Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create command for deploying with heroku pipeline plugin #54

Closed
1 of 6 tasks
patcon opened this issue May 13, 2014 · 0 comments
Closed
1 of 6 tasks

Create command for deploying with heroku pipeline plugin #54

patcon opened this issue May 13, 2014 · 0 comments

Comments

@patcon
Copy link
Contributor

patcon commented May 13, 2014

Thinking we can do this without access control, in all honesty. This command would only deploy things to roobot-prod heroku app that are already on roobot-test. And things only get to roobot-test if they're tagged commits on "master", as that's all the travis is told to deploy.

Thinking this would pair nicely with a custom heroku buildpack that allowed us to use an envvar to set keybase.io users who must sign the tag in order for it to compile and deploy.

So basically, here's the pieces:

  • set up travis to only deploy tagged commits on master to heroku
  • custom heroku buildpack that expects something like this: HEROKU_BUILDPACK_SIGS=whit537,patcon,seanlinsley,<etc>
  • enable heroku labs:enable user-env-compile (See: https://discussion.heroku.com/t/passing-environment-variables-to-slug-compiler/75)
  • check the signed tag against keybase.io usernames from envvar, ensuring that it has been signed by an authorized user
  • if everything looks good, deploy to roobot-test (ie. everything on roobot-test is cryptographically guaranteed trusted by us)
  • use a hubot command to deploy a release from roobot-test to roobot-prod

EDIT: Apparently heroku labs:enable user-env-compile is enabled by default now:
http://stackoverflow.com/a/22909608/504018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants