composer/.github/workflows/e2e-deploy.yml at main · prisma/composer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: E2E deploy

# Deploys examples/storefront-auth and examples/pn-widgets to real Prisma
# Cloud, verifies each round trip, then destroys them. Requires repo secret
# PRISMA_SERVICE_TOKEN and repo variable PRISMA_WORKSPACE_ID.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

# Fixed group (not per-ref): only one real-cloud deploy runs at a time.
# cancel-in-progress stays false so a kill mid-deploy/destroy can't orphan resources.
concurrency:
  group: e2e-deploy
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy, verify, destroy
    runs-on: ubuntu-latest
    timeout-minutes: 3
    # Secrets aren't available on forked-PR runs; skip rather than fail loudly.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    env:
      PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }}
      PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }}
      # The root binds the auth module's secret need to AUTH_SIGNING_SECRET (ADR-0029).
      # This non-sensitive test marker in the runner env is what deploy preflight
      # fill-missing provisions onto the ephemeral per-run stack — the single-step
      # CI path (runner env -> direct API POST -> platform). It must match the
      # auth service's EXPECTED_SIGNING_SECRET (modules/auth/src/server.ts); the
      # value never enters deploy state, only its pointer name does.
      AUTH_SIGNING_SECRET: sk_test_ci_storefront_auth
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/deploy-verify-destroy
        with:
          working-directory: examples/storefront-auth
          build-filter: '@prisma/example-storefront-auth...'
          stack-name: storefront-auth-ci-${{ github.run_id }}
          verify-command: bash scripts/e2e-verify.sh

  deploy-pn-widgets:
    name: Deploy, verify, destroy (pn-widgets)
    runs-on: ubuntu-latest
    # Not a data dependency — runs after storefront so the two deploys never
    # hold projects/databases concurrently (workspace DB-quota headroom).
    needs: deploy
    timeout-minutes: 3
    # Secrets aren't available on forked-PR runs; skip rather than fail loudly.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    env:
      PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }}
      PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/deploy-verify-destroy
        with:
          working-directory: examples/pn-widgets
          build-filter: '@prisma/example-pn-widgets...'
          stack-name: pn-widgets-ci-${{ github.run_id }}
          verify-command: bun scripts/e2e-verify.ts
          destroy-label: 'pn-widgets '
          sweep-prefixes: storefront-auth pn-widgets hello canary

  cold-connect-canary:
    name: Cold-connect canary (FT-5226)
    runs-on: ubuntu-latest
    # Runs after both deploys so it never holds a database concurrently with
    # them (workspace DB-quota headroom). Fails when PPg no longer rejects a
    # database's first connection — the signal to remove withConnectionRetry.
    needs: deploy-pn-widgets
    timeout-minutes: 3
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    env:
      PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }}
      PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - run: pnpm install --frozen-lockfile
      - run: bun scripts/cold-connect-canary.ts

  cold-start-canary:
    name: Cold-start canary (PRO-217)
    runs-on: ubuntu-latest
    # After the FT-5226 canary for the same quota-serialization reason as the
    # deploys. Fails when the ingress no longer closes first-touch connections
    # to a booting instance — the signal to remove the streams client's
    # IDEMPOTENT_BACKOFF (the PRO-219 compensation) and this canary. The bug
    # being PRESENT is today's normal and passes.
    #
    # Runtime: the script spaces its samples 60s apart and stops at the first
    # close (see cold-start-canary.ts), so a normal run — the bug is live
    # today — finishes quickly: four live runs of this version of the script
    # all closed on the very first sample, one measured (via `time`) at
    # 96.86s end to end. The worst case is a run that never sees a close and
    # has to collect MIN_HELD_SAMPLES_FOR_BUG_GONE (14) confirmed cold-start
    # holds to justify a bug-gone verdict: at roughly 85s per sample (60s
    # spacing plus ~21-25s of create/upload/start/promote/touch/log-read, per
    # those same live runs), 14 samples is about 20 minutes, plus this job's
    # own install/build/deploy/destroy/sweep steps. cold-start-canary.ts's own
    # MAX_RUN_MS (20 minutes) stops the sampling loop and reports whatever it
    # has collected before that point, so the 30-minute timeout here is
    # headroom for the script to reach that self-imposed stop and still exit
    # cleanly — not the primary mechanism.
    needs: cold-connect-canary
    timeout-minutes: 30
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    env:
      PRISMA_SERVICE_TOKEN: ${{ secrets.PRISMA_SERVICE_TOKEN }}
      PRISMA_WORKSPACE_ID: ${{ vars.PRISMA_WORKSPACE_ID }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: ./.github/actions/deploy-verify-destroy
        with:
          working-directory: examples/streams
          build-filter: '@prisma/example-streams...'
          stack-name: streams-canary-ci-${{ github.run_id }}
          verify-command: bun "${{ github.workspace }}/scripts/cold-start-canary.ts"
          destroy-label: 'streams-canary '
          sweep-prefixes: storefront-auth pn-widgets hello canary streams-canary