and times out with a re-run hint if web never succeeds in time. Manual workflow_dispatch skips this step. Workflow permissions add actions: read so the job can inspect other workflow runs.

^{Reviewed by Cursor Bugbot for commit 6ec26c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Prevents the router from deploying before the web deploy of the same commit finishes, so it never routes to pages that don't exist yet. After #150, the router shipped first and arelay.to/agent-relay returned 404 for about 10 minutes until the web deploy caught up.

• deploy-router.yml now waits up to 2 hours for the Deploy Web (Cloudflare) run for the same commit, polling every 30 seconds.
• The deploy continues only if the web run completed successfully; it fails if the web deploy failed, and the timeout error tells you to re-run the workflow once the web deploy finishes.
• Transient lookup errors (5xx, rate limits) are treated as "not ready yet" and retried instead of aborting.
• Manual workflow_dispatch runs skip the wait, and the workflow now needs actions: read permission.

^{Written for commit 6ec26c0. Summary will update on new commits.}

---

Agent Relay sessions

• claude session 1e2adfbe · opened via gh pr create · last active 2026-10-08

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T01:52:24.874580Z	c93f366	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3cbdecc9-45d1-44ec-a2cd-e63a32b424d1

📥 Commits

Reviewing files that changed from the base of the PR and between 8d4bf1e and 6ec26c0.

📒 Files selected for processing (1)

• .github/workflows/deploy-router.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The router deployment workflow now waits for the web deployment run for the same commit on push events. It continues after success and fails if the run completes unsuccessfully or the wait times out.

Changes

Router deployment gate

Layer / File(s)	Summary
Check web deployment before router deployment .github/workflows/deploy-router.yml	The workflow adds actions: read permission and checks the web deployment run for the current commit on push events. It retries unresolved statuses and lookup failures every 30 seconds, up to 240 attempts. A completed non-success result or timeout fails the job. The check is skipped for workflow_dispatch runs.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant RouterWorkflow
  participant GitHubActionsAPI
  participant WebDeployment
  RouterWorkflow->>GitHubActionsAPI: Look up web deployment run for current commit
  GitHubActionsAPI-->>RouterWorkflow: Return run status
  loop While status is unresolved, up to 240 attempts
    RouterWorkflow->>GitHubActionsAPI: Retry lookup after 30 seconds
    GitHubActionsAPI-->>RouterWorkflow: Return run status
  end
  alt Web deployment succeeds
    RouterWorkflow->>RouterWorkflow: Continue router deployment
  else Completed non-success or timeout
    RouterWorkflow->>RouterWorkflow: Fail the job
  end

Loading

Merge Risk: ⚪ Minimal · up to 6ec26

For push-triggered deployments, the router waits for the matching web run to succeed and fails on an unsuccessful run or timeout. No concrete deployment-order issue remains to resolve before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: delaying router deployment until the same commit's web deployment succeeds.
Description check	✅ Passed	The description directly explains the deployment race, the workflow changes, polling behavior, failure handling, manual-run behavior, permissions, and validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate,
And waits beside the router’s fate.
The web run passes, then onward we go,
Or stop if the result says no.
Two hundred forty checks, then rest,
The rabbit hops away, impressed.}

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[github-actions]

Preview deployed!

Environment	URL
Web	https://16151b9d-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>