Skip to content

chore(ci): consolidate deploy workflows #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gentlementlegen merged 3 commits into from
Mar 17, 2026
+134 −190
Merged

chore(ci): consolidate deploy workflows #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
40d24a1
chore(ci): consolidate deploy workflows
gentlementlegen Mar 12, 2026
3193cde
style: format update-configuration workflow
gentlementlegen Mar 12, 2026
babe993
fix(ci): restore plugin-specific deploy env vars
gentlementlegen Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 0 additions & 37 deletions .github/workflows/deno-deploy.yml
View file
Open in desktop

This file was deleted.

140 changes: 134 additions & 6 deletions .github/workflows/update-configuration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,152 @@
name: "Update Configuration and Build"
name: "Deploy"

on:
workflow_dispatch:
inputs:
build_action_enabled:
description: "Publish GitHub Action artifacts to dist/<ref>."
required: false
default: "true"
type: choice
options:
- "true"
- "false"
deploy_deno_enabled:
description: "Deploy Worker to Deno Deploy."
required: false
default: "true"
type: choice
options:
- "true"
- "false"
skip_bot_events:
description: "manifest.skipBotEvents value for generated manifest."
required: false
default: "false"
exclude_supported_events:
description: "Comma-separated supported events to exclude from manifest listeners."
required: false
default: ""
push:
branches-ignore:
- "dist/**"
tags-ignore:
- "*"
delete:

jobs:
update:
name: "Update Configuration & Build"
deploy:
name: "Deploy (Action / Deno)"
runs-on: ubuntu-latest
permissions: write-all

@coderabbitai coderabbitai Bot Mar 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/update-configuration.yml

Repository: ubiquity-os/command-demo

Length of output: 7736

Pin actions to full SHAs and scope permissions.

Line 41's permissions: write-all grants unnecessary access to GITHUB_TOKEN. The unpinned cross-repo actions at lines 94, 128, and 134 reference @main while receiving sensitive secrets (APP_ID, APP_PRIVATE_KEY, KERNEL_PUBLIC_KEY, GITHUB_TOKEN, APP_INSTALLATION_ID). If an action is compromised, it can access these secrets and write to the repository. Pin actions to full commit SHAs and restrict permissions to only what each step requires.

environment: ${{ (github.event.ref == 'refs/heads/main' || github.ref == 'refs/heads/main' || github.event.workflow_run.head_branch == 'main') && 'main' || 'development' }}
env:
BUILD_ACTION_ENABLED: ${{ github.event_name == 'workflow_dispatch' && inputs.build_action_enabled || vars.BUILD_ACTION_ENABLED || 'true' }}
DEPLOY_DENO_ENABLED: ${{ github.event_name == 'workflow_dispatch' && inputs.deploy_deno_enabled || vars.DEPLOY_DENO_ENABLED || 'true' }}
SKIP_BOT_EVENTS: ${{ github.event_name == 'workflow_dispatch' && inputs.skip_bot_events || vars.SKIP_BOT_EVENTS || 'false' }}
EXCLUDE_SUPPORTED_EVENTS: ${{ github.event_name == 'workflow_dispatch' && inputs.exclude_supported_events || vars.EXCLUDE_SUPPORTED_EVENTS || '' }}

steps:
- uses: ubiquity-os/action-deploy-plugin@main
- name: Resolve source ref
id: refs
shell: bash
run: |
source_ref="$(echo '${{ github.event.ref || github.event.workflow_run.head_branch || github.ref }}' | sed 's#refs/heads/##' | sed 's#refs/tags/##')"
if [[ -z "$source_ref" ]]; then
source_ref="${GITHUB_REF_NAME}"
fi

is_tag_ref="false"
if [[ "${{ github.event.ref_type || '' }}" == "tag" ]] || [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
is_tag_ref="true"
fi

is_artifact_ref="false"
if [[ "$source_ref" == dist/* ]]; then
is_artifact_ref="true"
fi

if [[ "$BUILD_ACTION_ENABLED" == "true" ]]; then
action_ref_branch="dist/${source_ref}"
else
action_ref_branch="${source_ref}"
fi

echo "source_ref=$source_ref" >> "$GITHUB_OUTPUT"
echo "is_tag_ref=$is_tag_ref" >> "$GITHUB_OUTPUT"
echo "is_artifact_ref=$is_artifact_ref" >> "$GITHUB_OUTPUT"
echo "ACTION_REF=${GITHUB_REPOSITORY}@${action_ref_branch}" >> "$GITHUB_ENV"
Comment on lines +75 to +78

@coderabbitai coderabbitai Bot Mar 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, get the actual lines from the workflow file
fd '.github/workflows/update-configuration.yml' -x cat {} | head -160 | tail -90

Repository: ubiquity-os/command-demo

Length of output: 50

🏁 Script executed:

find . -name "update-configuration.yml" -type f

Repository: ubiquity-os/command-demo

Length of output: 112

🏁 Script executed:

cat -n ./.github/workflows/update-configuration.yml | sed -n '70,85p'

Repository: ubiquity-os/command-demo

Length of output: 828

🏁 Script executed:

cat -n ./.github/workflows/update-configuration.yml | sed -n '135,150p'

Repository: ubiquity-os/command-demo

Length of output: 1127

🌐 Web query:

GitHub Actions $GITHUB_ENV vs $GITHUB_OUTPUT env context expression resolution

💡 Result:

What gets resolved when (expressions vs runtime)

  • ${{ ... }} expressions are evaluated by the GitHub Actions workflow engine (before/during step dispatch), using contexts like github, env, steps, needs, etc.
  • $VAR / %VAR% / $env:VAR are expanded later by the runner shell at runtime inside run:.

$GITHUB_ENV (environment variables) vs env context

  • Writing NAME=value to $GITHUB_ENV sets an OS environment variable for subsequent steps in the same job; the step that writes it cannot see the new value. [1]
  • The env context (${{ env.NAME }}) contains variables defined in workflow/job/step env: blocks, and does not contain variables inherited by the runner process. So a variable created via $GITHUB_ENV is reliably usable as $NAME in later run: steps, but is not guaranteed to appear in ${{ env.NAME }}. [2]

$GITHUB_OUTPUT (step outputs) vs env context

  • Writing name=value to $GITHUB_OUTPUT sets a step output (step needs an id) that you can reference later as ${{ steps.<id>.outputs.<name> }}. [1]
  • Step outputs are specifically designed to feed expressions in later steps (including if:, with:, env: values, etc.), because they live in the steps context. [1][2]

Practical rule of thumb

  • Use $GITHUB_ENV when the next steps only need the value inside shell scripts (run:): echo "$MYVAR".
  • Use $GITHUB_OUTPUT when the next steps need the value in workflow expressions: if: ${{ steps.calc.outputs.foo == 'bar' }} or with: token: ${{ steps.auth.outputs.token }}. [1][2]

Minimal example showing the difference

- name: Compute
  id: calc
  run: |
    echo "RUNTIME_ONLY=hello" >> "$GITHUB_ENV"
    echo "expr_value=hello"   >> "$GITHUB_OUTPUT"

- name: Use in shell (works)
  run: echo "$RUNTIME_ONLY"

- name: Use in expressions (use outputs)
  if: ${{ steps.calc.outputs.expr_value == 'hello' }}
  run: echo "expression matched"

Sources: GitHub Docs on workflow commands (GITHUB_ENV, GITHUB_OUTPUT) [1], contexts and env/steps behavior [2], and notes about what the env context does/doesn’t include [3].

References

  • [1] GitHub Docs — Workflow commands for GitHub Actions (sections “Setting an environment variable”, “Setting an output parameter”) (docs.github.com)
  • [2] GitHub Docs — Contexts (env context does not include runner-inherited variables; steps.<id>.outputs) (docs.github.com)
  • [3] GitHub Docs — Variables reference (default env vars not accessible via env context; context alternatives) (docs.github.com)

Citations:

ACTION_REF must use step output, not $GITHUB_ENV.

Writing to $GITHUB_ENV makes values available only as shell variables in later steps. The env context (${{ env.* }}) contains only workflow/job/step env: block variables—not runner-inherited ones. Line 142's ACTION_REF: ${{ env.ACTION_REF }} will not resolve to the value written at line 78. Step outputs (via $GITHUB_OUTPUT and ${{ steps.refs.outputs.action_ref }}) are the correct way to pass values to workflow expressions.

Suggested fix 
-          echo "ACTION_REF=${GITHUB_REPOSITORY}@${action_ref_branch}" >> "$GITHUB_ENV"
+          action_ref="${GITHUB_REPOSITORY}@${action_ref_branch}"
+          echo "action_ref=$action_ref" >> "$GITHUB_OUTPUT"
+          echo "ACTION_REF=$action_ref" >> "$GITHUB_ENV"
...
-          ACTION_REF: ${{ env.ACTION_REF }}
+          ACTION_REF: ${{ steps.refs.outputs.action_ref }}


- name: Print deployment mode
shell: bash
run: |
echo "BUILD_ACTION_ENABLED=${BUILD_ACTION_ENABLED}"
echo "DEPLOY_DENO_ENABLED=${DEPLOY_DENO_ENABLED}"
echo "SKIP_BOT_EVENTS=${SKIP_BOT_EVENTS}"
echo "EXCLUDE_SUPPORTED_EVENTS=${EXCLUDE_SUPPORTED_EVENTS}"
echo "SOURCE_REF=${{ steps.refs.outputs.source_ref }}"
echo "IS_ARTIFACT_REF=${{ steps.refs.outputs.is_artifact_ref }}"
echo "IS_TAG_REF=${{ steps.refs.outputs.is_tag_ref }}"
echo "ACTION_REF=${ACTION_REF}"

- name: Publish action artifact branch
if: ${{ env.BUILD_ACTION_ENABLED == 'true' }}
uses: ubiquity-os/action-deploy-plugin@main
with:
action: ${{ github.event_name == 'delete' && 'delete' || 'publish' }}
treatAsEsm: true
sourcemap: false
sourcemap: true
pluginEntry: "${{ github.workspace }}/src/action.ts"
skipBotEvents: false
excludeSupportedEvents: ${{ env.EXCLUDE_SUPPORTED_EVENTS }}
skipBotEvents: ${{ env.SKIP_BOT_EVENTS }}
env:
APP_ID: ${{ secrets.APP_ID }}
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

- name: Check out the repository
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' }}
uses: actions/checkout@v6

- name: Set up Deno
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' }}
uses: denoland/setup-deno@v2
with:
deno-version: v2.x

- name: Install dependencies
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' && github.event_name != 'delete' }}
run: deno install --node-modules-dir=auto --no-lock

- name: Generate manifest for deploy
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' && github.event_name != 'delete' }}
run: deno x -A -y --no-lock npm:@ubiquity-os/plugin-manifest-tool@latest
Comment on lines +114 to +122

@coderabbitai coderabbitai Bot Mar 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Check for deno configuration files
fd -t f "(deno\.json|deno\.lock|\.github/workflows)" | head -20

Repository: ubiquity-os/command-demo

Length of output: 50

🏁 Script executed:

# Get the full context of the workflow file
cat -n .github/workflows/update-configuration.yml | head -130 | tail -40

Repository: ubiquity-os/command-demo

Length of output: 2438

🏁 Script executed:

# Check if there's a deno.lock file in the repository
find . -name "deno.lock" -o -name "deno.json" 2>/dev/null | head -20

