Removes sync-back constraint for manual dispatch - #47
Merged
Conversation
The dev/staging/prod trio was the same pipeline three times, and the drift it hid was real: prod built its image without waiting for lint or tests, staging and prod disagreed on deploy's needs list, and inference's prod migrate keyed its concurrency group on a matrix it does not have. One repo-local build-deploy.yml now holds the graph; the three callers hold the trigger, the concurrency group, the checks the build waits on, the permission ceiling, and the env knobs. migrate/deploy/integration-tests collapse to one matrixed path gated on a has-envs boolean, because an empty matrix concludes the whole run as failed with no failed job in it. Also fixes what the pipelines were saying. Two pushes to staging had concluded startup_failure with zero jobs -- a caller granted no pull-requests scope while a callee declared one, and that cap is enforced when the file loads -- so staging served the previous image for ten hours and nothing alerted, because the notify job is a job inside the run. Prevention is a shared lint gate, detection is a scheduled sweep; the same fix closed an unnoticed prod window. Promotion PRs stop rebuilding images nothing deploys, and a release is one run tree instead of two.
…NG-1053) Replaces `workflow_permissions.py` with `workflow_graph.py` to incorporate additional static checks on workflow graphs, addressing issues with multiple run trees and uncalled reusables. Updates related workflow and test references. Introduces `.gitignore` to exclude common Python and IDE-specific files.
Update README to provide clear guidelines on choosing secret storage locations based on the type of secret, emphasizing security considerations and correcting misconceptions about Kubernetes as the default. Removes redundant compiled Python file.
…orkflow robustness (ENG-1053) Enhances PR environment comment workflow by removing sensitive details, promoting security by linking to protected documentation, and refines permission declarations to prevent runtime failures. Updates README and test cases to reflect these changes, ensuring clarity and consistency. These improvements address previous detection gaps and enhance auditability for pull request-based operations.
…ments (ENG-1053) Introduces a new input option to customize the heading text in PR environment comments, accommodating varied use cases such as installer artifacts. Simplifies message consistency by updating the subtext. These changes provide greater flexibility and clearer communication in pull request comments.
…p-failure-watchdog
…1053) Adjusts the grep command to ignore commented lines when checking for secret retrieval commands in scripts, preventing false positives. This ensures that only executable lines accessing secrets are flagged, enhancing the reliability of workflow audits.
…p-failure-watchdog
… (ENG-1053) Adds the capability to indicate when a PR environment is absent, enhancing clarity by explicitly stating its non-existence and providing instructions to create one. This change improves developer experience by preventing confusion when a previously accessible environment becomes unavailable.
Introduces configurable standard links for per-PR environments, ensuring a comprehensive table of services is listed across all comments. Enhances clarity and consistency in PR comments by centralizing service links, reducing redundancy, and preventing misinterpretations about environment scope.
…1053) Adds logic to detect and report retries in the notify-main-failure workflow, ensuring failures that recover on subsequent attempts are correctly identified. Introduces a shared policy for workflow-lint.yml via a reusable zizmor.yml, consolidating audit configurations across repos while allowing per-repo overrides.
…on versions (ENG-1053) Updated actions/checkout to v5 and docker/setup-buildx-action to v4 across various workflow files to maintain compatibility and leverage improvements in new versions.
…NG-1053) Revised advisory reporting in workflow-lint.yml to list rule counts alongside severity, replacing the previous tail-last-40-lines approach. This change improves clarity by presenting readers with an overview of firing rules and their frequencies, aiding in prioritization of issues before examining detailed outputs.
…NG-1053) Adds a top-level `text` field to the Slack payload in notify-main-failure.yml, ensuring critical pipeline failure alerts are accessible via push notifications, screen readers, and previews.
…(ENG-1053) Removed the `permissions:` block to allow dynamic permission inheritance from different caller workflows. This ensures compatibility with both failure-only and recovery-mode workflows, preventing load failures caused by permission mismatches and maintaining functionality across multiple repositories.
…e.yml (ENG-1053) Restores the `permissions:` block in the workflow to define explicit scopes (`contents: read`, `actions: read`) for reliable recovery detection. This adjustment ensures that workflows have the necessary permissions for consistent operation across caller types, addressing previous issues with inheritance and compatibility.
…al dispatch (ENG-1053) Allows manual dispatches to trigger the sync-back step in release unfreeze workflows, overcoming a limitation where failed PR-triggered runs left `staging` unsynced. Ensures that manual recovery processes can properly align `staging` with `main`.
mindsdb-devops
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allows sync-back process to run on manual dispatch:
Relates to ENG-1053