fix: reapply cli auth device tables with a current-timestamp migration #268
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Preview Destroy | |
| # Destroys the per-PR preview stack when the PR is closed/merged. | |
| # Also supports manual teardown via workflow_dispatch (e.g. to clean up an orphan | |
| # or force-destroy a stack outside normal PR lifecycle). | |
| # | |
| # Uses `pull_request_target` (rather than `pull_request`) so we have secrets | |
| # available for fork-PR closures — fork-PR previews are now deployed via the | |
| # pull_request_target path in preview-deploy.yml, and need to be torn down | |
| # the same way. No approval gate needed on destroy: no fork code is checked | |
| # out (we run our own scripts from main against the stack name), so there's | |
| # nothing untrusted executing with credentials. | |
| on: | |
| pull_request_target: | |
| types: [closed] | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: 'PR number whose preview stack to destroy (e.g. 123 for preview-pr-123)' | |
| type: string | |
| required: true | |
| permissions: | |
| contents: read | |
| id-token: write | |
| pull-requests: write | |
| jobs: | |
| resolve-pr: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| pr_number: ${{ steps.resolve.outputs.pr_number }} | |
| steps: | |
| - name: Resolve PR number | |
| id: resolve | |
| env: | |
| PR_NUMBER_FROM_EVENT: ${{ github.event.pull_request.number }} | |
| PR_NUMBER_FROM_DISPATCH: ${{ inputs.pr_number }} | |
| run: | | |
| if [ -n "$PR_NUMBER_FROM_DISPATCH" ]; then | |
| echo "pr_number=$PR_NUMBER_FROM_DISPATCH" >> $GITHUB_OUTPUT | |
| else | |
| echo "pr_number=$PR_NUMBER_FROM_EVENT" >> $GITHUB_OUTPUT | |
| fi | |
| # No fork gate: destroys are idempotent (drop-preview-db.sh exits | |
| # cleanly if the stack's resources are missing; Pulumi destroy | |
| # likewise no-ops on already-gone resources), and fork-PR previews | |
| # are now real things that need teardown on close. | |
| drop-db: | |
| needs: resolve-pr | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| # Explicit `ref: main` — never run a fork's version of the drop | |
| # script with our deploy creds. (pull_request_target defaults to | |
| # the base ref anyway, but being explicit prevents accidents if | |
| # the trigger is ever changed.) | |
| ref: main | |
| - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} | |
| aws-region: us-east-1 | |
| - name: Drop per-stack database | |
| # Must run before `pulumi destroy` — the per-stack secrets and backend | |
| # task definition disappear with the stack, and we need both to invoke | |
| # the drop. Script is idempotent if the stack is already partially gone. | |
| run: ./scripts/drop-preview-db.sh "${{ needs.resolve-pr.outputs.pr_number }}" | |
| destroy: | |
| needs: [resolve-pr, drop-db] | |
| # Run even if drop-db failed — a flaky DB drop must not orphan the whole | |
| # stack (ECS services, ALB, secrets) and leak cost indefinitely. | |
| if: ${{ always() && needs.resolve-pr.result == 'success' }} | |
| uses: ./.github/workflows/stack-deploy.yml | |
| with: | |
| action: destroy | |
| platform: fargate | |
| region: us-east-1 | |
| stack_name: preview-pr-${{ needs.resolve-pr.outputs.pr_number }} | |
| # inherit passes AWS_DEPLOY_ROLE_ARN, PULUMI_*, GHCR_PAT, CLOUDFLARE_API_TOKEN | |
| secrets: inherit | |
| comment: | |
| needs: [resolve-pr, drop-db, destroy] | |
| if: ${{ always() && needs.resolve-pr.result == 'success' && github.event.pull_request.number }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Update sticky comment to note teardown | |
| uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 | |
| with: | |
| header: preview-env | |
| message: | | |
| **Preview environment destroyed** 🧹 | |
| Stack `preview-pr-${{ needs.resolve-pr.outputs.pr_number }}` and its Cloudflare subdomain have been cleaned up. |