deploy: allow pinned beta source revisions - #3
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce549ce9f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| exit 1 | ||
| fi | ||
| case "$SOURCE_BRANCH" in | ||
| main|beta) ;; |
There was a problem hiding this comment.
When beta has weaker branch protection than main, this allows its commits to bypass the documented main-only production restriction: GitHub matches an environment’s deployment-branch rule against the workflow run’s GITHUB_REF, which remains main here, not against the commit later checked out (GitHub documentation). The build and deploy jobs then execute scripts and the local setup-kubectl action from that beta commit with production registry credentials and the cluster kubeconfig. Require beta to satisfy the same review/protection policy as main, or independently gate the selected SHA before exposing production secrets.
Useful? React with 👍 / 👎.
1 participant
The production workflow currently rejects every revision outside main, so the fork cannot publish features integrated into beta. Add a main/beta source selector (default main) and validate the pinned revision against the selected branch. Continue dispatching the trusted workflow from main with the existing production environment restriction.
Both choices replace the same Core/Web installation, database and PVC. Beta does not create a second environment. The beta integration ledger records upstream PRs and upgrade requirements; PR MiniMax-AI#297 remains on beta and is not included in this PR.
Validation: actionlint, git diff --check, independent review, and execution of the source guard against a temporary Git repository covering valid main/beta revisions and rejected cross-branch/unrelated revisions, workflow refs and source branches. No production rollout was triggered.