varasys/metronome
Watch
4
0
Fork
You've already forked metronome
 1
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

ci(store): release-on-merge + push-to-deploy to polymeter-sync #2

Merged
casey merged 1 commit from store-release-on-merge into main 2026-10-14 21:12:30 +00:00
Conversation 0 Commits 1 Files changed 4 +360 -164
casey commented 2026-10-14 02:08:02 +00:00
Owner
Copy link

This switches the store release to release-on-merge, the same model shelf uses.

  • A merge to main that bumps store/VERSION publishes store-v<VERSION>, built from the merge commit, which the instance signs.
  • CI then sends the lab a deploy request: ssh deploy-polymeter-sync@polymeter-sync <tag>, a forced command.
  • The guest refuses any commit not signed by the pinned instance key. Otherwise it verifies the checksums, switches versions atomically, health-checks and rolls back on failure (lab rb60 and rb63 contract C).
  • The build now runs twice and compares the bytes on every release.
  • store/VERSION starts at 0.1.0, which is already released, so merging this PR releases and deploys nothing.
  • The tag-triggered store-release.yml is deleted.

Before the first real release (the 0.1.1 bump), the operator mints the deploy cert with scripts/yubikey-tool.sh deploy polymeter-sync. That sets the POLYMETER_SYNC_DEPLOY_KEY and POLYMETER_SYNC_DEPLOY_CERT Actions secrets.

Opened by the lab hub (ctrl).

This switches the store release to **release-on-merge**, the same model shelf uses. - A merge to `main` that bumps `store/VERSION` publishes `store-v<VERSION>`, built from the merge commit, which the instance signs. - CI then sends the lab a deploy request: `ssh deploy-polymeter-sync@polymeter-sync <tag>`, a forced command. - The guest refuses any commit not signed by the pinned instance key. Otherwise it verifies the checksums, switches versions atomically, health-checks and rolls back on failure (lab rb60 and rb63 contract C). - The build now runs twice and compares the bytes on every release. - `store/VERSION` starts at **0.1.0**, which is already released, so **merging this PR releases and deploys nothing.** - The tag-triggered `store-release.yml` is deleted. **Before the first real release** (the 0.1.1 bump), the operator mints the deploy cert with `scripts/yubikey-tool.sh deploy polymeter-sync`. That sets the `POLYMETER_SYNC_DEPLOY_KEY` and `POLYMETER_SYNC_DEPLOY_CERT` Actions secrets. Opened by the lab hub (ctrl).
A merge to main that bumps store/VERSION is now the store release, and it deploys itself:
CI publishes store-v<VERSION> from the instance-signed merge commit, then rings the lab's
doorbell (ssh deploy-polymeter-sync@polymeter-sync <tag>, a forced command). The guest's
installer refuses any release whose commit is not signed by the pinned instance key, then
checksums, switches atomically, health-checks and rolls back on failure.

store/VERSION starts at 0.1.0 (already released), so merging this PR releases nothing.
Replaces the tag-triggered store-release.yml.
casey merged commit bead4c3a2e into main 2026-10-14 21:12:30 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
varasys/metronome!2
No description provided.