Repository navigation
preview deployment https://cloud-d0nkvxkfy-zitadel.vercel.app #3971
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: production-checks | |
| # Tests a production deployment of the Vercel project `cloud` before Vercel | |
| # assigns it the production domains, and reports each suite's result as a | |
| # commit status of its own on the deployed commit: `docs (Production)`, | |
| # `console (Production)` and `schemas (Production)`. Vercel's Deployment | |
| # Checks hold the domains until the statuses they list pass, once they are | |
| # added to the project (docs/runbooks/cloud.md, "Deployment checks"); until | |
| # then they only report. | |
| # | |
| # Why not `deployment_status`, like the previews: Vercel posts its GitHub | |
| # deployment when it assigns the domains, which is exactly what a blocking | |
| # check holds back, so that run would never start. Vercel sends | |
| # `vercel.deployment.ready` once the deployment is built, before its checks | |
| # run. | |
| # | |
| # A `repository_dispatch` run uses this file as it is on main and runs on | |
| # main's latest commit, which need not be the deployed one. So the suites check | |
| # out the deployed commit (`client_payload.git.sha`), and the result is set on | |
| # that commit as a status of its own, which is what Vercel matches; the jobs' | |
| # own checks land on main's head under other names, so they never pass for | |
| # the wrong commit. Vercel's status action | |
| # (vercel/repository-dispatch/actions/status) sets such a status too, but it | |
| # reads the run's first job instead of its own and reports a job that timed | |
| # out or was cancelled as a success. | |
| on: | |
| repository_dispatch: | |
| types: [vercel.deployment.ready] | |
| run-name: ${{ github.event.client_payload.environment }} deployment ${{ github.event.client_payload.url }} | |
| permissions: | |
| contents: read | |
| env: | |
| # Every suite reports the status "<suite> (Production)", which is what | |
| # Vercel's Deployment Checks match on: renaming one means updating them. | |
| SUITES: docs console schemas | |
| SHA: ${{ github.event.client_payload.git.sha }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| jobs: | |
| start: | |
| # Vercel sends the event for every deployment of every project it builds | |
| # from this repository; only production of `cloud` is tested here. | |
| if: >- | |
| github.event.client_payload.environment == 'production' && | |
| github.event.client_payload.project.name == 'cloud' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| statuses: write | |
| steps: | |
| - name: Report the checks as running | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| for suite in $SUITES; do | |
| gh api --silent "repos/$GITHUB_REPOSITORY/statuses/$SHA" \ | |
| -f state=pending -f context="$suite (Production)" -f target_url="$RUN_URL" \ | |
| -f description="Running the $suite suite against the deployment" | |
| done | |
| suites: | |
| if: >- | |
| github.event.client_payload.environment == 'production' && | |
| github.event.client_payload.project.name == 'cloud' | |
| uses: ./.github/workflows/deployment-checks.yml | |
| with: | |
| # The deployment's own URL; the payload may leave out the scheme. | |
| url: ${{ startsWith(github.event.client_payload.url, 'https://') && github.event.client_payload.url || format('https://{0}', github.event.client_payload.url) }} | |
| sha: ${{ github.event.client_payload.git.sha }} | |
| environment: Production | |
| secrets: inherit | |
| report: | |
| needs: [start, suites] | |
| # After a failure, a timeout or a cancellation too: Vercel has to see | |
| # anything but a pass as a failure. | |
| if: always() && needs.start.result != 'skipped' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| statuses: write | |
| steps: | |
| - name: Report the results on the deployed commit | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RESULT: ${{ needs.suites.result }} | |
| # `success` from each suite that passed, empty from one that did | |
| # not (deployment-checks.yml); read below as PASSED_<SUITE>. | |
| PASSED_DOCS: ${{ needs.suites.outputs.docs }} | |
| PASSED_CONSOLE: ${{ needs.suites.outputs.console }} | |
| PASSED_SCHEMAS: ${{ needs.suites.outputs.schemas }} | |
| run: | | |
| for suite in $SUITES; do | |
| passed="$(printenv "PASSED_$(echo "$suite" | tr a-z A-Z)" || true)" | |
| state=failure result="$RESULT" | |
| [ "$passed" = success ] && state=success result=success | |
| gh api --silent "repos/$GITHUB_REPOSITORY/statuses/$SHA" \ | |
| -f state="$state" -f context="$suite (Production)" -f target_url="$RUN_URL" \ | |
| -f description="The $suite suite against the deployment: $result" | |
| echo "$suite (Production): $state on ${SHA:0:8}" >> "$GITHUB_STEP_SUMMARY" | |
| done |