ci: gate the relay deploy behind an opt-in variable #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Pylon Connect relay | |
| on: | |
| push: | |
| branches: | |
| - pylon | |
| permissions: | |
| contents: read | |
| id-token: none | |
| statuses: write | |
| concurrency: | |
| group: relay-production | |
| cancel-in-progress: false | |
| jobs: | |
| deploy_relay: | |
| name: Deploy production relay | |
| # Opt-in: the relay needs Neon, Cloudflare, Axiom, Clerk, and APNs | |
| # credentials. Set the DEPLOY_RELAY repository variable to "true" once they | |
| # exist, so merges to pylon do not fail on a stack that cannot deploy. | |
| if: ${{ vars.DEPLOY_RELAY == 'true' }} | |
| runs-on: blacksmith-8vcpu-ubuntu-2404 | |
| timeout-minutes: 15 | |
| environment: | |
| name: production | |
| env: | |
| CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| AXIOM_ORG_ID: ${{ vars.AXIOM_ORG_ID }} | |
| RELAY_DOMAIN: ${{ vars.RELAY_DOMAIN }} | |
| RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }} | |
| RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }} | |
| CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }} | |
| CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }} | |
| APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }} | |
| APNS_TEAM_ID: ${{ vars.APNS_TEAM_ID }} | |
| APNS_KEY_ID: ${{ vars.APNS_KEY_ID }} | |
| APNS_BUNDLE_ID: ${{ vars.APNS_BUNDLE_ID }} | |
| ALCHEMY_TELEMETRY_DISABLED: "1" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: | | |
| args: | |
| - --filter=t3code-relay... | |
| - name: Deploy production relay stage | |
| id: deploy | |
| run: vp run --filter t3code-relay deploy --stage prod --yes --github-output | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| NEON_API_KEY: ${{ secrets.NEON_API_KEY }} | |
| AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }} | |
| CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }} | |
| APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }} | |
| - name: Publish relay deploy commit status | |
| uses: actions/github-script@v8 | |
| with: | |
| script: | | |
| const result = "${{ steps.deploy.outputs.result }}"; | |
| const changed = "${{ steps.deploy.outputs.changed }}" === "true"; | |
| const description = changed | |
| ? "Relay production deploy applied infrastructure changes." | |
| : result === "noop" | |
| ? "Relay production deploy was a no-op." | |
| : `Relay production deploy completed with result: ${result}.`; | |
| await github.rest.repos.createCommitStatus({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| sha: context.sha, | |
| state: "success", | |
| context: "Relay deploy / production", | |
| description, | |
| target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`, | |
| }); |