Repository navigation
ci: simplify production deployment to a single image operation - #255
Merged
Merged
Conversation
HTExplicit
added a commit
that referenced
this pull request
Oct 7, 2026
The deployment path still carried retired acceptance, rollback, resource-request and plugin-era controls, while console typography needed to be brought up to date with the current upstream style. This integrates the remaining authorized takeover work after the reasoning repair in #252. - Integrates #253, #254, #255 and #222 while retaining their commit ancestry. Removes stale release scaffolding and deployment template settings; preserves every existing migration SQL file. - Production Deploy accepts only `release_tag` and `confirmation=DEPLOY`, sends `deploy <immutable-image>`, and retains standard OCI provenance and fixed SSH/environment controls. Both automation callers and historical-run deduplication match it. - Migration 274 deletes only validated, soft-deleted release-acceptance keys and their usage/dedup rows, removes the two acceptance columns, and leaves ordinary keys and diagnostic logs. The matching application no longer reads those columns. Older images cannot be deployed after 274; failures require a forward fix. - Uses upstream system fonts, sizes and readable semantic text colors without dropping table columns. Fixes the TLS empty-state color and whole-badge/word wrapping, and normalizes the audit helper's LF bytes without semantic changes. - Removes the image-side skill-registry directory after the host mount and retired runtime configuration were removed. Validation: reuse the component branches' directly affected tests and source-identical UI matrix; normal required checks run on this final integration tree. The only integration conflicts were the migration CI selector and retired documentation/notices; the resolved selector retains the new PostgreSQL migration fixture and live migration tests. All existing migration SQL is unchanged. Entry-point Bash syntax and diff checks pass. The simplified host tool has completed a successful unchanged-image `.12` redeploy, preserving environment/resources and other containers. Host config retirement also passed with a new complete backup retained. UI localhost fake-data validation sampled 7,728 normal text/input/placeholder elements across 36 after states, with no sample below 4.5:1; account tables fit at 1280/1440/1920 in both languages/themes. Before screenshots block external fonts and show their fallback stack. No real model call or live upstream ID-less-item acceptance test was performed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production Deploy still exposes retired rollback, rollout, resource and interruption controls. It now accepts only
release_tagandconfirmation=DEPLOY, resolves the immutable image and source from the published Release, and sends exactlydeploy <image-ref>through the existing pinned SSH identity. The workflow filename,deployjob and tag-bearing title remain compatible with the status UI.Both upstream automatic callers use the new inputs and title. Their lookup also recognizes already dispatched legacy titles, so the transition does not schedule a second deployment. Remove the three fork OCI labels and their reader together; standard OCI labels, revision binding, provenance and the production environment remain in place. Current deployment documentation and focused contract fixtures follow the new form. Earlier tags still require a compatible database migration state.
Validation:
deploy/tests/production-deploy-workflow-test.shwith fake GitHub, registry, Git and SSH endpoints: immutable releases, rejected inputs/source mismatches and the exact pinned SSH command passed.downstreamStatus.spec.ts: 3 tests passed with the new title.git diff --checkpassed. No additional business tests or real model calls were run locally.Rollout dependency: merge only after the host deployment tool accepts the bare-image command and a redeployment of the current production tag proves environment, resources and compose configuration remain unchanged. This PR does not install or deploy host tools. Once images are published without the retired fork labels, restoring the old label reader is not a valid rollback.