ci: auto-dispatch showcase_deploy after aimock release - #126
Closed
jpr5 wants to merge 1 commit into
Closed
Conversation
Close the propagation gap between an aimock release and the showcase-aimock wrapper image + Railway redeploy. ## Problem Today's v1.14.5 hotfix exposed a gap in the release chain: 1. aimock release → GHCR push (ghcr.io/copilotkit/aimock:X.Y.Z + :latest) — works. 2. CopilotKit/CopilotKit showcase-aimock wrapper image builds FROM ghcr.io/copilotkit/aimock:latest via showcase/aimock/Dockerfile, but the workflow that builds it (showcase_deploy.yml) only triggers on showcase/aimock/** path changes in the CopilotKit repo — NOT on aimock release. Wrapper image kept pointing at the stale digest. 3. Railway showcase-aimock service pulls ghcr.io/copilotkit/showcase-aimock:latest — never auto-redeployed because step 2 didn't run. Net result: aimock v1.14.5 sat on GHCR for ~3 minutes until someone manually ran `gh workflow run showcase_deploy.yml -f service=aimock`. Unacceptable for a prod hotfix path. ## Fix Append a dispatch step to publish-docker.yml that fires CopilotKit/CopilotKit's showcase_deploy.yml with service=aimock after the GHCR push step succeeds on a tag build. showcase_deploy.yml already knows how to rebuild the wrapper and redeploy the Railway service. ## Mechanism Approach A from the design options — cross-repo workflow_dispatch via `actions.createWorkflowDispatch`. Chosen over repository_dispatch / scheduled-diff / explicit version pinning because it is the directest path, has the shortest tail, and the existing copilotkit-devops-bot GitHub App (app-id 1108748) already has actions:write on CopilotKit/CopilotKit (target_type: Organization, repository_selection: all, same identity used by showcase_docs-sync.yml). ## Auth / identity - Mints a scoped installation token via actions/create-github-app-token@v2 restricted to owner=CopilotKit, repositories=[CopilotKit] — minimum blast radius. - Gated on `startsWith(github.ref, 'refs/tags/v')` so PR preview builds and workflow_dispatch runs never trigger production redeploys. - Gated on `steps.build.outcome == 'success'` so a failed GHCR push never cascades into a no-op showcase rebuild (the wrapper would just rebuild on the old digest). ## Slack fallback Posts a 🚨 alert via the existing SLACK_WEBHOOK secret if the dispatch step fails. Message includes the exact manual recovery command so a human can unstick the chain without reading source. ## Prerequisite The `DEVOPS_BOT_PRIVATE_KEY` secret MUST be configured on the CopilotKit/aimock repo before this can work. Add it via: gh secret set DEVOPS_BOT_PRIVATE_KEY --repo CopilotKit/aimock < <key>.pem If the secret is missing the mint step fails loud, the dispatch step is skipped, and the Slack alert fires — no silent failure.
commit: |
Contributor
Author
|
Closing — superseded by PR #128 (feat: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
showcase_deploy.ymlonCopilotKit/CopilotKitwithservice=aimockusing the existingcopilotkit-devops-botGitHub App identity.Why
Today's v1.14.5 hotfix sat on GHCR for ~3 minutes because the wrapper image (
ghcr.io/copilotkit/showcase-aimock:latest) buildsFROM ghcr.io/copilotkit/aimock:latestbut only rebuilds whenshowcase/aimock/**files change in the CopilotKit repo — never on aimock release. A manualgh workflow run showcase_deploy.yml -f service=aimockwas needed to unstick production. This closes that gap.Mechanism
Approach A (direct cross-repo
workflow_dispatch):actions/create-github-app-token@v2withapp-id: 1108748→ mints a short-lived installation token scoped toowner=CopilotKit, repositories=[CopilotKit](minimum blast radius).actions/github-script@v7callsgithub.rest.actions.createWorkflowDispatchwithworkflow_id: 'showcase_deploy.yml', ref: 'main', inputs: { service: 'aimock' }.startsWith(github.ref, 'refs/tags/v') && steps.build.outcome == 'success'— PR previews andworkflow_dispatchruns never trigger prod redeploys; a failed GHCR push never cascades into a no-op showcase rebuild.SLACK_WEBHOOKsecret, with the exact manual recovery command inlined.Prerequisite — must configure before first aimock release
The
DEVOPS_BOT_PRIVATE_KEYsecret is not yet configured onCopilotKit/aimock(confirmed viagh secret list). It exists onCopilotKit/CopilotKitandCopilotKit/internal-skills. Before merging, set it:If the secret is missing at runtime the mint step fails loud, the dispatch step is skipped, and the Slack alert fires — no silent failure.
Test plan
python3 -c "import yaml; yaml.safe_load(...)").pnpm format:check,pnpm lint,pnpm testall green.gh api /orgs/CopilotKit/installations— permissions includeactions: write,repository_selection: all, org-wide.showcase_deploy.ymlconfirmed to acceptservice: aimockinput (line 52 of thechoiceoptions, with ALL_SERVICES matrix entry at line 164).showcase_deploy.ymlauto-fire withservice=aimockwithin seconds of the GHCR push completing.Not changed / out of scope
showcase_deploy.ymlalready handles theservice: aimockdispatch path.showcase/aimock/Dockerfileoff:latestto pinned versions (Approach D) — explicit-pin workflow is heavier and not required here.