feat: environment-scoped release secrets (dev/prod R2 isolation)#157
Merged
Conversation
…e isolation - Move R2_BUCKET from vars to secrets so it participates in GitHub environment scoping (dev vs prod get different buckets/credentials) - Add documentation header listing all environment-scoped secrets required per environment - Soft-fail Swift unit tests on dev releases (live MLX model cache may be incomplete on CI) - Download full model (remove --include filter) for deterministic CI cache seeding
|
Deployment failed with the following error: View Documentation: https://vercel.com/docs/accounts/team-members-and-roles |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…tion Both release workflows now resolve DEV_ or PROD_ prefixed repo secrets in a resolve-env step using bash indirection — no GitHub environments needed. The environment: gate is removed since secrets live at repo level with prefixes. Required repo secrets: DEV_R2_ACCESS_KEY_ID, PROD_R2_ACCESS_KEY_ID DEV_R2_SECRET_ACCESS_KEY, PROD_R2_SECRET_ACCESS_KEY DEV_R2_ENDPOINT, PROD_R2_ENDPOINT DEV_R2_BUCKET, PROD_R2_BUCKET DEV_R2_PUBLIC_URL, PROD_R2_PUBLIC_URL DEV_COORDINATOR_URL, PROD_COORDINATOR_URL DEV_RELEASE_KEY, PROD_RELEASE_KEY
|
Deployment failed with the following error: View Documentation: https://vercel.com/docs/accounts/team-members-and-roles |
Benchmark ResultsRunner: 1-provider-streaming1 providers, 1 users, 30 requests, concurrency=5, streaming=true
Latency Decomposition
Assertion Report: PASS
1-provider-non-streaming1 providers, 1 users, 20 requests, concurrency=5, streaming=false
Latency Decomposition
Assertion Report: PASS
7-provider-multi-model7 providers, 5 users, 50 requests, concurrency=10, streaming=true
Latency Decomposition
Assertion Report: PASS
3-provider-high-concurrency3 providers, 10 users, 60 requests, concurrency=20, streaming=true
Latency Decomposition
Assertion Report: PASS
1-provider-queue-saturation1 providers, 10 users, 40 requests, concurrency=15, streaming=true
Latency Decomposition
Assertion Report: PASS
3-provider-20-users3 providers, 20 users, 60 requests, concurrency=10, streaming=true
Latency Decomposition
Assertion Report: PASS
1-provider-scaling1 providers, 5 users, 30 requests, concurrency=10, streaming=true
Latency Decomposition
Assertion Report: PASS
3-provider-scaling3 providers, 5 users, 30 requests, concurrency=10, streaming=true
Latency Decomposition
Assertion Report: PASS
5-provider-scaling5 providers, 5 users, 30 requests, concurrency=10, streaming=true
Latency Decomposition
Assertion Report: PASS
3-provider-heavy-100conc-10kb3 providers, 20 users, 100 requests, concurrency=100, streaming=true
Latency Decomposition
Assertion Report: PASS
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release-swift.ymlandrelease-rust-bridge.ymlresolve the right prefixed secrets in aresolve-envstep using bash indirection — no GitHub environments needed.set -euo pipefail.--includefilter onhf downloadsoconfig.jsonand all model files land in the HuggingFace cache.Required Repo Secrets
Add these prefixed secrets to the GitHub repo (Settings → Secrets → Actions):
DEV_R2_ACCESS_KEY_IDPROD_R2_ACCESS_KEY_IDDEV_R2_SECRET_ACCESS_KEYPROD_R2_SECRET_ACCESS_KEYDEV_R2_ENDPOINThttps://<acct>.r2.cloudflarestorage.comPROD_R2_ENDPOINTDEV_R2_BUCKETd-inf-app-devPROD_R2_BUCKETd-inf-app-prodDEV_R2_PUBLIC_URLPROD_R2_PUBLIC_URLDEV_COORDINATOR_URLhttps://api.dev.darkbloom.xyzPROD_COORDINATOR_URLhttps://api.darkbloom.devDEV_RELEASE_KEYPROD_RELEASE_KEYApple signing secrets (
APPLE_CERTIFICATE_P12,APPLE_CERTIFICATE_PASSWORD,APPLE_ID,APPLE_APP_PASSWORD) stay as-is — shared across both envs.Test Plan
DEV_*repo secretsv0.5.0-dev.2tag → verify dev release uploads tod-inf-app-devbucketGET /v1/releases/lateston dev coordinator returns the new release