ci(preview): dispatch preview-env create/teardown to infra on PR events#210
Merged
Merged
Conversation
Phase 1a of the Layer-3 per-PR ephemeral k8s preview environment.
Companion PR: InstaNode-dev/infra#<preview-env-phase-1a-scaffolding>.
Fires repository_dispatch on the infra repo:
- preview-create-from-api on pull_request opened/synchronize/reopened
- preview-teardown-from-api on pull_request closed
Phase 1a is dry-run end-to-end — the infra workflow only echoes what it
would do and posts a `neutral` (warn-only) check-run back to the api PR.
No real namespace is created in Phase 1a; the wiring proves the dispatch
+ check-run + RBAC paths before Phase 1b enables real provisioning.
Security posture (per security-guidance):
- Every github.event.* value is assigned via env: (never interpolated
into a shell block directly).
- PR number shape-validated as a positive integer 1-99999.
- SHA shape-validated as lowercase hex >= 7 chars.
- Only repo-controlled identifiers are forwarded — no PR title/body/
branch-name reaches the dispatch payload.
- Re-uses the existing REPO_ACCESS_TOKEN secret (same one already used
by the auth-contract-e2e cross-repo dispatch in ci.yml).
- If REPO_ACCESS_TOKEN is missing, soft-skips with ::warning::, keeping
the api PR green (Phase 1a is warn-only end-to-end).
Rule 17 coverage:
Symptom: no preview-env dispatch existed on api PRs
Enumeration: ls .github/workflows/ + grep -l 'preview' .github/workflows/*.yml
Sites found: 0
Sites touched: 1 new file
Coverage test: python3 yaml.safe_load_all (OK; on=[pull_request], jobs=[dispatch])
Live verified: N/A — fires on next PR open against this branch;
infra-side posts a `neutral` check observable in the PR's Checks tab.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 1a companion to InstaNode-dev/infra#44 — adds the api-side trigger that fires
repository_dispatchevents on the infra repo when a PR opens/syncs (create) or closes (teardown)..github/workflows/preview-dispatch.ymlpreview-create-from-apionopened/synchronize/reopened,preview-teardown-from-apionclosedREPO_ACCESS_TOKENsecret (same one used byauth-contract-e2ecross-repo dispatch inci.yml)conclusion: neutralso it surfaces preview-env state on the PR without blocking mergeSecurity posture
github.event.*value isolated viaenv:block; never interpolated into a shellrun:directlygithub.sha,github.event.pull_request.number,github.event.action,github.event.pull_request.merged) are forwarded — no PR title/body/branch reaches the dispatch payloadREPO_ACCESS_TOKENsoft-skips with::warning::(keeps the api PR green during rollout)Rule 17 coverage block
Test plan
master,pull_request:openedfires)Dispatching preview-create to InstaNode-dev/infra: pr=<N> sha=<sha>anddispatch response: HTTP 204neutralcheck labelledpreview-env / status:plannedappears in this PR's Checks tab (posted byInstaNode-dev/infra/preview-create.yml)preview-teardown-from-apidispatch fires and the infra workflow logsWOULD DELETE namespace preview-api-pr-<N>🤖 Generated with Claude Code