From be71ed89e9ff39d8fb703f812e7136217b86b0d1 Mon Sep 17 00:00:00 2001 From: Amr Mohammed El-Sheraey <141947355+AmrMsCLL@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:19:52 +0200 Subject: [PATCH] feat: projects can be disabled with ENABLED=false, and the console can release through the platform app A compose project whose deploy//values says ENABLED=false is taken down by Deploy, volumes kept; removing the line deploys it again. The Deploy guard lets a bot change ENABLED=false lines as well as IMAGE_TAG lines, which is how the console's Release card disables, enables and picks a version. The console gets PLATFORM_APP_CLIENT_ID and PLATFORM_APP_PRIVATE_KEY to commit those changes as the platform app. --- .github/workflows/deploy.yml | 6 +++--- deploy/console/compose.yaml | 2 ++ scripts/deploy.py | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 7c7430d..a8a96e0 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -40,7 +40,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 - - name: Allow automated pushes to change only image tags + - name: Allow automated pushes to change only image tags and the enabled switch if: github.event_name == 'push' && endsWith(github.actor, '[bot]') run: | set -euo pipefail @@ -49,9 +49,9 @@ jobs: exit 1 fi files="$(git diff --name-only "$BEFORE" HEAD | grep -Ev '^deploy/[a-z0-9-]+/values$' || true)" - lines="$(git diff -U0 "$BEFORE" HEAD -- 'deploy/*/values' | grep -E '^[+-]' | grep -Ev '^(\+\+\+|---) ' | grep -Ev '^[+-]IMAGE_TAG=sha-[0-9a-f]{7,40}$' || true)" + lines="$(git diff -U0 "$BEFORE" HEAD -- 'deploy/*/values' | grep -E '^[+-]' | grep -Ev '^(\+\+\+|---) ' | grep -Ev '^[+-](IMAGE_TAG=sha-[0-9a-f]{7,40}|ENABLED=false)$' || true)" if [ -n "$files" ] || [ -n "$lines" ]; then - echo "::error::${GITHUB_ACTOR} may change only IMAGE_TAG lines in deploy/*/values; refusing to deploy:" + echo "::error::${GITHUB_ACTOR} may change only IMAGE_TAG and ENABLED=false lines in deploy/*/values; refusing to deploy:" printf '%s\n' "$files" "$lines" exit 1 fi diff --git a/deploy/console/compose.yaml b/deploy/console/compose.yaml index ddf6fe5..381df37 100644 --- a/deploy/console/compose.yaml +++ b/deploy/console/compose.yaml @@ -15,6 +15,8 @@ services: SMTP_URL: ${SMTP_URL:-} ALERTS_EMAIL: ${ALERTS_EMAIL:-} ALERTS_FROM: ${ALERTS_FROM:-} + PLATFORM_APP_CLIENT_ID: ${PLATFORM_APP_CLIENT_ID:-} + PLATFORM_APP_PRIVATE_KEY: ${PLATFORM_APP_PRIVATE_KEY:-} privileged: true pid: host volumes: [/var/run/docker.sock:/var/run/docker.sock, data:/data, logs:/logs] diff --git a/scripts/deploy.py b/scripts/deploy.py index 3ccd7e8..9a433a1 100644 --- a/scripts/deploy.py +++ b/scripts/deploy.py @@ -149,7 +149,7 @@ def plan(): for slug in chosen: registered = entry(slug) kind = registered["deploy"]["kind"] if registered else None - if not (DEPLOY / slug).is_dir(): + if not (DEPLOY / slug).is_dir() or values(slug).get("ENABLED") == "false": if kind == "compose": down.append(slug) elif kind == "compose" and compose_project(slug): @@ -239,7 +239,7 @@ def check(): kind = registered["deploy"]["kind"] if registered else None try: if kind == "pages": - problems.extend(f"deploy/{slug}/values: {name} is not used by a Pages site" for name in set(values(slug)) - {"IMAGE_TAG"}) + problems.extend(f"deploy/{slug}/values: {name} is not used by a Pages site" for name in set(values(slug)) - {"IMAGE_TAG", "ENABLED"}) elif kind == "compose" and compose_project(slug): route(slug, render(slug)[0]) else: