breakaway 1.4.0-main.2 → 1.4.0-main.21

package/src/repos.js

@@ -10,6 +10,8 @@
  * repository, and a prefix to exactly one area, so a work ID means one task across the install.
  */
 import { AREA_NAMES, InputError, PROJECTS } from './model.js';
+import { isPackageName } from './packages.js';
+import { checkSettings } from './specs.js';
 
 /** The slug a task without `repo` falls back to while the registry has no default: nothing is registered, so no task is. */
 export const NO_REPO = 'default';
@@ -114,26 +116,42 @@ function jsonField(value, what) {
 }
 
 const WORKER_NAME = /^[\w.-]{1,100}$/u;
+/** The fields a repository's pipeline has, as `repos modify --pipeline` and Turn on deploys (WEB-13) set it. */
+export const PIPELINE_KEYS = ['workers', 'workflows', 'deployPaths', 'package'];
 const DEPLOY_PATHS_PATH = /^(?!\/)(?!.*\.\.)[\w./-]{1,200}\.json$/u;
 
 /**
- * A repository's deploy pipeline as the owner sets it: the shape `pipelineOf` (release.js) reads, refused with
- * the reason when it would read none. `workers.staging` and `workers.production` are required; `workflows`
- * (deploy, promote, rollback, workflow file names) and `deployPaths` (a JSON file in the repository) are optional.
+ * A repository's deploy pipeline as the owner sets it: the shape `pipelineOf` and `packageOf` (release.js) read,
+ * refused with the reason when they would read none. It needs `workers` (`staging` and `production`, the Workers it
+ * deploys), `package` (the npm package it releases, BRK-103), or both. `workflows` (deploy, promote, rollback, and
+ * release, workflow file names) and `deployPaths` (a JSON file in the repository) are optional.
  */
-function checkPipeline(pipeline) {
+export function checkPipeline(pipeline) {
   if (!pipeline) return null;
-  const known = { workers: ['staging', 'production'], workflows: ['deploy', 'promote', 'rollback'] };
+  const known = { workers: ['staging', 'production'], workflows: ['deploy', 'promote', 'rollback', 'release'] };
   for (const key of Object.keys(pipeline)) {
-    if (!['workers', 'workflows', 'deployPaths'].includes(key))
-      throw new InputError(`pipeline has no "${key.slice(0, 40)}"; it has workers, workflows, and deployPaths`);
+    if (!PIPELINE_KEYS.includes(key))
+      throw new InputError(
+        `pipeline has no "${key.slice(0, 40)}"; it has workers, package, workflows, and deployPaths`,
+      );
   }
   const out = {};
+  const hasPackage = pipeline.package !== undefined && pipeline.package !== null && pipeline.package !== '';
+  if (hasPackage) {
+    const name = typeof pipeline.package === 'string' ? pipeline.package.trim() : null;
+    if (!isPackageName(name))
+      throw new InputError(
+        'pipeline.package is the npm package’s name, as its package.json says, like widgets or @acme/widgets',
+      );
+    out.package = name;
+  }
   for (const [group, keys] of Object.entries(known)) {
     const value = pipeline[group];
     if (value === undefined || value === null) {
-      if (group === 'workers')
-        throw new InputError('pipeline.workers needs staging and production, the names of the two Workers');
+      if (group === 'workers' && !hasPackage)
+        throw new InputError(
+          'pipeline needs workers (staging and production, the names of the two Workers it deploys), package (the npm package it releases), or both',
+        );
       continue;
     }
     if (typeof value !== 'object' || Array.isArray(value)) throw new InputError(`pipeline.${group} is an object`);
@@ -292,6 +310,7 @@ export function checkRepo(
   for (const key of JSON_FIELDS) if (key in input) row[key] = jsonField(input[key], key);
   if ('pipeline' in input) row.pipeline = checkPipeline(row.pipeline);
   if ('routine' in input) row.routine = checkRoutine(row.routine, caps);
+  if ('settings' in input) row.settings = checkSettings(row.settings);
 
   const adding = [...list(input.areas), ...list(input.addAreas)].map(parseArea);
   for (const project of list(input.removeAreas).map((p) => String(p).trim().toLowerCase())) {

