From 4bfb458eadad66765d682e59505a1312e1dac0cb Mon Sep 17 00:00:00 2001 From: SandipBajracharya Date: Tue, 15 Sep 2026 12:14:42 +0545 Subject: [PATCH 1/2] feat(OUT-4184): auto-deploy to Trigger.dev on merge to master Add a self-contained deploy workflow that runs on push to master: typecheck, test, and lint gate a deploy job (needs all three) that runs `yarn trigger:deploy` with VERCEL_ENV=production so Sentry sourcemaps upload. Secrets come from the Production GitHub Environment. - concurrency group preserves commit order, never cancels in-flight - yarn install --immutable pins the deployed deps to the lockfile - permissions: contents:read and a deploy timeout for hardening - fix SENTRY_AUTHTOKEN typo in .env.example Co-Authored-By: Claude Opus 4.8 --- .env.example | 2 +- .github/workflows/deploy.yml | 109 +++++++++++++++++++++++++++++++++++ 2 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/deploy.yml diff --git a/.env.example b/.env.example index 0cc84545..905c6284 100644 --- a/.env.example +++ b/.env.example @@ -25,4 +25,4 @@ AB_FEATURE_TESTING_PORTALS= SENTRY_ORG= SENTRY_PROJECT= NEXT_PUBLIC_SENTRY_DSN= -SENTRY_AUTHTOKEN= +SENTRY_AUTH_TOKEN= diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 00000000..2f8310c6 --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,109 @@ +name: Deploy + +on: + push: + branches: [master] + +# Preserve commit order; never cancel an in-flight production deploy. +concurrency: + group: deploy-production + cancel-in-progress: false + +permissions: + contents: read + +jobs: + typecheck: + name: Typecheck tests + runs-on: ubuntu-latest + + steps: + - name: Check out Git repository + uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: 22.14.0 + cache: yarn + cache-dependency-path: './yarn.lock' + + - name: Install dependencies + run: yarn install --immutable + + - name: Typecheck test files + run: yarn typecheck:test + + test: + name: Run tests + runs-on: ubuntu-latest + + steps: + - name: Check out Git repository + uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: 22.14.0 + cache: yarn + cache-dependency-path: './yarn.lock' + + - name: Install dependencies + run: yarn install --immutable + + - name: Run tests + run: yarn test + + lint: + name: Run linters + runs-on: ubuntu-latest + + steps: + - name: Check out Git repository + uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: 22.14.0 + cache: yarn + cache-dependency-path: './yarn.lock' + + - name: Install dependencies + run: yarn install --immutable + + - name: Run linters + run: yarn lint:check && yarn prettier:check + + deploy: + name: Deploy to Trigger.dev + needs: [typecheck, test, lint] + runs-on: ubuntu-latest + environment: Production + timeout-minutes: 20 + + steps: + - name: Check out Git repository + uses: actions/checkout@v4 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: 22.14.0 + cache: yarn + cache-dependency-path: './yarn.lock' + + - name: Install dependencies + run: yarn install --immutable + + - name: Deploy to Trigger.dev production + run: yarn trigger:deploy + env: + TRIGGER_ACCESS_TOKEN: ${{ secrets.TRIGGER_ACCESS_TOKEN }} + TRIGGER_PROJECT_ID: ${{ secrets.TRIGGER_PROJECT_ID }} + VERCEL_ENV: production + SENTRY_ORG: ${{ secrets.SENTRY_ORG }} + SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }} + SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} + NEXT_PUBLIC_SENTRY_DSN: ${{ secrets.NEXT_PUBLIC_SENTRY_DSN }} From 38a7aab6440b60f2d97450006c2f1d1bf4578198 Mon Sep 17 00:00:00 2001 From: SandipBajracharya Date: Tue, 15 Sep 2026 12:35:00 +0545 Subject: [PATCH 2/2] fix(OUT-4184): address Greptile review on deploy workflow - cancel-in-progress: true so newest master supersedes an in-flight run - pin actions/checkout and actions/setup-node to full commit SHAs across deploy.yml, test.yml, and lint.yml (mutable tags can be moved after a compromise); deploy job handles production secrets Co-Authored-By: Claude Opus 4.8 --- .github/workflows/deploy.yml | 23 +++++++++++++---------- .github/workflows/lint.yml | 6 ++++-- .github/workflows/test.yml | 10 ++++++---- 3 files changed, 23 insertions(+), 16 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 2f8310c6..7aa4bdc8 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -4,14 +4,17 @@ on: push: branches: [master] -# Preserve commit order; never cancel an in-flight production deploy. +# Newer push to master supersedes an in-flight deploy run. concurrency: group: deploy-production - cancel-in-progress: false + cancel-in-progress: true permissions: contents: read +# Actions are pinned to full commit SHAs, not @v4 tags: tags are mutable, +# and the deploy job runs these before handing production secrets to the +# deploy step. A moved tag must not run here. Bump SHA + version comment together. jobs: typecheck: name: Typecheck tests @@ -19,10 +22,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn @@ -40,10 +43,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn @@ -61,10 +64,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn @@ -85,10 +88,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d3abcb00..53df4bbc 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -2,6 +2,8 @@ name: Lint on: push +# Actions pinned to full commit SHAs: tags are mutable and can be moved +# after a compromise. Bump SHA + version comment together. jobs: run-linters: name: Run linters @@ -9,10 +11,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ccdba289..6c950208 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -2,6 +2,8 @@ name: CI on: pull_request +# Actions pinned to full commit SHAs: tags are mutable and can be moved +# after a compromise. Bump SHA + version comment together. jobs: typecheck: name: Typecheck tests @@ -9,10 +11,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn @@ -30,10 +32,10 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.14.0 cache: yarn