From 8dfbfb3d5402f8c406608c56e7c89a5533dfa5a5 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 21:58:03 +0000 Subject: [PATCH] ci(release): close notification/payment path gaps; build payment-service image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two related fixes to the release pipeline, no app-logic change. 1. release.yml's push-path filter was missing services/notification-service/** and services/payment-service/**. This is the same silent-ship gap the file already documents for chat-service: a change confined to one of those service dirs would merge green and never trigger a release, shipping stale (or, for payment-service, no) image. Added both paths. 2. payment-service had no build step, so its image never existed and paymentService.image.tag sat at "" (InvalidImageName if ever enabled). Added a Build & push payment-service step (self-contained context, like clock-app) and wired it through the GitOps tag-bump guard: PAYMENT_OK, the EXPECTED count, the awk payment var, and the repository anchor — per the bump step's own rule that a new build step MUST add its anchor and count. Verified by simulating the awk against values-prod.yaml: payment's tag rewrites and COUNT stays consistent whether or not the build succeeds. payment-service stays enabled: false. This only makes the image EXIST so a future go-live is a values flip in a deploy window, not a missing-image scramble. The build is continue-on-error, so a payment build failure is non-fatal and leaves its tag pinned rather than breaking the release. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01Hc8XVgyLJkyeMsRysJYCqP --- .github/workflows/release.yml | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9177080d..cfa8785f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,6 +38,13 @@ on: # failure mode the packages/** comment above describes, just for a # different path. This was live for every commit between #432 and now. - 'services/chat-service/**' + # notification-service/** and payment-service/** were both missing here, + # the same silent-ship gap the chat-service comment above describes: a + # change confined to one of those service dirs would merge green and never + # trigger a release, so the image would keep the old code (or, for the + # never-built payment-service, stay absent entirely). + - 'services/notification-service/**' + - 'services/payment-service/**' - 'clock-app/**' - 'deploy/helm/fuzefront/**' - '.github/workflows/release.yml' @@ -164,6 +171,25 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max + - name: Build & push payment-service + # Self-contained Dockerfile (no @fuzefront/shared dep) => context is + # services/payment-service/, like clock-app — NOT the repo root the + # workspace services use. Scaffold gateway, disabled in prod; this build + # only makes the image EXIST so paymentService.image.tag can be bumped + # off "" and a future go-live is a values flip, not a missing image. + id: payment_image + continue-on-error: true + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + with: + context: services/payment-service + file: services/payment-service/Dockerfile + push: true + tags: | + ghcr.io/izzywdev/fuzefront-payment-service:${{ steps.tag.outputs.sha }} + ghcr.io/izzywdev/fuzefront-payment-service:latest + cache-from: type=gha + cache-to: type=gha,mode=max + - name: Build & push security-service id: security_image continue-on-error: true @@ -303,8 +329,9 @@ jobs: CLOCK_OK=$(ok "${{ steps.clock_image.outcome }}") CHAT_OK=$(ok "${{ steps.chat_image.outcome }}") NOTIF_OK=$(ok "${{ steps.notification_image.outcome }}") - EXPECTED=$((2 + EMAIL_OK + SMS_OK + PROV_OK + BILLING_OK + SECURITY_OK + APPS_OK + CLOCK_OK + CHAT_OK + NOTIF_OK)) - echo "built: email=${EMAIL_OK} sms=${SMS_OK} provisioning=${PROV_OK} billing=${BILLING_OK} security=${SECURITY_OK} applications=${APPS_OK} clock=${CLOCK_OK} chat=${CHAT_OK} notification=${NOTIF_OK}" + PAYMENT_OK=$(ok "${{ steps.payment_image.outcome }}") + EXPECTED=$((2 + EMAIL_OK + SMS_OK + PROV_OK + BILLING_OK + SECURITY_OK + APPS_OK + CLOCK_OK + CHAT_OK + NOTIF_OK + PAYMENT_OK)) + echo "built: email=${EMAIL_OK} sms=${SMS_OK} provisioning=${PROV_OK} billing=${BILLING_OK} security=${SECURITY_OK} applications=${APPS_OK} clock=${CLOCK_OK} chat=${CHAT_OK} notification=${NOTIF_OK} payment=${PAYMENT_OK}" echo "expecting ${EXPECTED} tag rewrites (backend + frontend are always built)" if [ "${APPS_OK}${SECURITY_OK}${EMAIL_OK}${BILLING_OK}" != "1111" ]; then echo "::warning::one or more auxiliary images failed to build; their values-prod tags are left pinned to the last good release" @@ -341,7 +368,7 @@ jobs: awk -v sha="$SHA" -v chat="$CHAT_OK" -v notif="$NOTIF_OK" \ -v email="$EMAIL_OK" -v sms="$SMS_OK" -v prov="$PROV_OK" \ -v billing="$BILLING_OK" -v security="$SECURITY_OK" \ - -v apps="$APPS_OK" -v clock="$CLOCK_OK" ' + -v apps="$APPS_OK" -v clock="$CLOCK_OK" -v payment="$PAYMENT_OK" ' hot { hot=0 if ($0 ~ /^[[:space:]]*tag:/) { @@ -362,6 +389,7 @@ jobs: prov == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-provisioning-service\r?$/ { hot=1 } chat == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-chat-service\r?$/ { hot=1 } notif == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-notification-service\r?$/ { hot=1 } + payment == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-payment-service\r?$/ { hot=1 } { print } END { print n+0 > "/tmp/bump-count" } ' /tmp/vp-current.yaml > /tmp/vp-new.yaml