chore(release): v0.2.0 #519
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: E2E deploy | |
| # Deploys examples/storefront-auth and examples/pn-widgets to real Prisma | |
| # Cloud, verifies each round trip, then destroys them. Requires repo secret | |
| # PRISMA_SERVICE_TOKEN and repo variable PRISMA_WORKSPACE_ID. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Fixed group (not per-ref): only one real-cloud deploy runs at a time. | |
| # cancel-in-progress stays false so a kill mid-deploy/destroy can't orphan resources. | |
| concurrency: | |
| group: e2e-deploy | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Deploy, verify, destroy | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 3 | |
| # Secrets aren't available on forked-PR runs; skip rather than fail loudly. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }} | |
| PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }} | |
| # The root binds the auth module's secret need to AUTH_SIGNING_SECRET (ADR-0029). | |
| # This non-sensitive test marker in the runner env is what deploy preflight | |
| # fill-missing provisions onto the ephemeral per-run stack — the single-step | |
| # CI path (runner env -> direct API POST -> platform). It must match the | |
| # auth service's EXPECTED_SIGNING_SECRET (modules/auth/src/server.ts); the | |
| # value never enters deploy state, only its pointer name does. | |
| AUTH_SIGNING_SECRET: sk_test_ci_storefront_auth | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/deploy-verify-destroy | |
| with: | |
| working-directory: examples/storefront-auth | |
| build-filter: '@prisma/example-storefront-auth...' | |
| stack-name: storefront-auth-ci-${{ github.run_id }} | |
| verify-command: bash scripts/e2e-verify.sh | |
| deploy-pn-widgets: | |
| name: Deploy, verify, destroy (pn-widgets) | |
| runs-on: ubuntu-latest | |
| # Not a data dependency — runs after storefront so the two deploys never | |
| # hold projects/databases concurrently (workspace DB-quota headroom). | |
| needs: deploy | |
| timeout-minutes: 3 | |
| # Secrets aren't available on forked-PR runs; skip rather than fail loudly. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }} | |
| PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/deploy-verify-destroy | |
| with: | |
| working-directory: examples/pn-widgets | |
| build-filter: '@prisma/example-pn-widgets...' | |
| stack-name: pn-widgets-ci-${{ github.run_id }} | |
| verify-command: bun scripts/e2e-verify.ts | |
| destroy-label: 'pn-widgets ' | |
| sweep-prefixes: storefront-auth pn-widgets hello canary bucket | |
| deploy-bucket: | |
| name: Deploy, verify, destroy (bucket) | |
| runs-on: ubuntu-latest | |
| needs: deploy-pn-widgets | |
| timeout-minutes: 3 | |
| # Secrets aren't available on forked-PR runs; skip rather than fail loudly. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }} | |
| PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/deploy-verify-destroy | |
| with: | |
| working-directory: examples/bucket | |
| build-filter: '@prisma/example-bucket...' | |
| stack-name: bucket-ci-${{ github.run_id }} | |
| verify-command: bun scripts/e2e-verify.ts | |
| destroy-label: 'bucket ' | |
| sweep-prefixes: storefront-auth pn-widgets hello canary bucket | |
| cold-connect-canary: | |
| name: Cold-connect canary (FT-5226) | |
| runs-on: ubuntu-latest | |
| # Runs after both deploys so it never holds a database concurrently with | |
| # them (workspace DB-quota headroom). Fails when PPg no longer rejects a | |
| # database's first connection — the signal to remove withConnectionRetry. | |
| needs: deploy-bucket | |
| timeout-minutes: 3 | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }} | |
| PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup | |
| - run: pnpm install --frozen-lockfile | |
| - run: bun scripts/cold-connect-canary.ts | |
| cold-start-canary: | |
| name: Cold-start canary (PRO-217) | |
| runs-on: ubuntu-latest | |
| # After the FT-5226 canary for the same quota-serialization reason as the | |
| # deploys. Fails when the ingress no longer closes first-touch connections | |
| # to a booting instance — the signal to remove the streams client's | |
| # IDEMPOTENT_BACKOFF (the PRO-219 compensation) and this canary. The bug | |
| # being PRESENT is today's normal and passes. | |
| # | |
| # Runtime: the script spaces its samples 60s apart and stops at the first | |
| # close (see cold-start-canary.ts), so a normal run — the bug is live | |
| # today — finishes quickly: four live runs of this version of the script | |
| # all closed on the very first sample, one measured (via `time`) at | |
| # 96.86s end to end. The worst case is a run that never sees a close and | |
| # has to collect MIN_HELD_SAMPLES_FOR_BUG_GONE (14) confirmed cold-start | |
| # holds to justify a bug-gone verdict: at roughly 85s per sample (60s | |
| # spacing plus ~21-25s of create/upload/start/promote/touch/log-read, per | |
| # those same live runs), 14 samples is about 20 minutes, plus this job's | |
| # own install/build/deploy/destroy/sweep steps. cold-start-canary.ts's own | |
| # MAX_RUN_MS (20 minutes) stops the sampling loop and reports whatever it | |
| # has collected before that point, so the 30-minute timeout here is | |
| # headroom for the script to reach that self-imposed stop and still exit | |
| # cleanly — not the primary mechanism. | |
| needs: cold-connect-canary | |
| timeout-minutes: 30 | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }} | |
| PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/deploy-verify-destroy | |
| with: | |
| working-directory: examples/streams | |
| build-filter: '@prisma/example-streams...' | |
| stack-name: streams-canary-ci-${{ github.run_id }} | |
| verify-command: bun "${{ github.workspace }}/scripts/cold-start-canary.ts" | |
| destroy-label: 'streams-canary ' | |
| sweep-prefixes: storefront-auth pn-widgets hello canary streams-canary bucket |