mandrel-platform 0.17.2 → 0.19.0

package/templates/workflows/deploy-staging.yml

@@ -0,0 +1,86 @@
+name: deploy-staging
+
+# Canonical staging-deploy caller template (Story #175).
+#
+# > **Thin local caller.** The defence-in-depth deploy core (secret-isolation
+# > audit -> CF env gate -> pre-migration snapshot -> migrate -> deploy ->
+# > boot-smoke + auto-rollback) AND the CI-green guard both live in the shared
+# > `dsj1984/mandrel-platform` `deploy-cloudflare.yml` reusable workflow — see
+# > https://github.com/dsj1984/mandrel-platform/blob/main/docs/reusable-workflows.md#deploy-cloudflareyml.
+# > This file only holds <PROJECT_NAME>-specific values (worker names, build
+# > step, secret mapping). When the deploy PROCESS changes, that change lands
+# > upstream in mandrel-platform — not here.
+#
+# One paved road (operator decision 2026-07-01, D4): every consumer triggers
+# staging deploy via `workflow_run` on its own CI workflow, gated on
+# `conclusion == 'success'`. `workflow_run` fires on BOTH a successful AND a
+# failed upstream run, so a caller-side guard against a red run used to be
+# REQUIRED here — every consumer hand-copied the same `preflight` job (see
+# mandrel-platform Story #175 context). That guard is now a `require-ci-green`
+# job INSIDE `deploy-cloudflare.yml` itself (`github.event` inside a reusable
+# workflow is the CALLER's event, so the shared workflow can see and gate on
+# the `workflow_run` conclusion even though it cannot own this file's `on:`
+# block). This template needs NO caller-side preflight guard as a result —
+# copy it as-is and fill in the placeholders below.
+#
+# Replace every <PLACEHOLDER> with your project's real values:
+#   <CI_WORKFLOW_NAME>        the `name:` of the workflow this deploy should
+#                              gate on (e.g. "quality", "CI", "PR Quality").
+#                              Must match EXACTLY — GitHub matches
+#                              `workflow_run.workflows` by workflow name, not
+#                              file path.
+#   <MANDREL_PLATFORM_SHA>     the pinned mandrel-platform commit SHA (resolve
+#                              via `node scripts/platform-sync.mjs --ref
+#                              <release-tag>` from the consumer repo root, or
+#                              hand-resolve via `git ls-remote`).
+#   <MANDREL_PLATFORM_TAG>     the human-readable release tag matching the SHA
+#                              above (trailing `# <tag>` comment).
+#   <WORKERS_CSV>              comma-separated Worker names for this env, e.g.
+#                              "api,web".
+#   <BUILD_COMMAND>            optional build command (omit build-command /
+#                              build-artifact entirely if the deploy job's
+#                              default checkout is build-ready).
+#
+# See the full input/secret contract:
+# https://github.com/dsj1984/mandrel-platform/blob/main/docs/reusable-workflows.md#deploy-cloudflareyml
+
+on:
+  # CI-green gate: fires when <CI_WORKFLOW_NAME> finishes on main. The shared
+  # deploy-cloudflare.yml's require-ci-green job skips-with-notice unless the
+  # upstream conclusion was 'success' — no caller-side guard needed.
+  workflow_run:
+    workflows: [<CI_WORKFLOW_NAME>]
+    branches: [main]
+    types: [completed]
+  # Manual on-demand trigger (UI "Run workflow" + `gh workflow run`).
+  # workflow_dispatch always passes the shared workflow's CI-green guard
+  # (operator-intentional, no upstream conclusion to gate on).
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Cancel an in-flight staging deploy when a newer commit lands on main — only
+# the freshest tip of main should reach the staging surfaces. The shared
+# deploy-cloudflare.yml additionally serializes per-environment.
+concurrency:
+  group: deploy-staging
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Staging deploy (shared deploy-cloudflare.yml)
+    uses: dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml@<MANDREL_PLATFORM_SHA> # <MANDREL_PLATFORM_TAG>
+    with:
+      environment: staging
+      gh-environment: staging
+      workers: <WORKERS_CSV>
+      migrate: true
+      # db-engine defaults to 'd1'. Set db-engine + migrate-command +
+      # snapshot-command for a non-D1 engine (e.g. Turso) — see the contract
+      # doc's "command seams" section.
+    # Frozen secret allowlist: only {CLOUDFLARE_*, TURSO_*} cross into the
+    # shared workflow. Map your project's secret NAMES onto these slots.
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/templates/workflows/uptime-apply.yml

@@ -0,0 +1,54 @@
+name: uptime-apply
+
+# Canonical staging-deploy caller template (Story #180).
+#
+# > **Thin local caller.** The Better Stack monitor schema + apply logic
+# > (config validation, live-diff, create/update, graceful skip-with-notice
+# > when the secret isn't provisioned) lives in the shared
+# > `dsj1984/mandrel-platform` `uptime-apply.yml` reusable workflow — see
+# > https://github.com/dsj1984/mandrel-platform/blob/main/docs/reusable-workflows.md#uptime-applyyml.
+# > This file only holds <PROJECT_NAME>-specific values (the monitor-config
+# > path and the apply trigger). When the apply PROCESS changes, that change
+# > lands upstream in mandrel-platform — not here.
+#
+# Replace every <PLACEHOLDER> with your project's real values:
+#   <MANDREL_PLATFORM_SHA>   the pinned mandrel-platform commit SHA (resolve
+#                             via `node scripts/platform-sync.mjs --ref
+#                             <release-tag>` from the consumer repo root, or
+#                             hand-resolve via `git ls-remote`).
+#   <MANDREL_PLATFORM_TAG>   the human-readable release tag matching the SHA
+#                             above (trailing `# <tag>` comment).
+#   <MONITOR_CONFIG_PATH>    path to this repo's monitor-config JSON, e.g.
+#                             "infra/uptime/monitors.json".
+#
+# See the full input/secret contract:
+# https://github.com/dsj1984/mandrel-platform/blob/main/docs/reusable-workflows.md#uptime-applyyml
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: uptime-apply
+  cancel-in-progress: false
+
+jobs:
+  uptime:
+    name: Uptime apply (shared uptime-apply.yml)
+    uses: dsj1984/mandrel-platform/.github/workflows/uptime-apply.yml@<MANDREL_PLATFORM_SHA> # <MANDREL_PLATFORM_TAG>
+    with:
+      monitor-config: <MONITOR_CONFIG_PATH>
+      # apply:'true' on push to main converges live Better Stack monitors to
+      # the checked-in config; a workflow_dispatch preview run can pass
+      # apply:'false' instead to dry-run without writing.
+      apply: ${{ github.event_name == 'push' && 'true' || 'false' }}
+    # Frozen secret surface: only these two cross into the shared workflow.
+    # Both are optional on the shared side — an absent BETTERSTACK_API_TOKEN
+    # is the documented graceful-degradation (skip-with-notice) path.
+    secrets:
+      BETTERSTACK_API_TOKEN: ${{ secrets.BETTERSTACK_API_TOKEN }}
+      UPTIME_ALERT_EMAIL: ${{ secrets.UPTIME_ALERT_EMAIL }}