Skip to content

TT-17787: add workflow to promote the production tag #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
olamilekan000 merged 2 commits into from
Jul 22, 2026
Merged

TT-17787: add workflow to promote the production tag #145

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
133c905
TT-17787: add workflow to promote the production tag
olamilekan000 Jul 22, 2026
a73ec38
TT-17787: pin runner to ubuntu-24.04, document read-only permissions
olamilekan000 Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions .github/workflows/promote-production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: Promote production tag

on:
workflow_dispatch:

concurrency:
group: promote-production
cancel-in-progress: false

# GITHUB_TOKEN stays read-only on purpose: the tag push authenticates with the
# app token below, which is on the ruleset bypass list. contents: write here
# would neither help nor be used.
permissions:
contents: read

jobs:
promote:
runs-on: ubuntu-24.04
steps:
- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
with:
app-id: ${{ secrets.PROBE_APP_ID }}
private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}

- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
with:
fetch-depth: 0
Comment thread
rafalgolarz marked this conversation as resolved.
fetch-tags: true
token: ${{ steps.app-token.outputs.token }}

- name: Promote production to main

Check warning on line 34 in .github/workflows/promote-production.yml

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The workflow fetches the entire git history using `fetch-depth: 0`. This is unnecessary for the operations performed and can significantly increase checkout time, network usage, and disk consumption on the runner, especially for repositories with a long history.
Raw output 
To optimize performance, fetch only the required data. This can be achieved by performing a shallow checkout of the `main` branch (the default for `actions/checkout`) and then explicitly fetching the `production` tag in a separate step. Replace the existing 'Checkout' step (lines 29-34) with the following two steps:

```yaml
      - name: Checkout main branch
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Fetch production tag
        run: git fetch origin tag production --no-tags || true
```

This change ensures that only the HEAD of `main` and the specific `production` tag are fetched, making the workflow more efficient.
run: |
set -euo pipefail
OLD=$(git rev-parse production^{commit} 2>/dev/null || echo "none")
NEW=$(git rev-parse origin/main)

Check warning on line 39 in .github/workflows/promote-production.yml

View check run for this annotation

probelabs / Visor: architecture

architecture Issue 

The workflow hardcodes `origin/main` as the source for promotion. This lacks flexibility if the main development branch name changes or if promotions from other branches are needed in the future.
Raw output 
To improve extensibility and align with GitHub Actions best practices, use the `github.ref_name` context variable to dynamically refer to the branch the workflow is running on. Since this is a `workflow_dispatch` on the default branch, `github.ref_name` will resolve to `main`. This change makes the workflow more resilient to future branch renaming (e.g., `main` to `trunk`) without requiring code changes.

Replace `origin/main` with `${{ github.ref_name }}`.
if [ "$OLD" = "$NEW" ]; then
echo "production already points at main ($NEW), nothing to do"
echo "## :white_check_mark: production already up to date (\`$NEW\`)" >> "$GITHUB_STEP_SUMMARY"
exit 0

Check warning on line 43 in .github/workflows/promote-production.yml

View check run for this annotation

probelabs / Visor: quality

architecture Issue 

The workflow hardcodes the `main` branch name when determining the new commit for the `production` tag. If the repository's default branch is ever renamed, this workflow will fail or promote an outdated branch if an old `main` branch still exists.
Raw output 
To improve resilience and future-proof the workflow, use the `github.event.repository.default_branch` context variable to dynamically refer to the repository's default branch. This ensures the workflow continues to function correctly even if the default branch is renamed.
fi

git tag -f production "$NEW"
git push -f origin refs/tags/production

echo "promoted production: $OLD -> $NEW (by ${{ github.actor }})"
{
echo "## :rocket: production tag promoted"
echo ""
echo "| | commit |"
echo "|---|---|"
echo "| from | \`$OLD\` |"
echo "| to | \`$NEW\` |"
echo ""
echo "Promoted by @${{ github.actor }}. All \`@production\` consumers now use this commit."
} >> "$GITHUB_STEP_SUMMARY"
Loading