📦 EqualifyEverything / equalify-iris

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89name: Notify UIC deploy

# UIC runs an instance of Iris at https://iris.equalify.uic.edu for accessibility
# testing. This tells that deployment a new commit exists; it does not deploy
# anything itself and knows nothing about the infrastructure. How (or whether) the
# commit is rolled out is entirely the private deployment repo's business.
#
# Nothing here is load-bearing for the project. An absent token skips the step, and
# a revoked one — or an unreachable API — warns; neither fails the job, so anyone
# forking this repo gets a harmless no-op. Other deployments should ignore this
# file, or copy it with their own target.
on:
  push:
    branches: [main]
  workflow_dispatch:

# Least privilege: this job reads nothing and writes nothing in THIS repo. Its only
# capability comes from the PAT below, which is scoped to the deployment repo.
permissions: {}

# Newest wins, explicitly. Two merges seconds apart would otherwise race with no
# ordering guarantee, and if the older SHA's dispatch arrives last the far end
# deploys the older commit until something else is pushed — the exact drift this
# workflow exists to remove.
concurrency:
  group: notify-uic-deploy
  cancel-in-progress: true

jobs:
  notify:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Tell the UIC deployment repo to deploy this commit
        # Absent on forks and on any clone that has not opted in — skip rather than
        # fail, so this never turns a green main red for an unrelated reason.
        #
        # The ref guard matters for `workflow_dispatch`, which accepts ANY ref: without
        # it, `github.sha` could be an arbitrary branch tip aimed at a live deployment.
        # It takes repo write access to do, so it is a maintainer capability rather than
        # a hole — but "only what has actually landed on main gets deployed" should be
        # enforced here, not left to the far end to reject.
        if: ${{ github.repository == 'EqualifyEverything/equalify-iris' && github.ref == 'refs/heads/main' }}
        env:
          TOKEN: ${{ secrets.UIC_DEPLOY_DISPATCH_TOKEN }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          if [ -z "${TOKEN:-}" ]; then
            echo "UIC_DEPLOY_DISPATCH_TOKEN not set — nothing to notify. Skipping."
            exit 0
          fi

          # A repository_dispatch carrying the exact SHA, so the deployment ships
          # THIS commit rather than whatever main happens to point at by the time
          # the deploy runs.
          #
          # `|| RC=$?` is load-bearing, not decoration. `set -e` aborts on a failed
          # assignment, and curl exits non-zero whenever it gets no HTTP response at
          # all — DNS (6), refused (7), timeout (28), TLS (35). Without this, a
          # network blip skips every line below and fails the job, which is the exact
          # outcome the comments here promise not to cause.
          #
          # `--retry` because the fallback for a missed dispatch is a `::warning::` on
          # a green job, which nobody reads — and until the next push to `main` the
          # deployment quietly sits on an older commit. A still-failing curl lands in
          # the same branch below, so retrying costs nothing this job promised.
          RC=0
          CODE=$(curl -sS --max-time 30 --retry 3 --retry-connrefused \
            -o /tmp/resp.txt -w '%{http_code}' \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer $TOKEN" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/UIC-OSF/iris.equalify.uic.edu/dispatches \
            -d "{\"event_type\":\"deploy\",\"client_payload\":{\"ref\":\"$SHA\"}}") || RC=$?

          # 204 is the documented success. Anything else is worth seeing, but is
          # NOT worth failing main over — the deployment can be triggered by hand,
          # and a red main here would be misleading about the state of the code.
          if [ "$RC" -ne 0 ]; then
            echo "::warning::could not reach the GitHub API (curl exit $RC) — deploy not triggered."
          elif [ "$CODE" = "204" ]; then
            echo "Dispatched deploy of $SHA to the UIC deployment repo."
          else
            echo "::warning::dispatch returned HTTP $CODE — deploy not triggered."
            cat /tmp/resp.txt || true
          fi