ci: request a dev deploy after publishing - #6
Merged
Conversation
The dev stage of Forge Central pins swarf by image digest, so a deploy meant reading the digest ghcr.io/fil-forge/swarf:main now names and editing infra-central by hand. The publish run already knows that digest. Dispatch a bump-deployed-image event to fil-forge/infra-central from the prod matrix leg, carrying the digest, the commit and the pull request it came from. The receiver there opens a pull request pinning the digest with auto-merge enabled, and infra-central's "Check and deploy" runs tofu apply on dev/apps on every push to its main, so merging it is what deploys. Only the prod-target image is dispatched. The dev stage runs the stripped binary; main-dev carries delve and debugging tools. Refs FIL-1051 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> Assisted-by: Claude
bajtos
force-pushed
the
claude/auto-pick-docker-versions-5tadan
branch
from
August 20, 2026 10:16
fd6647f to
6671c67
Compare
bajtos
added a commit
to fil-forge/hilt
that referenced
this pull request
Aug 20, 2026
The `Deploying to dev` section added in #41 says HCP Terraform applies the dev workspace. infra-central moved off HCP in fil-forge/infra-central#25 — state lives in S3 now, and its `Check and deploy` workflow runs `tofu apply` on `dev/apps` (after `apply-platform`) on every push to `main`. fil-forge/infra-central#33 corrected the same wording on that side. The mechanism this repo relies on is unchanged: merging the receiver's pull request is still what deploys. Only the description was wrong. ### Changes - `README.md`: replace the HCP sentence, and add a `[deploy]` link to `check-and-deploy.yml` next to the existing receiver link. Docs only — no workflow or code changes. ### Context Found while porting #41 to the remaining Forge Central services, where the same sentence had been copied across. Corrected there in the same series: - fil-forge/sprue#71 - fil-forge/swarf#6 - fil-forge/delegator#28 - fil-forge/piri-signing-service#17 - fil-forge/did-method-plc#1 ### Related - Linear: [FIL-1051](https://linear.app/filecoin-foundation/issue/FIL-1051) - Receiver workflow: fil-forge/infra-central#24 --- _Generated by [Claude Code](https://claude.ai/code/session_01E7ZDwvCHKi6441uN3NCCnP)_
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Aug 24, 2026
Published from fil-forge/swarf#6 - Digest: `sha256:8599e69bdff335617f473eca6100d901cb1c6c2aa0adf9e4d072e90e357a2071` - Commit: fil-forge/swarf@d5d1a0a - Publish run: https://github.com/fil-forge/swarf/actions/runs/32491694738 Merging applies [`terraform/envs/dev/apps`](https://github.com/fil-forge/infra-central/tree/main/terraform/envs/dev/apps) with no further confirmation.
fil-forge-bot Bot
added a commit
to fil-forge/infra-central
that referenced
this pull request
Aug 24, 2026
Published from fil-forge/swarf#6 - Digest: `sha256:8599e69bdff335617f473eca6100d901cb1c6c2aa0adf9e4d072e90e357a2071` - Commit: fil-forge/swarf@d5d1a0a - Publish run: https://github.com/fil-forge/swarf/actions/runs/32491694738 Merging applies [`terraform/envs/dev/apps`](https://github.com/fil-forge/infra-central/tree/main/terraform/envs/dev/apps) with no further confirmation. Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dev stage of Forge Central pins swarf by image digest, so deploying a merge
to
mainmeant reading the digestghcr.io/fil-forge/swarf:mainnow names andediting infra-central by hand. The publish run already knows that digest.
The
Containerworkflow now dispatches abump-deployed-imageevent tofil-forge/infra-centralfrom the prod matrix leg, carrying the digest, thecommit and the pull request it came from. The receiver there opens a pull
request pinning the digest with auto-merge enabled, and infra-central's
Check and deploy workflow runs
tofu applyondev/appson everypush to its
main, so merging that pull request is what deploys.Only the prod-target image is dispatched — the dev stage runs the stripped
binary, while
main-devcarries delve and debugging tools.Changes
.github/workflows/publish-ghcr.yml:id: buildon the build step,pull-requests: readfor resolving the source PR, and three new steps on theprod leg — resolve the merged PR URL, mint a
fil-forge-bottoken scoped toinfra-central, and POST the dispatch. The digest is shape-checked before itis sent.
README.md:Container imagesandDeploying to devsections.Requirements
The dispatch runs as the
fil-forge-botGitHub App and needs theFORGE_BOT_APP_IDvariable and theFORGE_BOT_PRIVATE_KEYsecret to beavailable to this repository. Prod pins stay manual.
Related