fix(ci): harden auto-merge, add build validation, and post-deploy smoke test - #4433
fix(ci): harden auto-merge, add build validation, and post-deploy smoke test#4433cmcarthur wants to merge 9 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
lgtm!
Will this propagate to datadog or anywhere else that someone will notice? What's the alerting strategy once a failure happens? |
no, today, it won't. we have other monitoring in datadog that will ensure we notice this right away. but this is not wired up to anything yet. when you get a chance, can you approve on behalf of DX team? I need the approval to merge |
|
|
||
| jobs: | ||
| autolabel: | ||
| if: github.actor == 'FishtownBuildBot' |
There was a problem hiding this comment.
So, the way Hubcap is currently set up, I think that the actor ID on the PR is technically the user associated with the token (which is me currently). Which is obviously its own issue :) but until that gets reworked, I think this will block Hubcap PRs from getting merged. Based on Snowflake it looks like FishtownBuildBot is the associated user ID but not the actor ID - is that a field that can be used here instead?
There was a problem hiding this comment.
I think this will work withgithub.event.pull_request.user.login instead of github.actor
3 participants
Summary
This repo serves the production API backing
dbt deps. Three safety changes:Restrict auto-merge to hubcap only: Added
if: github.actor == 'FishtownBuildBot'to bothautolabelandautomergejobs. Verified across 810 historical workflow runs thatFishtownBuildBotis the only actor that should auto-merge. Previously, any org member who opened a PR touchingdata/packages/would have it auto-labeled and auto-merged to master → production.Add required build validation (new
validate.yml): Runs on all PRs and pushes to master. Builds the site, validatespackages.jsonis valid JSON with 100+ packages, and spot-checks 20 individual package JSON files for required fields (name,namespace,versions). Should be configured as a required status check via branch protection after merge.Add post-deploy smoke test: After S3 upload and CloudFront invalidation, curls the live API and verifies valid JSON response with 100+ packages. Makes failed deploys visible in GitHub Actions.
Test plan
Validate buildworkflow runs and passes on this PRValidate buildas a required status check onmastervia branch protection settings🤖 Generated with Claude Code