Add manual deployment script as single source of truth#49
Merged
Conversation
CI is unavailable, so releases must be deployed by hand. Add scripts/deploy.sh, which reproduces the Release workflow's deployment steps, and have the workflow call it so the two never drift. scripts/deploy.sh: - nix-cache: build komet-node once, push the closure to the k-framework cache (cachix), publish the binary to k-framework-binary (kup), and verify the push and pin. - docker: build the image, smoke-test it, push to Docker Hub; logs out on exit so credentials do not linger. - Preflight guards: required tools on PATH, a clean worktree (so a manual build matches the published REV), and required secrets. scripts/README.md: manual-deployment runbook. release.yml: the nix-cache and dockerhub jobs now invoke the script instead of duplicating the commands inline. .dockerignore: exclude local secret/credential files so a manual `docker build .` cannot bake them into a published image layer. .devcontainer: install cachix and add the docker-in-docker feature so both subcommands run inside the container.
Fold the manual-deployment runbook into CONTRIBUTOR.md ("Deploying a
release") and drop scripts/README.md so the contributor guide is the
single home for it. Repoint the references in deploy.sh and release.yml.
Use the conventional name so GitHub auto-links it in the PR and issue UI. Update the references in deploy.sh and release.yml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI is currently unavailable, so releases must be deployed to the Docker registry and Nix caches by hand. This adds
scripts/deploy.sh, which reproduces theReleaseworkflow's deployment steps, and rewires the workflow to call it — so the manual and CI paths can never drift.What
scripts/deploy.sh— two subcommands mirroring the workflow's deploy jobs:nix-cache: buildkomet-nodeonce, push the closure to thek-frameworkcache (cachix), publish the binary tok-framework-binary(kup), then verify the push and pin.docker: build the image, smoke-test it, push to Docker Hub; logs out on exit so credentials don't linger.PATH, a clean worktree (so a manual build is byte-for-byte what CI would produce and matches the publishedREV), and required secrets.ALLOW_DIRTY=1overrides the worktree check.scripts/README.md— manual-deployment runbook (prerequisites, secrets, and the full draft → deploy → finalizeghsequence)..github/workflows/release.yml— thenix-cacheanddockerhubjobs now invokescripts/deploy.shinstead of duplicating the commands inline..dockerignore— exclude local secret/credential files (.env,.envrc,*.key, …) so a manualdocker build .cannot bake them into a published image layer..devcontainer/— installcachixand add the docker-in-docker feature so both subcommands run inside the container.Notes
ghsteps by hand.