ci: deploy staging and production images after CI

Merged
PR
11h ago
+1555-218

Description

Merging into staging or master currently does not deploy the application. Run browser tests as part of CI and publish/deploy the same commit only after lint, types, unit tests and both builds pass. Keep builds on GitHub runners and use separate branch-restricted environments for staging and production.

Deploy immutable GHCR digests through Coolify. Check the branch head before building and again before image selection; refuse a release already superseded at either check. Reject mismatched applications, runtime version overrides and unapproved schema changes. Retry failed status reads within the deployment deadline, then check public readiness and the exact deployed commit. Verify the compiled instrumentation exports inside the image before publication. Manual image publication remains available without deploying.

Recheck the branch head immediately before selecting the image. Handle malformed health responses within the verification retries and include the last failed gate in the final error. Fork pull requests skip authenticated browser tests because they cannot receive repository secrets; those tests remain mandatory after merging into staging or master. Disable persisted checkout credentials in jobs that install dependencies and run tooling.

Type of change

  • Bug fix

How Has This Been Tested?

  • 31 Python tests covering build configuration and deployment guards.
  • actionlint on all three changed workflows.
  • Full unit suite: 2,153 passed, 4 skipped. TypeScript and focused ESLint pass. Database generation used the approved disposable local database; standard push hooks remain enabled.
  • Prettier and git diff --check.
  • Read-only preflight against the current staging and production applications.
  • API calls checked against the installed Coolify 4.5.3 controllers.
  • GitHub CI at 121d0e43: unit, lint/types, build, compiled-hook and browser checks passed; publication/deployment skipped for the PR.
  • Staging release b9c66d2e built, published, deployed and verified through CI run 41231167021.

Screenshots (if applicable)

Not applicable.

Checklist

  • Code follows project conventions.
  • Performed a self-review.
  • Local checks pass.

Notes for reviewers

Coolify integration credentials are installed in the existing GitHub environments. Source auto-deploy remains disabled so the VPS does not build images. The image supplies its own version; obsolete runtime version overrides have been disabled without restarting either running container.

An unknown deployed source version blocks release even when a schema digest is approved; restore its commit identity or fetch the missing history first. Both current environments expose verified commit SHAs. The project database wrapper permits a missing optional .env.local; CI uses the configured runner-local database variables.

GitHub and Coolify do not share an atomic branch lock. A release can finish while a newer commit queues. Releases are serialized and cancellation is disabled so a newer push does not interrupt Coolify verification after a mutation.

The workflow does not apply hosted migrations. Schema or migration-file changes block deployment until a fresh backup, explicit migration approval and verification are complete. Preserve the previous image digest for recovery. DNS, Vercel and subscription settings are unchanged.

Deployed to staging after #511. CI, immutable image publication, Coolify readiness and the exact public commit passed. Production promotion remains separate.