mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 10:23:14 +00:00
3af0bd5e16
* Align workflows with Sea Haven CI/CD handbook Bring the workflow suite in line with the handbook: bump actions/checkout to v7 (Node 24 runtime, already standardized), kebab-case the two snake_case workflow filenames, and add the org-standard Labeler caller and Dependency Review gate so vulnerable or disallowed-license deps and unlabeled PRs are caught automatically. File renames only — job/check display names are unchanged, so the promotion gate's REQUIRED_CHECKS and branch-protection required checks are unaffected. Refs: INFRA-115 * Drop Agent prefix from CI workflow + job names The handbook names workflows for what they do (CI, Deploy, Labeler), not the component they run, matching .github and afterhours-shift-manager. Rename the suite to CI and its jobs to Lint / Format check / Unit tests, and keep the promotion gate's REQUIRED_CHECKS in sync. Refs: INFRA-115 --------- Co-authored-by: seahaven-openswe[bot] <296972425+seahaven-openswe[bot]@users.noreply.github.com>
84 lines
2.8 KiB
YAML
84 lines
2.8 KiB
YAML
name: Rollback (re-point env to a prior release)
|
|
|
|
# Roll an env back to a previously published release without rebuilding. Re-points
|
|
# releases/latest/ at the chosen release and re-fires the open-swe-<env>-deploy SSM
|
|
# document — same fire/wait/gate path as a forward deploy (roll-box.sh).
|
|
#
|
|
# env=dev, sha blank → restore open-swe-dev-assets/releases/last-good/ (AUTO)
|
|
# env=prod, sha blank → restore open-swe-prod-assets/releases/last-good/ (manual
|
|
# approval: Environment "prod", same gate as a prod deploy)
|
|
# sha=<commit> → restore that exact releases/<sha>/ instead of last-good.
|
|
#
|
|
# No new IAM: reuses the githubdeploy-open-swe-app-<env> role's existing releases/*
|
|
# write + tag-scoped ssm:SendCommand. OIDC subject alignment matches build-artifacts:
|
|
# - rollback-dev declares NO `environment:` → sub = repo:…:ref:refs/heads/<branch>
|
|
# - rollback-prod declares `environment: prod` → sub = repo:…:environment:prod
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
env:
|
|
description: "Which environment to roll back"
|
|
required: true
|
|
type: choice
|
|
options: [dev, prod]
|
|
sha:
|
|
description: "Release SHA to restore (blank = releases/last-good)"
|
|
required: false
|
|
type: string
|
|
|
|
concurrency:
|
|
# never overlap a rollback with another rollback/deploy of the same env.
|
|
group: rollback-${{ inputs.env }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
rollback-dev:
|
|
name: Rollback (dev)
|
|
if: ${{ inputs.env == 'dev' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
env:
|
|
ENV: dev
|
|
BUCKET: open-swe-dev-assets
|
|
DEPLOY_DOC: open-swe-dev-deploy
|
|
TARGET_SHA: ${{ inputs.sha }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: aws-actions/configure-aws-credentials@v6
|
|
with:
|
|
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_DEV }}
|
|
aws-region: us-east-1
|
|
- name: Re-point releases/latest + redeploy
|
|
run: bash .github/scripts/rollback.sh
|
|
|
|
rollback-prod:
|
|
name: Rollback (prod)
|
|
if: ${{ inputs.env == 'prod' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
# Manual-approval gate: the "prod" Environment requires a reviewer (Adam). Also
|
|
# makes the OIDC sub …:environment:prod (matches the prod app-role trust).
|
|
environment: prod
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
env:
|
|
ENV: prod
|
|
BUCKET: open-swe-prod-assets
|
|
DEPLOY_DOC: open-swe-prod-deploy
|
|
TARGET_SHA: ${{ inputs.sha }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: aws-actions/configure-aws-credentials@v6
|
|
with:
|
|
role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_PROD }}
|
|
aws-region: us-east-1
|
|
- name: Re-point releases/latest + redeploy
|
|
run: bash .github/scripts/rollback.sh
|