Cache JWKS across isolates and serve stale keys on refresh failure (#… #202
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: deploy-production | |
| cancel-in-progress: false | |
| jobs: | |
| migrate: | |
| name: Migrate database | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| environment: production | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Cache Bun package cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun-1.3.11- | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Run migrations | |
| run: bun run scripts/migrate.ts --bucket executor-cloud-blobs | |
| working-directory: apps/cloud | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| deploy-cloud: | |
| name: Deploy cloud | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| environment: production | |
| needs: migrate | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Cache Bun package cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun-1.3.11- | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build cloud | |
| run: bun run --cwd apps/cloud build | |
| env: | |
| VITE_PUBLIC_SENTRY_DSN: ${{ secrets.VITE_PUBLIC_SENTRY_DSN }} | |
| - name: Deploy cloud | |
| run: bun run wrangler deploy -c dist/server/wrangler.json --var GIT_COMMIT_SHA:${{ github.sha }} | |
| working-directory: apps/cloud | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| # Deploy marker: one event per deploy into the same Axiom dataset the | |
| # worker traces land in, so a latency step-change lines up with its | |
| # deploy in one query. Skipped (not failed) when the secret is absent, | |
| # and never blocks the deploy. | |
| - name: Record deploy marker in Axiom | |
| env: | |
| AXIOM_INGEST_TOKEN: ${{ secrets.AXIOM_INGEST_TOKEN }} | |
| run: | | |
| if [ -z "$AXIOM_INGEST_TOKEN" ]; then | |
| echo "AXIOM_INGEST_TOKEN not configured; skipping deploy marker" | |
| exit 0 | |
| fi | |
| curl -sf -X POST "https://api.axiom.co/v1/datasets/executor-cloud/ingest" \ | |
| -H "Authorization: Bearer $AXIOM_INGEST_TOKEN" \ | |
| -H "Content-Type: application/json" \ | |
| -d "[{\"event\":\"deploy\",\"service\":\"executor-cloud\",\"commit_sha\":\"${{ github.sha }}\",\"actor\":\"${{ github.actor }}\",\"run_id\":\"${{ github.run_id }}\"}]" \ | |
| || echo "deploy marker ingest failed (non-blocking)" | |
| deploy-marketing: | |
| name: Deploy marketing | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| environment: production | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Cache Bun package cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-1.3.11-${{ hashFiles('bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun-1.3.11- | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build marketing | |
| run: bun run --cwd apps/marketing build | |
| - name: Deploy marketing | |
| run: bun run wrangler deploy --config dist/server/wrangler.json | |
| working-directory: apps/marketing | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |