Skip to content

dev2/deploy-poll.sh: deploy private-repo sites on merge without Actions - #194

Merged
ralyodio merged 1 commit into
masterfrom
dev2-deploy-poll
Oct 19, 2026
Merged

ralyodio merged 1 commit into
masterfrom
dev2-deploy-poll

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Anthony: "disable it we just need auto deploy to work not builds/tests on private repos".

GitHub won't start Actions jobs on private repos (org billing), and Deploy to dev2 is an Action, so the 24 private dev2 sites stopped deploying on merge. This replaces it from the box itself: a 2-minute cron that git ls-remotes each private site's default branch with its deploy key and runs deploy-app.sh <sha> when it differs from .deploy-state, through deploy-gate (3 at a time). It won't retry a failed sha until a newer commit lands. Public repos are skipped.

Tested on dev2: --status matched exactly the 24 sites that have a Deploy-to-dev2 workflow; 22 current, 2 behind (ch4nnels, weedforcrypto: merges the block never deployed). shellcheck clean.

🤖 Generated with Claude Code

…b Actions

Private profullstack repos cannot start Actions jobs while the org bill is
unpaid, and the generated Deploy to dev2 workflow is an Action, so merges to
those 24 sites stopped deploying. The workflow only ran deploy-app.sh <sha>
over ssh; this does the same from dev2 on a 2-minute cron: ls-remote the
default branch with the site's deploy key, deploy when it differs from
.deploy-state, through deploy-gate. A failed sha waits for a newer commit.
Public repos are skipped since their Actions still run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

33 finding(s)

HIGH/CRITICAL: 7 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1060
HIGH py-ssrf-outbound-request dev2/dev2-site:1775
HIGH sh-remote-script-execution root-ubuntu.sh:3250
HIGH sh-remote-script-execution root-ubuntu.sh:3251
HIGH sh-remote-script-execution root-ubuntu.sh:5146
HIGH sh-remote-script-execution root-ubuntu.sh:5150
MEDIUM sql-template-interpolation dev2/dev2-site:1286
MEDIUM sql-template-interpolation dev2/dev2-site:1363
MEDIUM sh-remote-script-execution root-ubuntu.sh:5354
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1047
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-credential src/credentials.ts:53
LOW secret-generic-credential src/credentials.ts:56
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 029d6c9 into master Oct 19, 2026
5 checks passed
@ralyodio
ralyodio deleted the dev2-deploy-poll branch October 19, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant