Skip to content

Commit 3f149d1

Browse files
wenxiaojie1wenxiaojie1
authored
ci(repo): gate backend deploy on CI (#1482)
1 parent 77fa143 commit 3f149d1

4 files changed

Lines changed: 103 additions & 99 deletions

File tree

‎.github/workflows/backend.yml‎

Lines changed: 0 additions & 78 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ jobs:
7575
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
7676
with:
7777
version: 9.15.9
78-
78+
7979
- name: Setup Node.js
8080
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
8181
with:
@@ -88,7 +88,7 @@ jobs:
8888
- name: Check colour contrast (WCAG AA)
8989
run: node scripts/check-contrast.js
9090
continue-on-error: false
91-
91+
9292
- name: Check generated API types are up to date
9393
run: |
9494
pnpm run generate:types
@@ -113,7 +113,7 @@ jobs:
113113
path: client/coverage/lcov.info
114114
if-no-files-found: error
115115
retention-days: 7
116-
116+
117117
- name: Build
118118
run: pnpm run build
119119
continue-on-error: false
@@ -132,15 +132,15 @@ jobs:
132132
name: backend-openapi
133133
path: openapi.json
134134
retention-days: 7
135-
135+
136136
- name: Install Playwright browsers
137137
run: npx playwright install chromium --with-deps
138138
continue-on-error: false
139-
139+
140140
- name: Run e2e accessibility tests
141141
run: pnpm run test:e2e -- --grep "Accessibility"
142142
continue-on-error: true
143-
143+
144144
- name: Upload build artifacts
145145
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
146146
with:
@@ -164,7 +164,7 @@ jobs:
164164
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
165165
with:
166166
version: 9.15.9
167-
167+
168168
- name: Setup Node.js
169169
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
170170
with:
@@ -194,7 +194,7 @@ jobs:
194194
path: sdk/coverage/lcov.info
195195
if-no-files-found: error
196196
retention-days: 7
197-
197+
198198
- name: Build
199199
run: pnpm run build
200200
continue-on-error: false
@@ -210,7 +210,7 @@ jobs:
210210
pnpm exec api-extractor run --config api-extractor.write.json
211211
pnpm exec api-extractor run --config api-extractor.light.json
212212
continue-on-error: false
213-
213+
214214
- name: Check bundle size budgets
215215
run: |
216216
pnpm size-check --json > size-summary.json || SIZE_CHECK_EXIT_CODE=$?
@@ -242,7 +242,7 @@ jobs:
242242
exit $SIZE_CHECK_EXIT_CODE
243243
fi
244244
continue-on-error: false
245-
245+
246246
- name: Check bundle size budgets
247247
run: |
248248
pnpm size-check --json > size-summary.json || SIZE_CHECK_EXIT_CODE=$?
@@ -274,7 +274,7 @@ jobs:
274274
exit $SIZE_CHECK_EXIT_CODE
275275
fi
276276
continue-on-error: false
277-
277+
278278
- name: Check bundle size budgets
279279
run: |
280280
pnpm size-check --json > size-summary.json || SIZE_CHECK_EXIT_CODE=$?
@@ -306,7 +306,7 @@ jobs:
306306
exit $SIZE_CHECK_EXIT_CODE
307307
fi
308308
continue-on-error: false
309-
309+
310310
- name: Generate docs
311311
run: pnpm run docs
312312
continue-on-error: false
@@ -334,7 +334,7 @@ jobs:
334334
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
335335
with:
336336
version: 9.15.9
337-
337+
338338
- name: Setup Node.js
339339
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
340340
with:
@@ -355,18 +355,21 @@ jobs:
355355
NODE_ENV: test
356356
continue-on-error: false
357357

358+
- name: Validate OpenAPI Spec
359+
run: pnpm run validate:openapi
360+
358361
- name: Upload coverage artifact
359362
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
360363
with:
361364
name: coverage-backend
362365
path: backend/coverage/lcov.info
363366
if-no-files-found: error
364367
retention-days: 7
365-
368+
366369
- name: Check module boundaries (dependency-cruiser)
367370
run: pnpm run boundaries
368371
continue-on-error: false
369-
372+
370373
- name: Build
371374
run: pnpm run build
372375
continue-on-error: false
@@ -394,7 +397,7 @@ jobs:
394397
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
395398
with:
396399
version: 9.15.9
397-
400+
398401
- name: Setup Node.js
399402
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
400403
with:
@@ -426,7 +429,7 @@ jobs:
426429
path: indexer/coverage/lcov.info
427430
if-no-files-found: error
428431
retention-days: 7
429-
432+
430433
- name: Build
431434
run: pnpm run build
432435
continue-on-error: false
@@ -454,7 +457,7 @@ jobs:
454457
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
455458
with:
456459
version: 9.15.9
457-
460+
458461
- name: Setup Node.js
459462
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
460463
with:
@@ -482,7 +485,7 @@ jobs:
482485
path: oracle/coverage/lcov.info
483486
if-no-files-found: error
484487
retention-days: 7
485-
488+
486489
- name: Build
487490
run: pnpm run build
488491
continue-on-error: false
@@ -678,7 +681,7 @@ jobs:
678681
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
679682
with:
680683
version: 9.15.9
681-
684+
682685
- name: Setup Node.js
683686
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
684687
with:
@@ -941,7 +944,7 @@ jobs:
941944
fi
942945
return 0
943946
}
944-
947+
945948
if ! check_status "${{ needs.client.result }}" || \
946949
! check_status "${{ needs.sdk.result }}" || \
947950
! check_status "${{ needs.backend.result }}" || \

