From 8054c6a6b45272fb9ec7e3a5c7a2ee92834d1b97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lukas=20Weberru=C3=9F?= Date: Fri, 16 Oct 2026 18:54:53 +0000 Subject: [PATCH] docs(configurator): explain reproducible manual UI releases Document fresh releases, build-only tagging, environment approval and exact-artifact promotion in GitHub Actions. Make branch-HEAD and first-attempt restrictions explicit without operational workarounds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../deploy/cloud-foundry/README.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/landing-zone-configurator/deploy/cloud-foundry/README.md b/landing-zone-configurator/deploy/cloud-foundry/README.md index 6c78713..b776755 100644 --- a/landing-zone-configurator/deploy/cloud-foundry/README.md +++ b/landing-zone-configurator/deploy/cloud-foundry/README.md @@ -11,6 +11,42 @@ The migration-only application retains `binary_buildpack`. Update the version and checksum together when upgrading Node. The CF stack remains platform-maintained (`cflinuxfs4`). +## Manual development release in GitHub + +No push or merge deploys the Configurator. Use the repository's **Actions** +page and select **Configurator Release**, then **Run workflow**: + +1. Select branch **main**. +2. Leave **build_only** unchecked (`false`). +3. Leave **release_run_id** empty for a new release. +4. Start the workflow. It qualifies the real Assistant, builds and tests both + packages, then creates the protected source-bound buildpack tag. +5. When **deploy** waits for review, use **Review deployments** to approve + **lzc-dev-release** with an authorized reviewer account. +6. Wait for the whole run to succeed, including Runner isolation, engine checks, + database migrations, service connections and public route checks. + +The target is the existing development application, not a production environment. +Keep the selected `main` revision unchanged until tag publication completes: +a superseded branch HEAD is rejected rather than silently deploying another +revision. Do not add broader repository token permissions or manually create +tags during an ordinary new release. + +For build now/deploy later, check **build_only**. Qualification, packaging and tag +publication still run, but no cloud deployment occurs. Later start a **new** +manual run on `main`, leave **build_only** unchecked and enter the original +numeric build run ID in **release_run_id**. This promotes that exact qualified +artifact without repeating qualification/build or tagging a historical commit; +it does not select the newest application source. The original artifact must +still exist and must not have expired. + +After a deployment-only failure, a new promotion can reuse the successful +qualified build in the same way. Do not use **Re-run jobs**: release attempts +after the first are rejected. Inspect the actual failure before starting another +run; failures are retained and the workflow performs no automatic deployment +retry. Historical artifacts missing their buildpack tag need the explicit +operator backfill described below, not a protection bypass. + ### Image staging and caching Hosted archives omit only the pinned `firewall-image.qcow2`; local Runner