ci: fix fork-PR staging deploy, drop dead mainnet overlay - #330
Merged
Conversation
The quality job ran prettier, lint, build and check-types, but never turbo test — so a green CI said nothing about the 23 test tasks in the workspace. PR #326 was a behavioural fix backed entirely by tests that CI never executed. turbo test costs ~18s locally: its dependsOn is ^build (dependencies only), so the apps' Next builds are not repeated.
A pull_request event raised by a PR from a fork gets a read-only GITHUB_TOKEN and no secrets, whatever the permissions block says. When PR #326 (external contributor) was merged, all four build-push jobs failed with 'denied: installation not allowed to Write organization package' and post-deploy was skipped, leaving the release branch out of sync until the deploy was re-run manually via workflow_dispatch. pull_request_target runs in the base-repo context with a read/write token, and keeps github.event.pull_request.labels so the existing 'release' label gate is unchanged. The usual pull_request_target hazard does not apply: both checkouts pin ref: staging, never the PR head, and the job only runs post-merge.
Real deployments come from pnf-ops (middleman side) and the docker-compose example (operator side). This overlay was last written by the release automation in v0.11.2 (2026-05-18) and has been frozen at that image tag through six releases; deploy-production.yml no longer references it. Its only remaining effect was to read as authoritative production config while declaring NODE_ENV=development and LOG_LEVEL=debug, both inherited from base — which is wrong, and misleading to anyone auditing prod. Tilt is unaffected: every k8s/apps/*/Tiltfile builds ./overlays/dev.
Reverts e0111e9. The quality job already ran `pnpm turbo test` (ci.yml lines 79-80, right after Type check); that commit added a second, identical step. Its premise — that CI never ran the tests — came from a truncated read of the workflow, not from the file. Squash-and-merge collapses this pair away.
jorgecuesta
changed the title
Merged
jorgecuesta
pushed a commit
that referenced
this pull request
Aug 13, 2026
### Reliability - Transient RPC errors no longer wedge the transaction verifier. A node at a block's commit boundary answers blockResults with "could not find results for height #N"; that error escaped verifyTransaction's tri-state contract and the sweep then threw WorkflowError, which is a plain Error rather than a TemporalFailure and therefore fails the workflow task forever. Under ScheduleOverlapPolicy.SKIP that wedged the schedule: mainnet went three days without verifying a transaction on 2026-08-10. (#338) - Corrupt schedules self-heal, with manual pause/resume/recreate from the UI. (#323) - Provider Keys pending-state polling is gated on an actually-pending state. Observability - Structured logging foundation: LogTape replaces pino, full console migration, repo is console-free and guarded by scripts/no-console-guard.sh. (#322) - Transaction tables show friendly on-chain failure reasons instead of raw codes. (#328) ### Supplier endpoints - Endpoint override compatibility is preserved across legacy and numeric forms, supplier override readers are aligned, and the behaviour is pinned by regression tests. - New CometBFT RPC type for service endpoints. (#328) ### UI - Revamp: sticky headers, tabs, failure reasons, notification filters. (#325) ### CI - Fork-PR staging deploys are fixed and the dead mainnet overlay is dropped. (#330) ### Database - Two additive migrations run on deploy: 0017 (notification channels, events and preferences) and 0018 (watchdog heal state). New tables and enums only — no ALTER on existing tables, no data movement.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent cleanups that came out of merging #325/#329/#326.
1. A fork PR breaks the staging deploy
When #326 (external contributor) was merged, all four
build-pushjobs failed:A
pull_requestevent raised by a PR from a fork gets a read-onlyGITHUB_TOKENand no secrets, regardless of thepermissions:block. The token logs confirm it:pull_requestfrom forkContents: read,Packages: read,Secret source: Noneworkflow_dispatchContents: write,Packages: write,Secret source: ActionsThe images were never published and
post-deploywas skipped, so thereleasebranch stayed out of sync withstaginguntil the deploy was re-run manually.pull_request_targetruns in the base-repo context with a read/write token and keepsgithub.event.pull_request.labels, so the existingreleaselabel gate is unchanged.The usual
pull_request_targethazard — running untrusted PR-head code with a privileged token — does not apply here: both checkouts in the workflow pinref: staging, never the PR head, and the job only runs once the PR is already merged. The reasoning is left as a comment in the YAML so it does not get "fixed" back.2. Orphaned mainnet overlay
k8s/apps/middleman-workflows/overlays/mainnet/was last written by the release automation in v0.11.2 (2026-05-18) and has been frozen at that image tag through six releases.deploy-production.ymlno longer references it. Real deployments come from pnf-ops (middleman side) and thedocker-compose/example (operator side).Its only remaining effect was to read as authoritative production config while declaring
NODE_ENV=developmentandLOG_LEVEL=debuginherited from base — neither of which is true of any real environment.Tilt is unaffected: every
k8s/apps/*/Tiltfilebuilds./overlays/dev. Verified all four dev overlays stillkubectl kustomizeclean after the deletion.