From 8bbe2016d9f1258acb3765666771ea8ac43a0b47 Mon Sep 17 00:00:00 2001 From: kzoeps Date: Thu, 12 Nov 2026 15:47:52 +0600 Subject: [PATCH 1/3] ci: deploy HappyView modules on production push --- .github/workflows/deploy-production.yml | 42 +++++++++++++++++++++++++ happyview-modules/README.md | 10 ++++++ 2 files changed, 52 insertions(+) create mode 100644 .github/workflows/deploy-production.yml diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml new file mode 100644 index 0000000..b1047fb --- /dev/null +++ b/.github/workflows/deploy-production.yml @@ -0,0 +1,42 @@ +name: Deploy production + +on: + push: + branches: [production] + +permissions: + contents: read + +concurrency: + group: deploy-production + cancel-in-progress: false + +jobs: + deploy: + name: Install HappyView modules + runs-on: ubuntu-latest + environment: production + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up pnpm + uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 + + - name: Set up Node.js + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version-file: .nvmrc + cache: pnpm + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Install API modules into HappyView + env: + HAPPYVIEW_BASE_URL: ${{ vars.HAPPYVIEW_BASE_URL }} + HAPPYVIEW_ADMIN_TOKEN: ${{ secrets.HAPPYVIEW_ADMIN_TOKEN }} + HYPERCERTS_HANDLE_RESOLVER_URL: ${{ vars.HYPERCERTS_HANDLE_RESOLVER_URL }} + run: pnpm --filter @hypercerts-org/happyview-modules install:api diff --git a/happyview-modules/README.md b/happyview-modules/README.md index 81de3da..99cc100 100644 --- a/happyview-modules/README.md +++ b/happyview-modules/README.md @@ -53,3 +53,13 @@ pnpm install:api ``` For bundles that register `app.certified.actor.getProfile`, handle lookups require `HYPERCERTS_HANDLE_RESOLVER_URL` to be an HTTPS origin without credentials, path, query, or fragment. Interactive installs prompt when it is absent; noninteractive installs must set it. The admin token needs `script-variables:read`, and `script-variables:create` if the installer must create the setting. Existing settings are retained; HappyView exposes only a masked preview, so the installer cannot verify the configured value. See [CONTRIBUTING.md](../CONTRIBUTING.md) for release-note requirements and installer safety details. + +## Production deploy + +Pushing to the `production` branch runs [`.github/workflows/deploy-production.yml`](../.github/workflows/deploy-production.yml), which installs this bundle into the production HappyView with `pnpm install:api` (no `--override`, so asset conflicts stop the deploy). The workflow uses the `production` GitHub environment, which must define: + +- variable `HAPPYVIEW_BASE_URL`: the production HappyView origin +- secret `HAPPYVIEW_ADMIN_TOKEN`: a scoped admin token, including `script-variables:read` +- variable `HYPERCERTS_HANDLE_RESOLVER_URL`: needed only if HappyView does not already have this setting; the token then also needs `script-variables:create` + +Deploys run one at a time and are never cancelled midway. From 2235afb78c87700c43f28036e0dc0747fe3f23fc Mon Sep 17 00:00:00 2001 From: kzoeps Date: Thu, 12 Nov 2026 17:02:54 +0600 Subject: [PATCH 2/3] ci: deploy HappyView modules to staging on staging push One workflow maps the staging and production branches to the GitHub environment of the same name, with a separate concurrency group each. --- .../workflows/{deploy-production.yml => deploy.yml} | 11 ++++++----- happyview-modules/README.md | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) rename .github/workflows/{deploy-production.yml => deploy.yml} (79%) diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy.yml similarity index 79% rename from .github/workflows/deploy-production.yml rename to .github/workflows/deploy.yml index b1047fb..a9f3729 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy.yml @@ -1,21 +1,22 @@ -name: Deploy production +name: Deploy on: push: - branches: [production] + # Each branch deploys to the GitHub environment with the same name. + branches: [staging, production] permissions: contents: read concurrency: - group: deploy-production + group: deploy-${{ github.ref_name }} cancel-in-progress: false jobs: deploy: - name: Install HappyView modules + name: Install HappyView modules (${{ github.ref_name }}) runs-on: ubuntu-latest - environment: production + environment: ${{ github.ref_name }} steps: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/happyview-modules/README.md b/happyview-modules/README.md index 99cc100..d102f7b 100644 --- a/happyview-modules/README.md +++ b/happyview-modules/README.md @@ -54,12 +54,12 @@ pnpm install:api For bundles that