package/src/specs.js

@@ -0,0 +1,96 @@
+/**
+ * A repository's specs (docs/specs/IDEA-31-specs-view.md, sections 1 and 2): where they are, and what the board
+ * reads from each file. Pure, so it's tested without the Durable Object; reading them through GitHub is in
+ * store-specs.js. The board never stores a spec: it reads the files on the default branch when asked.
+ */
+import { InputError } from './model.js';
+
+/** Where a repository keeps its specs when its settings don't say: where breakaway and the template put them. */
+export const DEFAULT_SPECS_DIR = 'docs/specs';
+/** The largest spec the board reads; a bigger one is a link to GitHub. */
+export const SPEC_MAX_BYTES = 1_048_576;
+const SPECS_DIR = /^(?!\/)(?!.*\.\.)[\w./-]{1,200}$/u;
+const SPEC_NAME = /^[\w.-]{1,200}\.md$/u;
+const WID = /^([A-Z]{2,8}-\d+)(?:[-.]|$)/u;
+
+/**
+ * A repository's specs directory as the owner sets it (`settings.specs`): a relative directory, with no `..`,
+ * of at most 200 characters, checked like `routine.prompt`. Empty or null means the default, so it's left out.
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+export function checkSpecsDir(value) {
+  if (value === null || value === undefined || value === '') return null;
+  const dir = String(value).trim().replace(/^\.\//u, '').replace(/\/+$/u, '');
+  if (!SPECS_DIR.test(dir) || dir.split('/').some((part) => part === '' || part === '.'))
+    throw new InputError('settings.specs is a directory in the repository, like docs/specs');
+  return dir;
+}
+
+/**
+ * A repository's `settings`, checked: its specs directory (`specs`) when it has one; the rest is kept as it is.
+ * @param {Record<string, any> | null} settings
+ */
+export function checkSettings(settings) {
+  if (!settings) return null;
+  const out = { ...settings };
+  const specs = checkSpecsDir(out.specs);
+  if (specs) out.specs = specs;
+  else delete out.specs;
+  return Object.keys(out).length ? out : null;
+}
+
+/** The directory, in the repository, its specs are in. */
+export const specsDirOf = (repo) => repo?.settings?.specs || DEFAULT_SPECS_DIR;
+
+/** A path as a task's `spec` field or a request may give it: no leading `./` or `/`. */
+export const normalPath = (path) =>
+  String(path ?? '')
+    .trim()
+    .replace(/^(?:\.\/|\/)+/u, '');
+
+/**
+ * Whether `path` is a file the board reads as one of the repository's specs: a Markdown file directly in `dir`
+ * (its README.md too). Subdirectories, other files, and anything outside it are refused.
+ * @param {string} dir
+ * @param {string} path
+ */
+export function inSpecsDir(dir, path) {
+  const p = normalPath(path);
+  if (!p.startsWith(`${dir}/`)) return false;
+  const name = p.slice(dir.length + 1);
+  return SPEC_NAME.test(name) && !name.startsWith('.');
+}
+
+/** Whether a file in the directory is a spec, not its introduction. */
+export const isSpecFile = (name) => SPEC_NAME.test(name) && !name.startsWith('.') && name.toLowerCase() !== 'readme.md';
+
+/**
+ * What the list shows for one spec: its title (the first `# ` heading, else the file name), its status (the
+ * first word after `Status:` on the line under the heading, as the template has it, else null), and the work ID
+ * its file name starts with, if any. `text` is null for a file the board didn't read (too large).
+ * @param {string} name the file name
+ * @param {string | null} text
+ */
+export function specMeta(name, text) {
+  const wid = WID.exec(name)?.[1] ?? null;
+  const fallback = name.replace(/\.md$/u, '');
+  if (text === null || text === undefined) return { wid, title: fallback, status: null };
+  const lines = String(text).split(/\r?\n/u);
+  const at = lines.findIndex((l) => /^#\s+\S/u.test(l));
+  if (at < 0) return { wid, title: fallback, status: null };
+  const title =
+    lines[at]
+      .replace(/^#\s+/u, '')
+      .replace(/\s+#+\s*$/u, '')
+      .trim() || fallback;
+  const under = lines.slice(at + 1).find((l) => l.trim() !== '') ?? '';
+  const status = /\bStatus:\s*\**\s*([A-Za-z][\w-]*)/u.exec(under)?.[1]?.toLowerCase() ?? null;
+  return { wid, title, status };
+}
+
+/** Newest first by the work ID's number, then by path; specs without a work ID last. */
+export function bySpecOrder(a, b) {
+  const n = (s) => (s.wid ? Number(s.wid.split('-')[1]) : -1);
+  return n(b) - n(a) || a.path.localeCompare(b.path);
+}