‎.github/workflows/deploy-backend.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Deploy Backend
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- CI
7+
types:
8+
- completed
9+
branches:
10+
- master
11+
12+
permissions:
13+
contents: read
14+
15+
concurrency:
16+
group: deploy-backend-${{ github.event.workflow_run.head_sha }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
deploy:
21+
name: Deploy Backend to Railway
22+
if: >-
23+
github.event.workflow_run.conclusion == 'success' &&
24+
github.event.workflow_run.event == 'push' &&
25+
github.event.workflow_run.head_branch == 'master'
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- name: Verify Railway deploy hook is configured
30+
env:
31+
RAILWAY_DEPLOY_HOOK_URL: ${{ secrets.RAILWAY_DEPLOY_HOOK_URL }}
32+
run: |
33+
if [ -z "$RAILWAY_DEPLOY_HOOK_URL" ]; then
34+
echo "RAILWAY_DEPLOY_HOOK_URL is required for backend deployment."
35+
exit 1
36+
fi
37+
38+
- name: Deploy backend
39+
env:
40+
RAILWAY_DEPLOY_HOOK_URL: ${{ secrets.RAILWAY_DEPLOY_HOOK_URL }}
41+
run: curl --fail --show-error --silent --request POST "$RAILWAY_DEPLOY_HOOK_URL"

‎docs/DEPLOYMENTS.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Deployment paths
2+
3+
This repository has several deployable services, but they do not all share one
4+
deployment mechanism. The table below records the automation that exists in the
5+
repository today so a successful CI build is not mistaken for a production
6+
deployment.
7+
8+
| Service | Deployment path | Repository automation |
9+
| --- | --- | --- |
10+
| Backend | Railway deploy hook | `.github/workflows/deploy-backend.yml` runs only after the `CI` workflow succeeds for a push to `master`. A missing `RAILWAY_DEPLOY_HOOK_URL` fails the deployment instead of silently skipping it. |
11+
| Client | Vercel Git integration | `client/vercel.json` controls Vercel build behavior and routing. There is no client deployment job in GitHub Actions. |
12+
| Indexer | Kubernetes overlay | `indexer/k8s/` can be applied manually as described in [`k8s-deployment.md`](./k8s-deployment.md). There is no automated GitHub Actions deployment. |
13+
| Oracle | Kubernetes overlay | `oracle/k8s/` can be applied manually as described in [`k8s-deployment.md`](./k8s-deployment.md). There is no automated GitHub Actions deployment. |
14+
| SDK docs | GitHub Pages | `.github/workflows/docs.yml` publishes documentation. It does not deploy an application service. |
15+
16+
## Backend deployment gate
17+
18+
The backend build, lint, unit tests, and OpenAPI validation run once in the
19+
`backend` job of `.github/workflows/ci.yml`. The deployment workflow listens for
20+
the completed CI run instead of repeating those checks. It invokes Railway only
21+
when all of the following are true:
22+
23+
1. the triggering CI run concluded successfully;
24+
2. the CI run was caused by a push, not a pull request;
25+
3. the tested branch was `master`; and
26+
4. the `RAILWAY_DEPLOY_HOOK_URL` repository secret is configured.
27+
28+
Pull-request CI therefore never deploys. A failed or cancelled CI run also
29+
never deploys. Deployment failure is visible in the separate `Deploy Backend`
30+
workflow rather than being reported as a successful no-op.
31+
32+
## Manual Kubernetes deployment
33+
34+
The backend also has a Kubernetes overlay under `backend/k8s/`. It is an
35+
operator-driven alternative documented in [`k8s-deployment.md`](./k8s-deployment.md),
36+
not part of the Railway GitHub Actions path. The indexer and oracle currently
37+
have only these operator-driven Kubernetes paths; adding automated deployment
38+
for them requires a separate workflow and explicit environment/secret policy.

0 commit comments

Comments
 (0)