register `app.certified.actor.getProfile`, handle lookups require `HYPERCERTS_HANDLE_RESOLVER_URL` to be an HTTPS origin without credentials, path, query, or fragment. Interactive installs prompt when it is absent; noninteractive installs must set it. The admin token needs `script-variables:read`, and `script-variables:create` if the installer must create the setting. Existing settings are retained; HappyView exposes only a masked preview, so the installer cannot verify the configured value. See [CONTRIBUTING.md](../CONTRIBUTING.md) for release-note requirements and installer safety details. -## Production deploy +## Deploys -Pushing to the `production` branch runs [`.github/workflows/deploy-production.yml`](../.github/workflows/deploy-production.yml), which installs this bundle into the production HappyView with `pnpm install:api` (no `--override`, so asset conflicts stop the deploy). The workflow uses the `production` GitHub environment, which must define: +Pushing to the `staging` or `production` branch runs [`.github/workflows/deploy.yml`](../.github/workflows/deploy.yml), which installs this bundle into that environment's HappyView with `pnpm install:api` (no `--override`, so asset conflicts stop the deploy). Each branch uses the GitHub environment of the same name (`staging` or `production`), and each environment must define its own values; never reuse the production token for staging: -- variable `HAPPYVIEW_BASE_URL`: the production HappyView origin -- secret `HAPPYVIEW_ADMIN_TOKEN`: a scoped admin token, including `script-variables:read` -- variable `HYPERCERTS_HANDLE_RESOLVER_URL`: needed only if HappyView does not already have this setting; the token then also needs `script-variables:create` +- variable `HAPPYVIEW_BASE_URL`: that environment's HappyView origin +- secret `HAPPYVIEW_ADMIN_TOKEN`: a scoped admin token for that HappyView, including `script-variables:read` +- variable `HYPERCERTS_HANDLE_RESOLVER_URL`: needed only if that HappyView does not already have this setting; the token then also needs `script-variables:create` -Deploys run one at a time and are never cancelled midway. +Deploys to each environment run one at a time and are never cancelled midway; staging and production deploys do not block each other. From c0e44103f51c137f5f0a1524c19a4aa6fb90bc89 Mon Sep 17 00:00:00 2001 From: kzoeps Date: Thu, 12 Nov 2026 17:05:02 +0600 Subject: [PATCH 3/3] ci: replace differing HappyView assets on deploy Without --override any change to an installed module stops the deploy. The deploy branches are merged on purpose, so the repo is authoritative. --- .github/workflows/deploy.yml | 3 ++- happyview-modules/README.md | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index a9f3729..36500f7 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -40,4 +40,5 @@ jobs: HAPPYVIEW_BASE_URL: ${{ vars.HAPPYVIEW_BASE_URL }} HAPPYVIEW_ADMIN_TOKEN: ${{ secrets.HAPPYVIEW_ADMIN_TOKEN }} HYPERCERTS_HANDLE_RESOLVER_URL: ${{ vars.HYPERCERTS_HANDLE_RESOLVER_URL }} - run: pnpm --filter @hypercerts-org/happyview-modules install:api + # The repo is the source of truth: replace any differing installed assets. + run: pnpm --filter @hypercerts-org/happyview-modules install:api --override diff --git a/happyview-modules/README.md b/happyview-modules/README.md index d102f7b..16d3dd3 100644 --- a/happyview-modules/README.md +++ b/happyview-modules/README.md @@ -56,7 +56,7 @@ For bundles that register `app.certified.actor.getProfile`, handle lookups requi ## Deploys -Pushing to the `staging` or `production` branch runs [`.github/workflows/deploy.yml`](../.github/workflows/deploy.yml), which installs this bundle into that environment's HappyView with `pnpm install:api` (no `--override`, so asset conflicts stop the deploy). Each branch uses the GitHub environment of the same name (`staging` or `production`), and each environment must define its own values; never reuse the production token for staging: +Pushing to the `staging` or `production` branch runs [`.github/workflows/deploy.yml`](../.github/workflows/deploy.yml), which installs this bundle into that environment's HappyView with `pnpm install:api --override`, so assets that differ from this repository are replaced (the repository is the source of truth). Each branch uses the GitHub environment of the same name (`staging` or `production`), and each environment must define its own values; never reuse the production token for staging: - variable `HAPPYVIEW_BASE_URL`: that environment's HappyView origin - secret `HAPPYVIEW_ADMIN_TOKEN`: a scoped admin token for that HappyView, including `script-variables:read`