executor/.github/workflows/deploy.yml at main · sprayberry-code/executor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: false

# CI is not a user — see the note in ci.yml. Applied to every workflow rather
# than the ones that look like they run product code: the first pass guessed,
# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
# where the product is not executed, so the blanket application is the cheap
# structural answer.
env:
  DO_NOT_TRACK: "1"
  EXECUTOR_DISABLE_ANALYTICS: "1"
  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"

jobs:
  migrate:
    name: Migrate database
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run migrations
        run: bun run scripts/migrate.ts --bucket executor-cloud-blobs
        working-directory: apps/cloud
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

  deploy-cloud:
    name: Deploy cloud
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    needs: migrate
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build cloud
        run: bun run --cwd apps/cloud build
        env:
          VITE_PUBLIC_SENTRY_DSN: ${{ secrets.VITE_PUBLIC_SENTRY_DSN }}

      - name: Deploy cloud
        run: bun run wrangler deploy -c dist/server/wrangler.json --var GIT_COMMIT_SHA:${{ github.sha }}
        working-directory: apps/cloud
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

      # Deploy marker: one event per deploy into the same Axiom dataset the
      # worker traces land in, so a latency step-change lines up with its
      # deploy in one query. Skipped (not failed) when the secret is absent,
      # and never blocks the deploy.
      - name: Record deploy marker in Axiom
        env:
          AXIOM_INGEST_TOKEN: ${{ secrets.AXIOM_INGEST_TOKEN }}
        run: |
          if [ -z "$AXIOM_INGEST_TOKEN" ]; then
            echo "AXIOM_INGEST_TOKEN not configured; skipping deploy marker"
            exit 0
          fi
          curl -sf -X POST "https://api.axiom.co/v1/datasets/executor-cloud/ingest" \
            -H "Authorization: Bearer $AXIOM_INGEST_TOKEN" \
            -H "Content-Type: application/json" \
            -d "[{\"event\":\"deploy\",\"service\":\"executor-cloud\",\"commit_sha\":\"${{ github.sha }}\",\"actor\":\"${{ github.actor }}\",\"run_id\":\"${{ github.run_id }}\"}]" \
            || echo "deploy marker ingest failed (non-blocking)"

  deploy-marketing:
    name: Deploy marketing
    runs-on: blacksmith-4vcpu-ubuntu-2404
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.11

      - name: Cache Bun package cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-1.3.11-

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build marketing
        run: bun run --cwd apps/marketing build

      - name: Deploy marketing
        run: bun run wrangler deploy --config dist/server/wrangler.json
        working-directory: apps/marketing
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}