adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-09-30 09:33:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

docs(cd): document GitHub Environment branch and tag policies

Browse source
This commit is contained in:
Adam Moussa 2026-09-18 11:22:50 -04:00
parent 8f4fa36647
commit 7eaa7fb3f9
No known key found for this signature in database
1 changed files with 25 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
terraform/live/README.md
View file

@ -137,11 +137,11 @@ restores the previous Elastic Beanstalk version label. Database migrations
already applied by the failed bundle are not reverted. Deploy parameters are read from `/shoc-backend/<env>/deploy/*` SSM
parameters this module writes.
Merge to `main` deploys **dev** unless the push is terraform-only. Staging and
prod are cut from **Actions → Release** (`environment`, `bump`, `message`).
That workflow waits for CI, tags `vX.Y.Z-staging` or `vX.Y.Z` from main HEAD
with `GITHUB_TOKEN`, then calls deploy. Prod waits on GitHub Environment
reviewers; AWS steps stay skipped until `PROD_APP_CD_ENABLED` is true.
Merge to `main` deploys **dev** unless the push is terraform-only. Staging is
cut from **Actions → Release** (`environment`, `bump`, `message`). That
workflow waits for CI, tags `vX.Y.Z-staging` from main HEAD with
`GITHUB_TOKEN`, then calls deploy. Do not cut prod yet; leave
`PROD_APP_CD_ENABLED` unset and do not create the `prod` GitHub Environment.
Staging remains `adoption_complete=false` with a pinned API CNAME until its
import apply is proven.
@ -160,13 +160,32 @@ on that leftover path only.
### Credentials
Store `DEPLOY_ROLE_ARN` as a GitHub Environment **variable** (`dev`,
`staging`, later `prod`). OIDC trust is
`staging`). OIDC trust is
`repo:Sea-Haven-Industries/shoc-backend:environment:<env>` plus
`job_workflow_ref` for `.github/workflows/deploy.yaml` at `refs/heads/main`
and `refs/tags/v*`. Adding another deploy workflow is a cross-family IAM
change. After cutover, drop `TF_API_TOKEN` from GitHub Environments. The new
CD path does not use it.
GitHub Environment deployment branch and tag policies are repository
settings, not this diff. Update them before the first merge to `main` and
the first staging cut. The policy matches `GITHUB_REF` of the workflow run.
Branch patterns never match tag refs; adding `v*` as a branch pattern fails
the same way as an empty allowlist.
1. `dev` — allow branch `main`. Keep `dev` allowed while leftover
`.github/workflows/deploy.yml` still deploys from that branch.
2. `staging` — add a **tag-type** policy matching `v*.*.*-staging` for
`deploy-tag.yaml`. Allow branch `main` because Actions → Release is
`workflow_dispatch` on `main` and then calls `deploy.yaml`
(`GITHUB_TOKEN` tag pushes do not start `deploy-tag.yaml`). Keep
`staging` allowed while leftover `deploy.yml` still deploys from that
branch.
Do not create the `prod` environment yet. Leave `PROD_APP_CD_ENABLED`
unset. Do not run Actions → Release with `environment=prod`; the first
prod dispatch would auto-create an unprotected environment.
## Pinned live identities
- Dev: workspace `shoc-backend-dev`; EB environment `shoc-backend-dev`