Repository: ubiquity-os/command-demo

Length of output: 50

🌐 Web query:

Deno --no-lock flag behavior documentation

💡 Result:

--no-lock tells Deno not to auto-discover and use a lockfile (for example, the default deno.lock that would otherwise be picked up when Deno finds your project config). (docs.deno.com)

Context: since Deno v1.28, Deno will automatically discover/use (and create/update) deno.lock when a deno.json(c) is discovered; --no-lock is the documented opt-out for that auto-discovery behavior. (deno.com)

If you want to disable lockfiles via config instead of a CLI flag, you can set "lock": false in deno.json. (docs.deno.com)

Citations:

🌐 Web query:

Deno reproducibility lockfile auto-discovery

💡 Result:

Deno’s lockfile “auto-discovery” works like this:

  • Deno first auto-detects your config file (deno.json / deno.jsonc) by searching the current working directory and then walking up parent directories. You can override with --config. [1]
  • Once a config file is resolved, Deno uses lockfiles by default—and will create/use deno.lock alongside that config (unless configured otherwise). You can also set "lock": { "path": "./deno.lock", "frozen": true } or disable with "lock": false. [1]
  • This behavior was introduced so you no longer need to pass --lock=... manually; since Deno v1.28, the lockfile is automatically discovered and used when a config file is discovered. You can disable with --no-lock. [2]

Sources:
[1] Deno docs: deno.json / lockfile configuration and defaults (docs.deno.com)
[2] Deno v1.28 announcement (auto-discovered lockfiles; --no-lock) (deno.com)

Citations:

Pin Deno version and plugin-manifest-tool to specific versions.

deno-version: v2.x (semver range) and @ubiquity-os/plugin-manifest-tool@latest allow versions to drift over time. Pin both to exact versions (e.g., v2.0.0 and plugin-manifest-tool@1.2.3) for reproducible builds. The --no-lock flags are redundant here since the repository has no deno.json file to trigger lockfile auto-discovery, but the semver ranges and @latest tags are the actual reproducibility concerns.

env:
SKIP_BOT_EVENTS: ${{ env.SKIP_BOT_EVENTS }}
EXCLUDE_SUPPORTED_EVENTS: ${{ env.EXCLUDE_SUPPORTED_EVENTS }}
GITHUB_REF_NAME: ${{ steps.refs.outputs.source_ref }}

- uses: ubiquity-os/deno-plugin-adapter@main
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' && github.event_name != 'delete' }}
id: adapter
with:
pluginEntry: "./worker"

- uses: ubiquity-os/deno-deploy@main
if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
KERNEL_PUBLIC_KEY: ${{ secrets.KERNEL_PUBLIC_KEY }}
APP_ID: ${{ secrets.APP_ID }}
APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
APP_INSTALLATION_ID: ${{ secrets.APP_INSTALLATION_ID }}
ACTION_REF: ${{ env.ACTION_REF }}
LOG_LEVEL: ${{ secrets.LOG_LEVEL }}
USER_GITHUB_TOKEN: ${{ secrets.USER_GITHUB_TOKEN }}
with:
token: ${{ secrets.DENO_DEPLOY_TOKEN }}
action: ${{ github.event_name == 'delete' && 'delete' || 'deploy' }}
organization: ${{ secrets.DENO_ORG_NAME }}
entrypoint: ${{ github.event_name == 'delete' && 'src/deno.ts' || steps.adapter.outputs.entrypoint }}
project_name: ${{ secrets.DENO_PROJECT_NAME }}
sourceRef: ${{ steps.refs.outputs.source_ref }}
artifactPrefix: dist/
40 changes: 0 additions & 40 deletions .github/workflows/worker-delete.yml
View file
Open in desktop

This file was deleted.

107 changes: 0 additions & 107 deletions .github/workflows/worker-deploy.yml
View file
Open in desktop

This file was deleted.

Loading