Repository navigation
docs(agris): name an issue in every pull request, reproduce before fixing, and free the demo for testing - #43
Merged
Conversation
|
Hebilicious
force-pushed
the
docs/workflow-followups
branch
2 times, most recently
from
October 14, 2026 07:31
17714ca to
62000b2
Compare
…xing, and free the demo for testing Adds to the Workflow section: every pull request names its issue (Closes #N, enforced by the new issue-link check and a pull request template), a bug or security finding is reproduced before it is fixed, and how to handle the catalog identity and Fig 1 in a stack. The maintainer's demo and docs stages are disposable: deploying them and sending bounded test traffic need no separate ask. Closes #22
Hebilicious
force-pushed
the
docs/workflow-followups
branch
from
October 14, 2026 09:09
62000b2 to
4bbc378
Compare
1 of 2 tasks
Hebilicious
added a commit
that referenced
this pull request
Oct 14, 2026
… changes them (#50) Closes #49 ## What changed - **`.github/workflows/check.yml`:** adds a `deploy` job. It runs after `check` passes, on a push to `main` or a manual run. It asks moon which tasks the push affects (`moon query affected` from `github.event.before` to the pushed commit), then deploys: - the **demo** when `infra:demo-deploy` is affected; - the **docs** when `website:build` or `infra:docs-deploy` is affected, building the site first; - nothing when neither is affected. A manual run, or a push with no usable base, deploys both. The job uses the `cloudflare` environment and runs one deploy at a time without cancelling one in progress. It fails with a clear error if a credential is missing. - **`infra/moon.yml`:** `infra:demo-deploy` declares the runtime code the demo's Workers are built from as its `inputs`, and `infra:docs-deploy` declares its stack files. These lists are the only path rules: the workflow keeps none of its own. - **`AGENTS.md`, `docs/deploy.md`:** say that CI redeploys the maintainer's stages, and which token permissions it needs. Two traps the workflow avoids, both checked locally: - With `CI=true`, moon silently skips a `runInCI: "skip"` task, so the deploy steps run the same `alchemy deploy … --stage demo|docs --yes` commands directly. The tasks keep `runInCI: "skip"`, so a stray `moon ci` never deploys. - Without a terminal, `moon query affected` waits to read changed files from stdin and hangs, so the workflow closes stdin (`< /dev/null`). ## How it was reproduced Not a bug. To check the path rules, I replayed the job's decision with this branch's moon inputs over the last 16 merges to `main`: ``` demo docs 31f1281 fix(market-worker): limit the Pearl Abyss rate per region, not for the whole deployment (#48 - - 8988949 docs(agris): name an issue in every pull request, reproduce before fixing, and free the demo - docs 76c2457 docs: correct the search, limit and namespace claims, and Fig 1's search pigeonhole (#36) demo docs f76218d fix(gateway-worker): serve GraphiQL under a strict CSP, and send nosniff and no referrer eve demo docs aaabc17 feat(infra)!: limit each client of a self-hosted gateway to 60 requests a minute by default demo docs af0118d fix(gateway-worker): admit each client's market reads exactly, and every request through the demo docs 92720e0 fix(market-worker): hold one Pearl Abyss rate allowance for the whole deployment (#32) demo docs 98d50ea fix(market-worker): bound the Pearl Abyss coordinator's queue and let one caller's abort end demo docs 5672fee fix(market-subgraph)!: hold Market.items to the 100-item batch cap and require Market.catalo demo docs 3677cbb fix(market-worker): report Pearl Abyss throttling as 429 and budget refusals as QUERY_BUDGET demo docs 3dd2aee fix: mask market and catalog errors to a closed set, and keep originals out of the gateway's demo docs 139323a chore: add a security policy, a minimum release age and a pinned, checksummed proto installe - docs 28b17a8 fix(website): render Fig 1's hotspots as Astro markup and escape its JSON blocks (#26) - docs 526a3b9 feat(website): send security headers from the docs site (#25) demo docs aa2f4a5 fix(pearl-abyss): cap the Huffman decoder's declared output at 8 MiB (#41) - - ab3e94f docs(agris): fast-forward the main checkout to origin/main after every merge (#46) ``` Website-only merges (#25, #26, #36) deploy only the docs. Process-only merges (#43, #46) deploy nothing. Runtime merges deploy both, because the site renders runtime facts (cache windows, limits) through `@group(agris-sources)`. This PR changes neither stage's inputs, so merging it deploys nothing. The deploy itself is first exercised by a manual run once `CLOUDFLARE_API_TOKEN` is set (see below). ## Credentials - **Done:** the `cloudflare` environment exists, only `main` may deploy to it, and it holds `CLOUDFLARE_ACCOUNT_ID`. - **Missing:** `CLOUDFLARE_API_TOKEN`. The local OAuth sign-ins (Alchemy and Wrangler) are refused by Cloudflare's token endpoints (`9109 Unauthorized`), and Alchemy's own token command needs the account's Global API Key. The token has to be created in the dashboard with Workers Scripts edit, Account Settings read and Secrets Store edit. ## Checks - [x] `moon run agris:check` passes on this branch - [ ] In a stack, this pull request holds one concern and its own layer passes `agris:check` (not a stack)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #22
Replaces #23, which GitHub closed when
mainwas force-pushed. #38 has since merged and covers most of #23 (worktrees, one pull request or stack per task, review, squash merges, thegh-stackskill), so this carries only what #38 lacks.What changed
Closes #N/Refs #N), with one pull request per issue unless the code can't be separated;demostage;demoanddocsstages are disposable, so deploying or redeploying them and sending them bounded test traffic need no separate ask. Real application load still doesn't belong on the demo, and a fork never deploys them..github/workflows/pr-issue-link.yml(jobissue-link): fails a pull request whose body names no issue. The body is read through an environment variable and never interpolated into the script. Also.github/pull_request_template.md.How it was reproduced
This is a process change, not a bug fix. The trigger was the security-audit remediation (#21): I first built it on one branch and split it afterwards, and I invented a "no demo traffic" rule that blocked reproducing D1 and D2.
Not covered here
issue-linkblocks merges only once it is a required status check in themainruleset.