ci: gate deploy on checks + caching, timeouts, shared setup-vp action#12
Merged
wormeyman merged 1 commit intoJun 29, 2026
Merged
Conversation
…ction Automation hardening after the Vite+ migration: - Gate deploys on green checks. deploy.yml previously ran in parallel with CI on the same push, so a merge that broke tests or the type-gate could still ship. Merge both into ci.yml: a `deploy` job with `needs: checks` that runs only on push to the deploy branch (or a manual dispatch with the deploy input), never on pull requests. The deploy job no longer re-lints - checks already gates lint/test/gate. - Add an npm download cache (~/.npm, keyed on the lockfiles) so CI and deploy stop re-fetching every dependency each run; the old setup-node cache: npm was lost in the migration. - Install worker deps with `npm ci` (packages/worker has its own lockfile) so the Cloudflare deploy uses the project's locked wrangler instead of letting the action install a floating wrangler@4 each run. - Add job timeouts (10m checks, 15m deploy) and workflow-level concurrency with cancel-in-progress so superseded PR pushes and branch pushes don't pile up. - Factor the pinned, checksum-verified vp install into a shared composite action (.github/actions/setup-vp) - one source of truth for the vp version and installer checksum instead of duplicating across two workflows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K7yKKMZne7uzgxPw2RUkUG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automation hardening follow-up to the Vite+ migration (#11). No app code changes - workflows only.
Why
After #11,
ci.ymlanddeploy.ymlboth triggered on push towormeyman-space-age-supportand ran in parallel. Deploy only ran its own lint + build (not tests or the type-gate) and didn't wait for CI - so a merge that broke tests could still ship to Cloudflare.What changed
deploy.ymlintoci.ymlas adeployjob withneeds: checks. It runs only on push to the deploy branch, or a manualworkflow_dispatchwith the newdeployinput set - never on pull requests. Removed the now-redundant lint step from deploy (checks gates it).~/.npm, keyed on the root + worker lockfiles). The oldsetup-nodecache: npmwas lost in the migration, so every run was re-fetching all deps.npm ci.packages/workerhas its own lockfile; installing it means the deploy uses the project's locked wrangler instead of the action installing a floatingwrangler@4each run.package.jsonkeeps^4.75.0.concurrencywith cancel-in-progress so superseded PR/branch pushes don't pile up (ci had none before; preserves deploy.yml's cancel-on-newer-push intent).setup-vpcomposite action (.github/actions/setup-vp) - one source of truth for the pinned vp version + installer checksum, used by both jobs, instead of duplicating the install block.Verification
YAML validates and the worker
npm ciis lockfile-clean locally. The gating logic, thedeployinput, and the composite action can only be fully exercised on this PR's CI run + the next merge deploy. Thechecksjob behavior is unchanged from #11 (already proven green).Note
The deploy is now the
CI / Deploy to Cloudflarejob rather than a standaloneDeploy to Cloudflareworkflow. If any branch-protection required-status-check referenced the old workflow name, it'd need updating (didn't appear to block #11's merge).🤖 Generated with Claude Code
https://claude.ai/code/session_01K7yKKMZne7uzgxPw2RUkUG