Skip to content

1.0-24 — Deploy review webhook

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Aug 20:23
· 21 commits to master since this release
1.0-24
848e0f0

Deploy review webhook at deploy start

Notifies an external service the moment a deploy starts — the same moment as the 🛫 Telegram message
— so a release can be analysed while it is still being rolled out. The analysis on the receiving side
takes ~10 minutes, which is why the call happens at takeoff rather than after the rollout.

Disabled by default. Nothing changes on an existing installation until DEPLOY_REVIEW_ENABLED=true
is set, and no other behaviour was modified in this release.

The notification

POST <DEPLOY_REVIEW_URL>
Authorization: Bearer <DEPLOY_REVIEW_TOKEN>
Content-Type: application/json

{"project":"payneteasy/paynet","app":"ams2-paynet-proc","instance":"AMS-2",
 "old_version":"3.36.16-117","new_version":"3.36.16-118","deployed_at":"2026-08-11T15:07:39Z"}

deployed_at is stamped when the notification is enqueued, so a retry or a replay after a restart
still reports the real deploy moment rather than the time of the retry.

Configuration

A new independent config interface, shown (with the token masked) on the dashboard Config screen:

Env var Default Meaning
DEPLOY_REVIEW_ENABLED false Enable the deploy-start webhook.
DEPLOY_REVIEW_URL "" Endpoint the notification is posted to.
DEPLOY_REVIEW_TOKEN "" Bearer token (secret).
DEPLOY_REVIEW_TIMEOUT_MS 20000 Connect/read timeout (ms).

Enabling the webhook without a URL fails fast at startup instead of silently doing nothing. The token
is read from the environment only — it is never logged and never written to the spool.

New alias fields

project, app and instance name the deployed thing for the receiving service (gitlabProjectId
is a numeric id, and there was no notion of an instance before). They are three new optional fields
in the alias diff: block:

diff:
  enabled: true
  versionUrl: http://ams2-app:8080/version
  gitlabProjectId: 114
  agent: ams2-app
  newVersionArg: 1
  project: payneteasy/paynet     # new — GitLab project path
  app: ams2-paynet-proc          # new — optional, defaults to the alias name
  instance: AMS-2                # new — target instance

The webhook reuses the versions the diff: block already resolves, so it is sent only for aliases
with diff.enabled: true that set project and instance; anything else is skipped with a log line.
The plain ?command=run path never reads the old version, so it sends nothing.

Delivery

A third durable spool alongside redmine and telegram:

  • the request body is written to QUEUE_DIR/deploy-review before the call, removed after success, and
    replayed on restart, so a notification survives a crash or an unreachable receiver;
  • delivery is at-least-once, which is safe because the receiver dedupes by version;
  • 5xx and network failures are retried with backoff, then dead-lettered; 4xx answers (bad token,
    bad version format) are dead-lettered immediately rather than burning ten attempts on a rejection
    that cannot succeed;
  • visible as queue="deploy-review" in the Prometheus queue metrics and as a row on the dashboard
    Delivery card;
  • enqueueing cannot abort a deploy — any failure there is logged and the rollout continues.

Docs

Upgrading

Drop in the new deploy-server-1.0-24.jar; no configuration change is required. To switch the
webhook on: set the four DEPLOY_REVIEW_* variables and add project / instance to the aliases
that should report. The agent jar is unchanged in behaviour and can be upgraded independently.

Assets 4
Loading