Repository navigation
CD: local just deploy-dev for Azure dev; main → prod - #67
Merged
Merged
Conversation
Temporary routing for #10: pull requests push a SHA (and pr-<n>) to GHCR and roll that image onto pixel-dev. Merges to main push the SHA (and the moving main tag) toward prod, fail-closed until infra/envs/prod and prod secrets exist. Never copy the Mini/dev Discord token. Max replicas stay 1.
7 tasks
just deploy-dev builds this tree, pushes GHCR, and updates pixel-dev. CD on main still publishes the SHA and deploys prod (fail closed until #12). CI no longer rolls PRs onto the one-replica dev app.
cursor
Bot
changed the title
NinjaLikesCheez
marked this pull request as ready for review
October 8, 2026 12:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes nothing yet (#10 stays open: Sentry releases and
just registerfrom CD are still later).Temporary routing (overrides issue 10 / architecture
main→dev):dev:just deploy-devon a laptop. Builds this tree, pushesghcr.io/pixelbar/pixel:<sha>(ordev-dirty-*if dirty) plus:dev, thenaz containerapp updateonpixel-devonly. Max replicas stay 1. CI does not deploy pull requests, so a local SHA is not overwritten by another CI head.prod: merges tomainpush that SHA (and movingmain) and deploy it. Fail closed ifinfra/envs/prod(Prod environment, approval gate and go-live in the Pixelbar server #12) or prod Key Vault secrets are missing. Discord will not answer on prod until that stack exists.Do not copy the Mini local / Pixel Dev Discord token (
pixel-dev-kv) into prod. Neither path applies Terraform or starts Pixel locally. Ifpixel-devis up, do not alsojust devon the same token.GHCR auth
dev:just docker-login-ghcrusesgh auth token. Needsgh auth refresh --scopes write:packages,read:packages,repo.main: publish job only,packages: write,docker/login-action+GITHUB_TOKEN. Provenance/SBOM off.The image is secret-free. The package should be public so Container Apps can pull (today’s 401 / DENIED). The workflow tries to flip this and warns if it cannot.
What Thomas must set
pixelbar/pixel: Package settings → Change visibility → Public. Local push also needswrite:packagesongh.azsigned in on the Pixel subscription forjust deploy-dev. EnvironmentdevARM_*is not required for this path.prod(missing): create it, require reviewers, limit to branchmain. Variables (not secrets):ARM_CLIENT_ID=7cb1d0a8-5314-4c9b-a0ba-10f5c75367d7,ARM_TENANT_ID=2cd2bab0-0dd0-41ff-8f13-592500857ea6,ARM_SUBSCRIPTION_ID=d150e252-e2f0-47fb-8a4a-c3f29e9aebd4.pixel-devContainer App still has to exist (Terraform module for Pixel on Azure Container Apps + dev environment #9 / PR 66).just deploy-devonly runsaz containerapp update.Prod stays fail-closed
infra/envs/prodis not in this PR. A push tomainpublishes the image, then the prod job fails and does not deploy. No Mini/dev token, no second replica.See ADR 0010.