package/template/pipeline/deploy.yml

@@ -0,0 +1,178 @@
+# {{header}}
+#
+# Deploy: a merge to {{branchName}} that passes its checks goes to staging, the Worker {{stagingName}}. Production
+# changes only when the owner promotes a staging build (promote.yml). The build is kept as the workflow artifact
+# release-<commit>, and Promote deploys those same files to production. Deploys record GitHub Deployments, which the
+# board reads. Agents never run this workflow.
+name: Deploy
+
+on:
+  # After every check workflow has passed on a push to {{branchName}}: each one's completion starts this, and only the
+  # run that finds them all passed deploys.
+  workflow_run:
+    workflows: {{checks}}
+    types: [completed]
+    branches: [{{branch}}]
+  # By hand: deploy {{branchName}}'s latest commit to staging, once its checks have passed.
+  workflow_dispatch:
+
+permissions: {}
+
+# One staging deploy at a time. One that waits finds staging already runs its commit, or a newer one, and stops.
+concurrency:
+  group: deploy-staging
+  cancel-in-progress: false
+
+env:
+  STAGING: {{staging}}
+  BRANCH: {{branch}}
+  CHECKS: {{checksEnv}}
+  HEALTH_URL: {{healthStaging}}
+
+jobs:
+  staging:
+    name: staging
+    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # CLOUDFLARE_API_TOKEN is a secret of this environment, which only {{branchName}} may use: a token for the staging
+    # Worker only. CLOUDFLARE_ACCOUNT_ID is a repository variable.
+    environment: staging
+    permissions:
+      contents: read
+      deployments: write
+      actions: read
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      # What the repository's own commands (beforeDeploy) read to know where they run.
+      BREAKAWAY_ENV: staging
+      WORKER: {{staging}}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Check it should deploy
+        id: plan
+        run: node scripts/deploy-plan.mjs plan --staging "$STAGING" --sha "$SHA" --branch "$BRANCH" --checks "$CHECKS" --paths .github/deploy-paths.json >> "$GITHUB_OUTPUT"
+
+      - name: Record the start
+        id: record
+        if: steps.plan.outputs.deploy == 'true'
+        run: node scripts/record-deployment.mjs --environment "$STAGING" --sha "$SHA" --state in_progress --description "pre-release · building" --log-url "$RUN_URL"
+
+      - name: Install and build
+        if: steps.plan.outputs.deploy == 'true'
+        run: |
+          set -euo pipefail
+          if grep -q '"packageManager"' package.json 2>/dev/null; then corepack enable; fi
+          {{@install}}
+          {{@build}}
+
+      - name: Keep the build as the release artifact
+        id: artifact
+        if: steps.plan.outputs.deploy == 'true'
+        run: |
+          set -euo pipefail
+          # The commit as installed and built: Promote deploys these files to production, and builds nothing.
+          mkdir -p "$RUNNER_TEMP/release"
+          tar --exclude=./.git -czf "$RUNNER_TEMP/release/tree.tgz" .
+          echo "digest=$(node scripts/release-artifact.mjs digest "$RUNNER_TEMP/release")" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.plan.outputs.deploy == 'true'
+        with:
+          name: release-${{ github.event.workflow_run.head_sha || github.sha }}
+          path: ${{ runner.temp }}/release
+          retention-days: 90
+          compression-level: 0
+          if-no-files-found: error
+
+      - name: Deploy to staging
+        id: deploy
+        if: steps.plan.outputs.deploy == 'true'
+        env:
+          FROM: ${{ steps.plan.outputs.from }}
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+        run: |
+          set -euo pipefail
+          wrangler() { npx --yes wrangler "$@" --name "$WORKER"{{stagingEnvFlag}}; }
+          step() { node scripts/record-deployment.mjs --deployment "$DEPLOYMENT" --state in_progress --description "pre-release · $1" > /dev/null; }
+          # The version running now, which a failed check goes back to. Only a Worker that doesn't exist yet has none:
+          # any other failure to list stops here, since deploying with nothing to go back to isn't safe.
+          previous=""
+          if wrangler deployments list --json > "$RUNNER_TEMP/deployments.json" 2> "$RUNNER_TEMP/list-error.txt"; then
+            previous=$(node scripts/deploy-plan.mjs current < "$RUNNER_TEMP/deployments.json" | sed 's/^version=//')
+          else
+            cat "$RUNNER_TEMP/deployments.json" "$RUNNER_TEMP/list-error.txt" | node scripts/deploy-plan.mjs missing > /dev/null
+          fi
+          # The migrations this deploy runs: the ones added since staging's last deploy.
+          migrations=""
+          if [ -d migrations ]; then
+            node scripts/check-migrations.mjs --dir migrations ${FROM:+--base "$FROM"}
+            if [ -n "$FROM" ]; then
+              migrations=$(git diff --name-only --diff-filter=A "$FROM" "$SHA" -- migrations | grep '\.sql$' | xargs -r -n1 basename | paste -sd, - || true)
+            fi
+          fi
+          echo "migrations=$migrations" >> "$GITHUB_OUTPUT"
+          step migrating
+          {{@beforeDeploy}}
+          step deploying
+          export WRANGLER_OUTPUT_FILE_PATH="$RUNNER_TEMP/wrangler-output.ndjson"
+          if [ -z "$previous" ]; then
+            # The first deploy makes the Worker.
+            wrangler deploy --message "${SHA:0:7}"
+            version=$(node scripts/deploy-plan.mjs uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+          else
+            wrangler versions upload --message "${SHA:0:7}"
+            version=$(node scripts/deploy-plan.mjs uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+            wrangler versions deploy "$version@100%" --message "${SHA:0:7}" --yes
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          step checking
+          if [ -z "$HEALTH_URL" ]; then
+            echo "::notice title=Not checked::Staging runs ${SHA:0:7} as version $version. Set healthCheck in .github/breakaway-pipeline.json and the next deploy checks it, and goes back if it doesn't answer."
+            exit 0
+          fi
+          for attempt in $(seq 1 18); do
+            if curl -fsS --max-time 10 -o /dev/null "$HEALTH_URL"; then
+              echo "Staging runs ${SHA:0:7} as version $version, and $HEALTH_URL answers."
+              exit 0
+            fi
+            sleep 5
+          done
+          if [ -n "$previous" ] && wrangler rollback "$previous" --message "${SHA:0:7} failed its check" --yes; then
+            echo "rolled_back=true" >> "$GITHUB_OUTPUT"
+            echo "::error title=Rolled back::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, so staging went back to version $previous. Read the Worker's logs on Cloudflare."
+          else
+            echo "::error title=Failed its check::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, and staging had no version to go back to. Read the Worker's logs on Cloudflare."
+          fi
+          exit 1
+
+      - name: Record the end
+        if: always() && steps.record.outputs.deployment
+        env:
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+          OUTCOME: ${{ job.status }}
+          VERSION: ${{ steps.deploy.outputs.version }}
+          DIGEST: ${{ steps.artifact.outputs.digest }}
+          MIGRATIONS: ${{ steps.deploy.outputs.migrations }}
+          ROLLED_BACK: ${{ steps.deploy.outputs.rolled_back }}
+        run: |
+          set -euo pipefail
+          record() { node scripts/record-deployment.mjs --deployment "$DEPLOYMENT" --log-url "$RUN_URL" "$@" > /dev/null; }
+          if [ "$OUTCOME" = success ]; then
+            record --state success --note pre-release --version "$VERSION" --artifact "$DIGEST" --migrations "$MIGRATIONS" ${HEALTH_URL:+--environment-url "$HEALTH_URL"}
+          elif [ "$ROLLED_BACK" = true ]; then
+            record --state failure --description "rolled back: version $VERSION failed its check"
+          else
+            record --state failure --description "failed: the run says why"
+          fi

