Repository navigation
Restore automatic DigitalOcean backend deployments from release - #792
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pushing
releasenow builds that exact backend commit and deploys it to both DigitalOcean nodes, secondary first. The coordinator drains each node, verifies database/cache/authenticated API readiness, restores traffic, and rolls back application images if verification fails.Deployment credentials are confined to a release-only GitHub environment and root-owned server files. The build job has no deployment secrets; the Docker context uses an explicit allowlist and tests credential-file exclusion. Dedicated SSH keys use pinned hosts and restricted commands. Database migrations require an explicit backward-compatibility declaration and a private, checksum-verified Spaces backup; database downgrades are never automatic.
Validation: 18 failure/rollback/command-guard tests pass; a fresh image passed dependency, import, and authenticated production-read checks in an isolated container; both live nodes and shared cache passed checks. Gitleaks and known-production-secret comparison found no secrets in the staged changes. The first automatic release rollout succeeded: https://github.com/openagents-org/openagents/actions/runs/38795967937. Both nodes run release commit 04858a5, authenticated/cache/public checks passed, and all 177 public readiness probes returned 200. The 938 MB preflight database backup was uploaded to Spaces, downloaded and SHA-256 verified, with anonymous access denied. The Actions run logs also passed Gitleaks.