fix(ci): validate the Version PR and preflight its release evidence #176
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Preview cleanup | |
| on: | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] No pull-request code is checked out or executed. | |
| branches: [main] | |
| types: [closed, unlabeled, converted_to_draft] | |
| permissions: {} | |
| concurrency: | |
| group: hephaestus-preview-lifecycle-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| cleanup: | |
| name: "Preview / Remove and verify resources" | |
| if: >- | |
| vars.COOLIFY_URL != '' && | |
| vars.COOLIFY_APP_UUID != '' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| (github.event.label.name == 'preview' || | |
| (github.event.action != 'unlabeled' && | |
| contains(github.event.pull_request.labels.*.name, 'preview'))) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| deployments: write | |
| pull-requests: write | |
| timeout-minutes: 8 | |
| env: | |
| COOLIFY_URL: ${{ vars.COOLIFY_URL }} | |
| COOLIFY_APP_UUID: ${{ vars.COOLIFY_APP_UUID }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| # Coolify's routing key: the branch its preview application is configured for. | |
| BASE_REF: ${{ github.event.repository.default_branch }} | |
| ENVIRONMENT: preview/pr-${{ github.event.pull_request.number }} | |
| steps: | |
| - name: Load the trusted preview adapter | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| sparse-checkout: | | |
| .github/actions/setup-node-pnpm | |
| package.json | |
| pnpm-lock.yaml | |
| pnpm-workspace.yaml | |
| scripts | |
| - name: Set up the repository's Node.js and pnpm versions | |
| uses: ./.github/actions/setup-node-pnpm | |
| with: | |
| install: "none" | |
| - name: Request Coolify cleanup through the signed close event | |
| id: close | |
| continue-on-error: true | |
| env: | |
| COOLIFY_WEBHOOK_SECRET: ${{ secrets.COOLIFY_PREVIEW_WEBHOOK_SECRET }} | |
| run: node scripts/coolify-preview.ts close | |
| - name: Record that teardown was requested | |
| id: tombstone | |
| if: steps.close.outcome == 'success' | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const controller = await import(`${process.env.GITHUB_WORKSPACE}/scripts/preview-controller.ts`); | |
| await controller.inactivate({ github, context, core }); | |
| - name: Report the released preview | |
| # Always overwrites the sticky comment, closed pull requests included: a torn-down preview | |
| # must never leave a live-looking link behind. | |
| if: always() && steps.tombstone.outcome == 'success' | |
| uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 | |
| with: | |
| header: app-preview | |
| number: ${{ github.event.pull_request.number }} | |
| message: | | |
| ## 🧹 App Preview | |
| ~~Preview removed~~ — its slot is free again. | |
| <sub>Add the `preview` label, or mark the pull request ready for review, to deploy it again.</sub> | |
| - name: Fail if Coolify did not accept the close event | |
| if: always() && steps.close.outcome != 'success' | |
| run: | | |
| echo "::error::Coolify did not accept the close event; the nightly reconcile will retry." | |
| exit 1 |