chore: tidy up #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD Dev | |
| "on": | |
| push: | |
| branches: [main] | |
| # Skip deploy cycle for docs-only or planning-artifact changes. | |
| # These never affect the built image or Pulumi stack, so there is | |
| # no reason to burn a ~3-minute deploy on a README tweak. | |
| paths-ignore: | |
| - '.planning/**' | |
| - '**/*.md' | |
| - 'CLAUDE.md' | |
| - 'AGENTS.md' | |
| # IN-01 revisited: top-level permissions ARE required on callers of a | |
| # reusable workflow that needs elevated scopes. The caller's workflow | |
| # permissions form the upper bound for what the called workflow's | |
| # jobs can claim. Without `id-token: write` here, cd-base.yml cannot | |
| # get an OIDC token for WIF auth (verified empirically: CD Dev run | |
| # 24291482351 failed at startup when this block was removed). The | |
| # original review finding IN-01 was incorrect on this point. | |
| permissions: | |
| contents: read | |
| id-token: write | |
| # WR-02 fix: serialize dev deploys per stack so two quick pushes to | |
| # main never race two `pulumi up` calls against the same GCS state | |
| # lock. cancel-in-progress: true because dev always wants latest main. | |
| concurrency: | |
| group: cd-dev | |
| cancel-in-progress: true | |
| jobs: | |
| deploy-dev: | |
| uses: ./.github/workflows/cd-base.yml | |
| with: | |
| stack: dev | |
| command: up | |
| gcp_project: vici-app-dev | |
| secrets: | |
| WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }} | |
| WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_CI_SA_EMAIL }} | |
| PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} |