@@ -3,9 +3,19 @@ name: "🤖 Deploy dashboard agent"
33# Deploys the @internal/dashboard-agent chat.agent to its Trigger.dev project
44# with --skip-promotion, so a deploy never becomes "current" on its own. The
55# consuming app cuts over by pinning DASHBOARD_AGENT_VERSION to the new version.
6- # Runs a leg per environment (staging + prod), each gated by its own environment;
7- # a push to main that touches the agent or its store triggers both. Version
8- # numbers are per-environment, so pin each environment to its own leg's version.
6+ # Runs a leg per environment (staging + prod); a push to main that touches the
7+ # agent or its store deploys both. Version numbers are per-environment, so pin
8+ # each environment to its own leg's version.
9+ #
10+ # The deploy lands dormant, so it doesn't need a reviewer gate: nothing goes live
11+ # until DASHBOARD_AGENT_VERSION is flipped. The `environment:` below is kept only
12+ # to scope the deploy token per environment; its required-reviewers rule is
13+ # removed in repo settings so pushes deploy unattended. workflow_dispatch takes an
14+ # optional ref (SHA, branch, or tag) to deploy a specific commit instead of head.
15+ #
16+ # The deployed ref must be an ancestor of main, so only reviewed, merged code ever
17+ # runs with the deploy token (the checked-out build + trigger.config.ts execute
18+ # with it). A push is always on main; a dispatched ref is checked before deploy.
919
1020on :
1121 push :
1424 - " internal-packages/dashboard-agent/**"
1525 - " internal-packages/dashboard-agent-db/**"
1626 workflow_dispatch :
27+ inputs :
28+ ref :
29+ description : " Commit SHA, branch, or tag to deploy. Defaults to the ref the workflow runs from."
30+ required : false
31+ type : string
1732
1833permissions : {}
1934
2742 max-parallel : 1
2843 matrix :
2944 environment : [staging, prod]
30- # Per-environment reviewer gate + source of the scoped deploy PAT.
45+ # Kept to scope the deploy token per environment. The required-reviewers rule
46+ # on these environments is removed in repo settings, so this no longer gates.
3147 environment : dashboard-agent-${{ matrix.environment }}
3248 concurrency :
49+ # Queue a superseding deploy behind an in-flight one; do NOT cancel it.
50+ # Cancelling the runner wouldn't stop the remote build (it finishes
51+ # server-side), and a second concurrent deploy of the same project would
52+ # race the indexer. Deploys are short now the gate is gone, so a brief queue
53+ # is fine and can't pile up.
3354 group : dashboard-agent-deploy-${{ matrix.environment }}
3455 cancel-in-progress : false
3556 permissions :
4162 - name : Checkout
4263 uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4364 with :
65+ # push: the pushed commit. workflow_dispatch: the input ref if given,
66+ # otherwise the head of the ref the run was launched from.
67+ ref : ${{ github.event.inputs.ref || github.sha }}
68+ # Full history so the ancestor-of-main check below can find a merge base.
69+ fetch-depth : 0
4470 persist-credentials : false
4571
72+ - name : Require the ref to be an ancestor of main
73+ # The deploy token runs the checked-out code, so refuse anything that
74+ # hasn't landed on main. A push is main's tip (ancestor of itself); this
75+ # only ever rejects a dispatched, unmerged ref.
76+ #
77+ # NOTE: this in-file check only constrains WHICH commit is deployed. It
78+ # can't protect the token on its own, because workflow_dispatch runs the
79+ # workflow file from the selected ref. The real guard is the deployment
80+ # branch policy on the dashboard-agent-* environments (main only), set in
81+ # repo settings, which GitHub enforces server-side against GITHUB_REF.
82+ run : |
83+ set -euo pipefail
84+ # An explicit `ref:` checkout doesn't create remote-tracking branches,
85+ # so fetch main before comparing against it.
86+ git fetch --no-tags --quiet origin +refs/heads/main:refs/remotes/origin/main
87+ if ! git merge-base --is-ancestor HEAD origin/main; then
88+ echo "::error::Refusing to deploy $(git rev-parse HEAD): not an ancestor of origin/main. Only merged code can be deployed."
89+ exit 1
90+ fi
91+ echo "$(git rev-parse --short HEAD) is an ancestor of origin/main"
92+
4693name : Setup pnpm
4794 uses : pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
4895 with :
0 commit comments