Skip to content

fix: reapply cli auth device tables with a current-timestamp migration #268

fix: reapply cli auth device tables with a current-timestamp migration

fix: reapply cli auth device tables with a current-timestamp migration #268

Workflow file for this run

name: Preview Destroy
# Destroys the per-PR preview stack when the PR is closed/merged.
# Also supports manual teardown via workflow_dispatch (e.g. to clean up an orphan
# or force-destroy a stack outside normal PR lifecycle).
#
# Uses `pull_request_target` (rather than `pull_request`) so we have secrets
# available for fork-PR closures — fork-PR previews are now deployed via the
# pull_request_target path in preview-deploy.yml, and need to be torn down
# the same way. No approval gate needed on destroy: no fork code is checked
# out (we run our own scripts from main against the stack name), so there's
# nothing untrusted executing with credentials.
on:
pull_request_target:
types: [closed]
branches: [main]
workflow_dispatch:
inputs:
pr_number:
description: 'PR number whose preview stack to destroy (e.g. 123 for preview-pr-123)'
type: string
required: true
permissions:
contents: read
id-token: write
pull-requests: write
jobs:
resolve-pr:
runs-on: ubuntu-latest
outputs:
pr_number: ${{ steps.resolve.outputs.pr_number }}
steps:
- name: Resolve PR number
id: resolve
env:
PR_NUMBER_FROM_EVENT: ${{ github.event.pull_request.number }}
PR_NUMBER_FROM_DISPATCH: ${{ inputs.pr_number }}
run: |
if [ -n "$PR_NUMBER_FROM_DISPATCH" ]; then
echo "pr_number=$PR_NUMBER_FROM_DISPATCH" >> $GITHUB_OUTPUT
else
echo "pr_number=$PR_NUMBER_FROM_EVENT" >> $GITHUB_OUTPUT
fi
# No fork gate: destroys are idempotent (drop-preview-db.sh exits
# cleanly if the stack's resources are missing; Pulumi destroy
# likewise no-ops on already-gone resources), and fork-PR previews
# are now real things that need teardown on close.
drop-db:
needs: resolve-pr
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
# Explicit `ref: main` — never run a fork's version of the drop
# script with our deploy creds. (pull_request_target defaults to
# the base ref anyway, but being explicit prevents accidents if
# the trigger is ever changed.)
ref: main
- uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
with:
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
aws-region: us-east-1
- name: Drop per-stack database
# Must run before `pulumi destroy` — the per-stack secrets and backend
# task definition disappear with the stack, and we need both to invoke
# the drop. Script is idempotent if the stack is already partially gone.
run: ./scripts/drop-preview-db.sh "${{ needs.resolve-pr.outputs.pr_number }}"
destroy:
needs: [resolve-pr, drop-db]
# Run even if drop-db failed — a flaky DB drop must not orphan the whole
# stack (ECS services, ALB, secrets) and leak cost indefinitely.
if: ${{ always() && needs.resolve-pr.result == 'success' }}
uses: ./.github/workflows/stack-deploy.yml
with:
action: destroy
platform: fargate
region: us-east-1
stack_name: preview-pr-${{ needs.resolve-pr.outputs.pr_number }}
# inherit passes AWS_DEPLOY_ROLE_ARN, PULUMI_*, GHCR_PAT, CLOUDFLARE_API_TOKEN
secrets: inherit
comment:
needs: [resolve-pr, drop-db, destroy]
if: ${{ always() && needs.resolve-pr.result == 'success' && github.event.pull_request.number }}
runs-on: ubuntu-latest
steps:
- name: Update sticky comment to note teardown
uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
with:
header: preview-env
message: |
**Preview environment destroyed** 🧹
Stack `preview-pr-${{ needs.resolve-pr.outputs.pr_number }}` and its Cloudflare subdomain have been cleaned up.