ci: request a dev deploy after publishing - #1
Merged
Conversation
The dev stage of Forge Central pins plc by image digest, so a deploy meant reading the digest ghcr.io/fil-forge/did-method-plc:main now names and editing infra-central by hand. The publish run already knows that digest. Dispatch a bump-deployed-image event to fil-forge/infra-central, carrying the digest, the commit and the pull request it came from. The receiver there opens a pull request pinning the digest with auto-merge enabled, and HCP applies dev on every commit to main, so merging it is what deploys. The workflow runs on every push, so the dispatch is gated on refs/heads/main and on this being fil-forge/did-method-plc: other refs and forks publish to their own namespace and stop there. Prod pins are promoted by hand. Refs FIL-1051 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> Assisted-by: Claude
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f613eb9e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This workflow has no concurrency guard, so two pushes to main build side by side. The arm64 legs decide who finishes first, the receiver takes the last dispatch it sees, and an older build could therefore repin dev behind a newer one. Read the tip of main immediately before dispatching and skip when this commit is no longer it, leaving the pin to the build that is. The tip comes from GITHUB_TOKEN: the fil-forge-bot token is scoped to infra-central and cannot read this repository. The other services cancel in-flight runs on a newer push to the same ref, so they do not have this exposure. Refs FIL-1051 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> Assisted-by: Claude
infra-central moved off HCP Terraform in fil-forge/infra-central#25: state lives in S3 and its "Check and deploy" workflow runs tofu apply on dev/apps on every push to main. The comment added in 5f613eb described the old setup, which fil-forge/infra-central#33 also corrected on that side. The mechanism this workflow relies on is unchanged — merging the receiver's pull request is still what deploys. Only the description was wrong. Refs FIL-1051 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> Assisted-by: Claude
bajtos
added a commit
to fil-forge/hilt
that referenced
this pull request
Aug 20, 2026
The `Deploying to dev` section added in #41 says HCP Terraform applies the dev workspace. infra-central moved off HCP in fil-forge/infra-central#25 — state lives in S3 now, and its `Check and deploy` workflow runs `tofu apply` on `dev/apps` (after `apply-platform`) on every push to `main`. fil-forge/infra-central#33 corrected the same wording on that side. The mechanism this repo relies on is unchanged: merging the receiver's pull request is still what deploys. Only the description was wrong. ### Changes - `README.md`: replace the HCP sentence, and add a `[deploy]` link to `check-and-deploy.yml` next to the existing receiver link. Docs only — no workflow or code changes. ### Context Found while porting #41 to the remaining Forge Central services, where the same sentence had been copied across. Corrected there in the same series: - fil-forge/sprue#71 - fil-forge/swarf#6 - fil-forge/delegator#28 - fil-forge/piri-signing-service#17 - fil-forge/did-method-plc#1 ### Related - Linear: [FIL-1051](https://linear.app/filecoin-foundation/issue/FIL-1051) - Receiver workflow: fil-forge/infra-central#24 --- _Generated by [Claude Code](https://claude.ai/code/session_01E7ZDwvCHKi6441uN3NCCnP)_
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Aug 21, 2026
Published from fil-forge/did-method-plc#1 - Digest: `sha256:ebb12470f6fc50906c0ed867d009a056e131db1a994b45d7c3f1c8d2eb26dee9` - Commit: fil-forge/did-method-plc@df9ae0a - Publish run: https://github.com/fil-forge/did-method-plc/actions/runs/32491680329 Merging applies [`terraform/envs/dev/apps`](https://github.com/fil-forge/infra-central/tree/main/terraform/envs/dev/apps) with no further confirmation. Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dev stage of Forge Central pins plc by image digest, so deploying a merge to
mainmeant reading the digestghcr.io/fil-forge/did-method-plc:mainnownames and editing infra-central by hand. The publish run already knows that
digest.
build-and-push-ghcrnow dispatches abump-deployed-imageevent tofil-forge/infra-central, carrying the digest, the commit and the pull requestit came from. The receiver there opens a pull request pinning the digest with
auto-merge enabled, and infra-central's Check and deploy workflow runs
tofu applyondev/appson every push to itsmain, so merging that pullrequest is what deploys. infra-central keys this service as
plc.This workflow triggers on every push, not only
main, so the dispatch is gatedon
refs/heads/mainand on the repository beingfil-forge/did-method-plc.Other refs and forks keep publishing to their own GHCR namespace and stop there
— the same fork-awareness the existing
build-and-push-awsjob uses. Prod pinsare promoted by hand.
Unlike the sibling services, this workflow has no
concurrencyblock, so twopushes to
mainbuild side by side and finish in whatever order their arm64legs take. The receiver takes the last dispatch it sees, so an older build could
otherwise repin dev behind a newer one. A tip check immediately before the
dispatch skips when
GITHUB_SHAis no longer the tip ofmain, leaving the pinto the build that is. Serializing with
concurrencywould have changed publishbehaviour for every push and fork in this repo, which is wider than this change
needs to be.
Changes
.github/workflows/build-and-push-ghcr.yaml:pull-requests: readforresolving the source PR, and four new gated steps — resolve the merged PR URL,
mint a
fil-forge-bottoken scoped toinfra-central, confirm this commit isstill the tip of
main, and POST the dispatch. The existing build stepalready carried
id: build-and-push, whosedigestoutput feeds the payload;the digest is shape-checked before it is sent. The tip read uses
GITHUB_TOKEN, since the bot token cannot read this repository.No README change here: this fork's
README.mdis the upstream did:plc document,so the deployment notes live as comments in the workflow to keep upstream syncs
clean. In the other services these notes went into their READMEs.
Requirements
The dispatch runs as the
fil-forge-botGitHub App and needs theFORGE_BOT_APP_IDvariable and theFORGE_BOT_PRIVATE_KEYsecret to beavailable to this repository.
Related