package/template/pipeline/promote.yml

@@ -0,0 +1,203 @@
+# {{header}}
+#
+# Promote: puts the staging build the owner chose live on production, the Worker {{productionName}}. It deploys the
+# files Deploy built and kept for that commit, and builds nothing. The board's Promote button starts it, or Actions,
+# Run workflow, with the commit staging runs. Agents never run this workflow.
+name: Promote
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: The full commit of the staging build to put live
+        required: true
+        type: string
+      destructive_ok:
+        description: I've read the destructive migrations it carries, and they may run
+        required: false
+        default: false
+        type: boolean
+
+permissions: {}
+
+# Production deploys one at a time, and a rollback waits for a promote (and the other way round).
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+env:
+  STAGING: {{staging}}
+  PRODUCTION: {{production}}
+  BRANCH: {{branch}}
+  HEALTH_URL: {{healthProduction}}
+
+jobs:
+  production:
+    name: production
+    if: github.ref == 'refs/heads/{{branchName}}'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # CLOUDFLARE_API_TOKEN is a secret of this environment, which only {{branchName}} may use: a token for the
+    # production Worker only.
+    environment: production
+    permissions:
+      contents: write
+      deployments: write
+      actions: read
+      pull-requests: read
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      GH_TOKEN: ${{ github.token }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      DEPLOYS_PAUSED: ${{ vars.DEPLOYS_PAUSED }}
+      SHA: ${{ inputs.sha }}
+      DESTRUCTIVE_OK: ${{ inputs.destructive_ok }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      BREAKAWAY_ENV: production
+      WORKER: {{production}}
+    steps:
+      # The helpers run from {{branchName}}; the build comes from the artifact Deploy kept.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - name: Fetch the staging build
+        id: artifact
+        run: |
+          set -euo pipefail
+          if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error title=Not a commit::Give the full commit of the staging build to promote (40 characters)."
+            exit 1
+          fi
+          id=$(gh api "repos/$GITHUB_REPOSITORY/actions/artifacts?name=release-$SHA&per_page=1" --jq '[.artifacts[] | select(.expired | not)][0].id // empty')
+          if [ -z "$id" ]; then
+            echo "::error title=No stored build::Deploy kept no build of ${SHA:0:7}, or it expired after 90 days, so there is nothing to promote. Merge to $BRANCH to make a new candidate."
+            exit 1
+          fi
+          mkdir -p "$RUNNER_TEMP/release"
+          gh api "repos/$GITHUB_REPOSITORY/actions/artifacts/$id/zip" > "$RUNNER_TEMP/release.zip"
+          unzip -q "$RUNNER_TEMP/release.zip" -d "$RUNNER_TEMP/release"
+          echo "digest=$(node scripts/release-artifact.mjs digest "$RUNNER_TEMP/release")" >> "$GITHUB_OUTPUT"
+
+      # The same refusals as the board's Promote button, checked again here: not paused, the latest successful staging
+      # build, on {{branchName}}, not live already, and the stored build is the one staging ran.
+      - name: Check the candidate
+        id: check
+        env:
+          DIGEST: ${{ steps.artifact.outputs.digest }}
+        run: node scripts/promote-check.mjs --staging "$STAGING" --production "$PRODUCTION" --sha "$SHA" --artifact-digest "$DIGEST" --branch "$BRANCH"
+
+      - name: Check its migrations
+        id: migrations
+        run: |
+          set -euo pipefail
+          live=$(node scripts/deploy-plan.mjs live --environment "$PRODUCTION" | sed 's/^sha=//')
+          echo "live=$live" >> "$GITHUB_OUTPUT"
+          if [ -n "$live" ]; then
+            added=$(git diff --name-only --diff-filter=A "$live" "$SHA" -- migrations | grep '\.sql$' || true)
+          else
+            added=$(git ls-tree -r --name-only "$SHA" -- migrations | grep '\.sql$' || true)
+          fi
+          echo "migrations=$(echo "$added" | xargs -r -n1 basename | paste -sd, -)" >> "$GITHUB_OUTPUT"
+          # A migration that destroys data carries an owner-approved line, and runs only when the owner ticked it.
+          destructive=""
+          for file in $added; do
+            if git show "$SHA:$file" | grep -qE '^[[:space:]]*--[[:space:]]*owner-approved:[[:space:]]*[^[:space:]]'; then destructive="$destructive $(basename "$file")"; fi
+          done
+          if [ -n "$destructive" ] && [ "$DESTRUCTIVE_OK" != true ]; then
+            echo "::error title=Destructive migration::${SHA:0:7} carries a migration that destroys data:$destructive. Read it, then promote again with destructive_ok."
+            exit 1
+          fi
+
+      - name: Record the start
+        id: record
+        run: |
