Repository navigation
CD: keep main off prod; Sentry maps and register on deploy-dev - #68
Merged
Merged
Conversation
Prod is not ready (#12). Merges to main publish GHCR (and source maps when Sentry org/token exist) but never log in to Azure or touch pixel-prod. just deploy-dev still rolls pixel-dev (one replica), then creates a Sentry release and just register for the Pixel Dev guild.
7 tasks
Sentry on main and terraform plan no longer skip if org/token or Environment dev ARM_* are unset. Prod CD stays off: no Azure login, no pixel-prod.
This repo was created after 2026-07-15, so Actions tokens use repo:pixelbar@1690472/pixel@1402859166:environment:<env>. The name-only subject never matches (AADSTS700213). Plan still fails until that credential is updated in Azure.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
The app is already live after az containerapp update. A Sentry outage must not skip just register. sentry-release still fails the recipe.
Commands are already registered. Do not hide a Sentry failure with || true; print that pixel-dev is live and still exit 1.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continues #10 after PR 67. Does not redo GHCR publish or
just deploy-dev. Closes nothing yet (#10 stays open).Prod CD is off until #12. Merges to
mainstill publishghcr.io/pixelbar/pixel:<sha>(and:main) and create a Sentry release. They do not log in to Azure and have no path topixel-prod. Fail closed: never copy the Mini / Pixel Dev Discord token (pixel-dev-kv) into prod. Max replicas stay 1.Missing config fails closed (no silent skip):
SENTRY_AUTH_TOKENand variablesSENTRY_ORG,SENTRY_PROJECT.devvariablesARM_CLIENT_ID,ARM_TENANT_ID,ARM_SUBSCRIPTION_ID.OIDC (Plan envs/dev): GitHub Environment
devARM_*is set and correct. Login fails with AADSTS700213 because this repo (created 2026-10-03) emits immutable subjectsrepo:pixelbar@1690472/pixel@1402859166:environment:dev, while Azure still hasrepo:pixelbar/pixel:environment:dev. Bootstrap Terraform in this PR matches the immutable subject. Plan stays red until someone with Owner updates that federated credential in Azure (see comment / coordinator note). This PR does not apply bootstrap.Azure
dev:just deploy-devstill rollspixel-devfrom this tree, then localjust sentry-release(still skips without Mini.envorg/token) andjust registeragainst the Pixel Dev guild. CI still does not deploy pull requests. Ifpixel-devis up, do not alsojust devon the same token.Auth-related: this PR does not change
core/access*,core/identity*,core/dispatcher*,core/registry*orservices/access-config*.