Merge pull request #239 from pylon-code/upstream/2026-09-01-live-acti… #235
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Pylon Connect relay | |
| on: | |
| push: | |
| branches: | |
| - pylon | |
| # Infrastructure drifts and deploys fail for reasons unrelated to a commit, | |
| # so the stack can be reapplied without pushing one. | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: none | |
| statuses: write | |
| concurrency: | |
| group: relay-production | |
| cancel-in-progress: false | |
| jobs: | |
| deploy_relay: | |
| name: Deploy production relay | |
| # Opt-in: the relay needs Neon, Cloudflare, Axiom, Clerk, and APNs | |
| # credentials. Set the DEPLOY_RELAY repository variable to "true" once they | |
| # exist, so merges to pylon do not fail on a stack that cannot deploy. | |
| if: ${{ vars.DEPLOY_RELAY == 'true' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| environment: | |
| name: production | |
| env: | |
| CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} | |
| AXIOM_ORG_ID: ${{ vars.AXIOM_ORG_ID }} | |
| RELAY_DOMAIN: ${{ vars.RELAY_DOMAIN }} | |
| RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }} | |
| RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }} | |
| CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }} | |
| CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }} | |
| APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }} | |
| APNS_TEAM_ID: ${{ vars.APNS_TEAM_ID }} | |
| APNS_KEY_ID: ${{ vars.APNS_KEY_ID }} | |
| APNS_BUNDLE_ID: ${{ vars.APNS_BUNDLE_ID }} | |
| ALCHEMY_TELEMETRY_DISABLED: "1" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| sparse-checkout: | | |
| /* | |
| !/.repos/ | |
| sparse-checkout-cone-mode: false | |
| - name: Setup Vite+ | |
| uses: voidzero-dev/setup-vp@v1 | |
| with: | |
| node-version-file: package.json | |
| cache: true | |
| run-install: | | |
| args: | |
| - --filter=t3code-relay... | |
| # Alchemy keeps its resource state in a Cloudflare Worker that has to | |
| # exist before the first apply. Without `force` this adopts an existing | |
| # store and refreshes its credentials, so running it every deploy is a | |
| # no-op after the first and survives the store being deleted. | |
| - name: Bootstrap Alchemy state store | |
| working-directory: infra/relay | |
| run: node node_modules/alchemy/bin/cli.js cloudflare bootstrap | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| - name: Deploy production relay stage | |
| id: deploy | |
| run: vp run --filter t3code-relay deploy --stage prod --yes --github-output | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| NEON_API_KEY: ${{ secrets.NEON_API_KEY }} | |
| AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }} | |
| CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }} | |
| APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }} | |
| - name: Publish relay deploy commit status | |
| uses: actions/github-script@v8 | |
| with: | |
| script: | | |
| const result = "${{ steps.deploy.outputs.result }}"; | |
| const changed = "${{ steps.deploy.outputs.changed }}" === "true"; | |
| const description = changed | |
| ? "Relay production deploy applied infrastructure changes." | |
| : result === "noop" | |
| ? "Relay production deploy was a no-op." | |
| : `Relay production deploy completed with result: ${result}.`; | |
| await github.rest.repos.createCommitStatus({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| sha: context.sha, | |
| state: "success", | |
| context: "Relay deploy / production", | |
| description, | |
| target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`, | |
| }); |