+          node scripts/record-deployment.mjs --environment "$PRODUCTION" --sha "$SHA" --production --state in_progress --description "promoting: starting" --log-url "$RUN_URL"
+
+      - name: Deploy to production
+        id: deploy
+        env:
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+        run: |
+          set -euo pipefail
+          helpers="$GITHUB_WORKSPACE/scripts"
+          step() { node "$helpers/record-deployment.mjs" --deployment "$DEPLOYMENT" --state in_progress --description "promoting: $1" > /dev/null; }
+          mkdir -p "$RUNNER_TEMP/app"
+          tar -xzf "$RUNNER_TEMP/release/tree.tgz" -C "$RUNNER_TEMP/app"
+          cd "$RUNNER_TEMP/app"
+          wrangler() { npx --yes wrangler "$@" --name "$WORKER"{{productionEnvFlag}}; }
+          previous=""
+          if wrangler deployments list --json > "$RUNNER_TEMP/deployments.json" 2> "$RUNNER_TEMP/list-error.txt"; then
+            previous=$(node "$helpers/deploy-plan.mjs" current < "$RUNNER_TEMP/deployments.json" | sed 's/^version=//')
+          else
+            cat "$RUNNER_TEMP/deployments.json" "$RUNNER_TEMP/list-error.txt" | node "$helpers/deploy-plan.mjs" missing > /dev/null
+          fi
+          step migrating
+          {{@beforeDeploy}}
+          step deploying
+          export WRANGLER_OUTPUT_FILE_PATH="$RUNNER_TEMP/wrangler-output.ndjson"
+          if [ -z "$previous" ]; then
+            wrangler deploy --message "${SHA:0:7}"
+            version=$(node "$helpers/deploy-plan.mjs" uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+          else
+            wrangler versions upload --message "${SHA:0:7}"
+            version=$(node "$helpers/deploy-plan.mjs" uploaded < "$WRANGLER_OUTPUT_FILE_PATH" | sed 's/^version=//')
+            wrangler versions deploy "$version@100%" --message "${SHA:0:7}" --yes
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          step checking
+          if [ -z "$HEALTH_URL" ]; then
+            echo "::notice title=Not checked::Production runs ${SHA:0:7} as version $version. Set healthCheck.production in .github/breakaway-pipeline.json and the next promote checks it, and goes back if it doesn't answer."
+            exit 0
+          fi
+          for attempt in $(seq 1 18); do
+            if curl -fsS --max-time 10 -o /dev/null "$HEALTH_URL"; then
+              echo "Production runs ${SHA:0:7} as version $version, and $HEALTH_URL answers."
+              exit 0
+            fi
+            sleep 5
+          done
+          if [ -n "$previous" ] && wrangler rollback "$previous" --message "${SHA:0:7} failed its check" --yes; then
+            echo "rolled_back=true" >> "$GITHUB_OUTPUT"
+            echo "::error title=Rolled back::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, so production went back to version $previous. Read the Worker's logs on Cloudflare."
+          else
+            echo "::error title=Failed its check::${SHA:0:7} didn't answer $HEALTH_URL within 90 seconds, and production had no version to go back to. Read the Worker's logs on Cloudflare."
+          fi
+          exit 1
+
+      - name: Record the end
+        if: always() && steps.record.outputs.deployment
+        env:
+          DEPLOYMENT: ${{ steps.record.outputs.deployment }}
+          OUTCOME: ${{ job.status }}
+          VERSION: ${{ steps.deploy.outputs.version }}
+          DIGEST: ${{ steps.artifact.outputs.digest }}
+          MIGRATIONS: ${{ steps.migrations.outputs.migrations }}
+          ROLLED_BACK: ${{ steps.deploy.outputs.rolled_back }}
+        run: |
+          set -euo pipefail
+          record() { node scripts/record-deployment.mjs --deployment "$DEPLOYMENT" --log-url "$RUN_URL" "$@" > /dev/null; }
+          if [ "$OUTCOME" = success ]; then
+            record --state success --version "$VERSION" --artifact "$DIGEST" --migrations "$MIGRATIONS" ${HEALTH_URL:+--environment-url "$HEALTH_URL"}
+          elif [ "$ROLLED_BACK" = true ]; then
+            record --state failure --description "rolled back: version $VERSION failed its check"
+          else
+            record --state failure --description "failed: the run says why"
+          fi
+
+      # Production only: a tag and a GitHub release with every pull request since what production ran before.
+      - name: Tag and release
+        env:
+          LIVE: ${{ steps.migrations.outputs.live }}
+          VERSION: ${{ steps.deploy.outputs.version }}
+        run: |
+          set -euo pipefail
+          tag="v$(date -u +%Y%m%d)-${SHA:0:7}"
+          from=${LIVE:-$(git rev-list --max-parents=0 "$SHA" | tail -1)}
+          node scripts/release-notes.mjs --title "${GITHUB_REPOSITORY#*/}" --version "$tag" --from "$from" --to "$SHA" > "$RUNNER_TEMP/notes.md"
+          gh release create "$tag" --repo "$GITHUB_REPOSITORY" --target "$SHA" --title "$tag" --notes-file "$RUNNER_TEMP/notes.md" --latest