ci(preview): build + push :pr-<N>-<sha> GHCR image on every PR#211
Merged
Conversation
Phase 1b companion to infra PR (Layer-3 ephemeral preview envs). The infra repo's preview-create workflow pulls `ghcr.io/instanode-dev/instant-api:pr-<N>-<sha>` when it provisions the per-PR namespace; this workflow is what produces that tag. Why a sibling workflow rather than a tag-add on deploy.yml: deploy.yml fires on push to master only. PR builds need a parallel pipeline. The test gate stays on ci.yml (already runs on PRs); this workflow is purely "package the binary so a preview env can pull it" — no duplicated test load. Posture - Same sibling-checkout pattern as deploy.yml (common/ + proto/ via REPO_ACCESS_TOKEN, same Dockerfile, same buildx invocation). - Same GHCR_PUSH_TOKEN PAT auth (per-job GITHUB_TOKEN cannot push to the org-owned package, per deploy.yml's documented constraint). - Tags only :pr-<N>-<sha>. Never touches :latest or :master-* — the prod tag namespace stays reserved for deploy.yml + pin-prod-images. - Soft-fails (warn-only) if GHCR_PUSH_TOKEN is unset. The infra preview-create soft-fails downstream on rollout timeout in that case. - paths-ignore matches deploy.yml (no preview image for docs-only PRs). - Concurrency cancel-in-progress: rapid push pattern doesn't double-build. Security - Every github.event.pull_request.* value assigned to env: and shape-validated (numeric PR, hex SHA) before shell use, matching preview-dispatch.yml's posture. - `ref:` uses head.sha (an immutable SHA, not a ref name) — can't be injection-abused. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 1b companion to InstaNode-dev/infra#45. The infra repo's
preview-createworkflow pullsghcr.io/instanode-dev/instant-api:pr-<N>-<sha>when it provisions a per-PR namespace; this workflow is what produces that tag.pull_requestopen/sync/reopen (paths-ignore mirrorsdeploy.yml).deploy.yml's sibling-checkout (common/ + proto/ via REPO_ACCESS_TOKEN), same Dockerfile, same buildx invocation, same GHCR_PUSH_TOKEN PAT auth.:pr-<N>-<sha>. Never touches:latestor:master-*— prod tag namespace stays reserved.Soft-fail surface
If
GHCR_PUSH_TOKENis unset on api repo: workflow soft-warns + exits 0. The infra preview-create then soft-fails downstream on its 240s rollout timeout (image never appears in GHCR → ImagePullBackOff → neutral check).Security
github.event.pull_request.*value assigned toenv:and shape-validated (numeric PR 1-99999, hex SHA 7-40 chars) before any shell use, matchingpreview-dispatch.yml's posture from ci(preview): dispatch preview-env create/teardown to infra on PR events #210.ref: \${{ github.event.pull_request.head.sha }}in checkout is an immutable SHA, not a ref name — can't be injection-abused.Coverage block (rule 17)
Test plan
validate(golangci-lint / typos / etc.) unaffected — workflow file onlypreview-image-buildjob pushesghcr.io/instanode-dev/instant-api:pr-<N>-<sha>to GHCRpreview-create(once operator-activated) can pull that image and roll out the api Deployment🤖 Generated with Claude Code