Repository navigation
ci: prepare guarded mapped Worker deploy-on-merge - #1687
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
|
Business Rules ValidationTask: 5773430482 — Provision Canonical iOS Records to Unblock Widget Fix Delivery Status: Issues Found FindingsMUST_FIX: PR scope does not match the task scope (scope mismatch)Requirement: "Provision Canonical iOS Records to Unblock Widget Fix Delivery" with active bundle IDs "Usage Monitor app: MUST_FIX: No evidence of registering the canonical Usage Monitor app bundle ID in this PR diffRequirement: "Usage Monitor app: MUST_FIX: No evidence of registering the Widget extension App ID in this PR diffRequirement: "Widget extension: MUST_FIX: No evidence of registering the Local Monitor app bundle ID in this PR diffRequirement: "Local Monitor app: MUST_FIX: No evidence of updating
|
![kody-ai[bot]](https://avatars.githubusercontent.com/in/413034?s=60&v=4){kind=small}
probe() named a missing "name" key in its unconfigured-probe error, so the guard raised KeyError instead of the intended RuntimeError. It now takes the target name from main(), and the test calls it without a name key so the old code fails. Add tests for current_main() (main ref URL, SHA extraction, malformed response) and for the superseded-main skip, which must stop before any probe, receipt read, or upload. Add a drift check that every workflow matrix Worker is mapped in worker-targets.json with an approved probe and the auditor stays out of the matrix. Docs: drop the private Infisical path from this public page and point to the private operations inventory. State that the pre-deploy probe fails closed and that fix-forward for an already-broken Worker is a manual deploy. Refs #1687 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Code Review Completed! 🔥The code review was successfully completed based on your current configurations. Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
ci: prepare guarded mapped Worker deploy-on-merge
Summary
Adds a disabled-by-default CI path for deploying a mapped set of Cloudflare Workers from exact
mainrevisions. The workflow serializes deployments, rechecksmainbefore mutation, tags Worker versions with the exact SHA, verifies 100% production routing to that version, and runs functional health probes. It also adds unit tests for deployment receipt and target gating, plus documentation for safe activation.Functional changes
.github/workflows/worker-deploy.yml):main, a 30-minute schedule (11,41 * * * *), and manual dispatch.WORKER_DEPLOY_ENABLEDistrue.expenses-jays-servicesandusage-monitor-receipt-inboxone at a time withmax-parallel: 1andfail-fast: false.mapped-workers-productionwithout cancel-in-progress.CLOUDFLARE_FLEET_API_TOKENthrough Infisical, and invokes the deploy script.scripts/deploy-mapped-worker.py):scripts/worker-targets.json.mainSHA before mutation and again before upload; skips when superseded.usage-monitor-receipt-*targets, runs the receipt inbox lifecycle verification.--keep-vars,--strict, exact SHA tag, and amain <sha>message.scripts/test-deploy-mapped-worker.py):start-jays-servicesandfleet-share-api.docs/worker-deploy-automation.md):Safety and activation
WORKER_DEPLOY_ENABLED=true.usage-monitor-receipt-lifecycle-auditoris explicitly excluded pending an approved health probe.Validation
npx --no-install vitest run workers/receipt-inbox/index.test.mjs workers/receipt-lifecycle-auditor/index.test.mjs --maxWorkers=1 --no-file-parallelismpython3 scripts/test-deploy-mapped-worker.pyAutomated review findings
current_main()is the only stale-deploy safety check but has no direct tests, so a regression there could be silent.TARGETS; they do not assert that the workflow matrix workers are present inTARGETS.probe()readstarget["name"]in its error path, but target dicts fromworker-targets.jsondo not have anamefield, creating a latentKeyError.Summary
Prepares the guarded mapped Worker deploy-on-merge automation by hardening the deploy script's probe handling, expanding test coverage around the deployment safeguards, and updating the accompanying documentation. All changes are preparation/guardrail work; deployment remains default-off.
Changes
Deploy script (
scripts/deploy-mapped-worker.py)probe()now accepts an optional target name (default"unnamed target") and uses that parameter in its "Functional probe not configured" error instead of reading anamekey from the target dict. This prevents aKeyErroron targets that don't carry anamefield.probe()call sites now pass the worker name explicitly: the already-deployed/short-circuit path, the pre-deploy health check, and the post-deploy verification.Tests (
scripts/test-deploy-mapped-worker.py){}) and a named target with no health route, confirming the error path no longer raisesKeyError.test_matrix_workers_are_mapped_with_probes, which parses theworkermatrix from.github/workflows/worker-deploy.ymland asserts every matrix worker exists inTARGETS, has an approved functional probe, and thatusage-monitor-receipt-lifecycle-auditoris excluded.current_main()reads thegit/ref/heads/mainendpoint and returns the SHA, and that a malformed API response is rejected.deployed_tag,probe, andsubprocess.runare never called.Documentation (
docs/worker-deploy-automation.md)Fleet-OPS/prod/root) with a reference to Infisical plus a private operations inventory maintained outside the public repository, keeping the CI bootstrap secret names unchanged.Notes
docs/worker-deploy-automation.mdwas removed and replaced with Infisical/private-inventory references, resolving the earlier rule violation.