Skip to content

feat: add production and staging deployment workflows #3127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
levivannoort merged 4 commits into from
Jul 20, 2026
Merged

feat: add production and staging deployment workflows #3127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bc1a928
feat: add production and staging deployment workflows for console
levivannoort Jul 20, 2026
d44a07b
Update production.yml
levivannoort Jul 20, 2026
771f09f
Update staging.yml
levivannoort Jul 20, 2026
2abbc8f
fix(deployment): update workflows to create pull requests for image t…
levivannoort Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 106 additions & 0 deletions .github/workflows/production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
name: Production deployment

on:
workflow_dispatch:
release:
types: [published]

concurrency:
group: ${{ github.workflow }}
cancel-in-progress: false

env:
ENVIRONMENT: production
DECLARATIVE_OWNER: appwrite-labs
DECLARATIVE_REPOSITORY: cloud-applications
DECLARATIVE_ALIAS: cloud-console
IMAGE_NAME: appwrite/console-cloud
TAG: ${{ github.event.release.tag_name || github.sha }}

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout the repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Build and push Docker image
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ env.IMAGE_NAME }}:${{ env.TAG }}

@greptile-apps greptile-apps Bot Jul 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Release Aliases Stop Updating

The old release job pushed major.minor.patch, major.minor, and major tags for appwrite/console-cloud, but this workflow now pushes only the raw release tag. Any production consumer still pinned to the moving 1 or 1.2 aliases will stay on the last image from the old workflow while releases continue deploying a different tag through the declarative repo.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/production.yml
Line: 41

Comment:
**Release Aliases Stop Updating**

The old release job pushed `major.minor.patch`, `major.minor`, and `major` tags for `appwrite/console-cloud`, but this workflow now pushes only the raw release tag. Any production consumer still pinned to the moving `1` or `1.2` aliases will stay on the last image from the old workflow while releases continue deploying a different tag through the declarative repo.

How can I resolve this? If you propose a fix, please make it concise.

Fix in Claude Code Fix in Codex

build-args: |
"PUBLIC_CONSOLE_MODE=cloud"
"PUBLIC_CONSOLE_FEATURE_FLAGS="
"PUBLIC_APPWRITE_MULTI_REGION=true"
"PUBLIC_CONSOLE_MOCK_AI_SUGGESTIONS=false"
"PUBLIC_GROWTH_ENDPOINT=${{ vars.VITE_APPWRITE_GROWTH_ENDPOINT }}"
"PUBLIC_STRIPE_KEY=${{ secrets.PUBLIC_STRIPE_KEY }}"
"PUBLIC_CONSOLE_FINGERPRINT_KEY=${{ secrets.PUBLIC_CONSOLE_FINGERPRINT_KEY }}"
"SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}"
"SENTRY_RELEASE=${{ github.event.release.tag_name }}"
Comment thread
greptile-apps[bot] marked this conversation as resolved.

deploy:
needs: build
runs-on: ubuntu-latest
# Shared across the staging and production workflows so their deploy
# jobs never push to cloud-applications at the same time.
concurrency:
group: declarative-deploy
cancel-in-progress: false
steps:
- name: Get token for ${{ env.DECLARATIVE_REPOSITORY }}
id: app-token
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
with:
app-id: ${{ vars.DECLARATIVE_DEPLOYMENT_GITHUB_APP_ID }}
private-key: ${{ secrets.DECLARATIVE_DEPLOYMENT_GITHUB_APP_PRIVATE_KEY }}
owner: ${{ env.DECLARATIVE_OWNER }}
repositories: ${{ env.DECLARATIVE_REPOSITORY }}

- name: Checkout ${{ env.DECLARATIVE_REPOSITORY }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ env.DECLARATIVE_OWNER }}/${{ env.DECLARATIVE_REPOSITORY }}
token: ${{ steps.app-token.outputs.token }}
Comment thread
greptile-apps[bot] marked this conversation as resolved.
# Don't leave the write-capable token in .git/config for later steps.
persist-credentials: false

- name: Update image tag
run: yq -i '.[strenv(DECLARATIVE_ALIAS)].image.tag = strenv(TAG)' ${{ env.ENVIRONMENT }}/cloud/default.yaml

- name: Open pull request
# The release author reviews; falls back to the dispatcher for
# manual runs. The PR author is the GitHub App bot, so requesting
# the release author as reviewer is always allowed.
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
REVIEWER: ${{ github.event.release.author.login || github.actor }}
BRANCH: deploy/console-${{ env.TAG }}
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add ${{ env.ENVIRONMENT }}/cloud/default.yaml
if git diff --cached --quiet; then
echo "No changes to commit"
exit 0
fi
git checkout -b "$BRANCH"
git commit -m "chore(${{ env.ENVIRONMENT }}): console image tag to ${{ env.TAG }}"
git push "https://x-access-token:${GH_TOKEN}@github.com/${{ env.DECLARATIVE_OWNER }}/${{ env.DECLARATIVE_REPOSITORY }}.git" "$BRANCH"
gh pr create \
--base main \
--head "$BRANCH" \
--reviewer "$REVIEWER" \
--title "chore(${{ env.ENVIRONMENT }}): console image tag to ${{ env.TAG }}" \
--body "Promotes \`${{ env.IMAGE_NAME }}:${{ env.TAG }}\` to production. Requested by @$REVIEWER."
83 changes: 0 additions & 83 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,89 +5,6 @@ on:
types: [published]

jobs:
publish-cloud:
runs-on: ubuntu-latest
steps:
- name: Checkout the repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: appwrite/console-cloud
tags: |
type=semver,pattern={{major}}.{{minor}}.{{patch}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
- name: Build and push Docker image
id: push
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
"PUBLIC_CONSOLE_MODE=cloud"
"PUBLIC_CONSOLE_FEATURE_FLAGS="
"PUBLIC_APPWRITE_MULTI_REGION=true"
"PUBLIC_CONSOLE_MOCK_AI_SUGGESTIONS=false"
"PUBLIC_GROWTH_ENDPOINT=${{ vars.VITE_APPWRITE_GROWTH_ENDPOINT }}"
"PUBLIC_STRIPE_KEY=${{ secrets.PUBLIC_STRIPE_KEY }}"
"PUBLIC_CONSOLE_FINGERPRINT_KEY=${{ secrets.PUBLIC_CONSOLE_FINGERPRINT_KEY }}"
"SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}"
"SENTRY_RELEASE=${{ github.event.release.tag_name }}"
publish-cloud-stage:
environment: staging
runs-on: ubuntu-latest
steps:
- name: Checkout the repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: appwrite/console-cloud-stage
tags: |
type=semver,pattern={{major}}.{{minor}}.{{patch}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
- name: Build and push Docker image
id: push
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
"PUBLIC_CONSOLE_MODE=cloud"
"PUBLIC_CONSOLE_FEATURE_FLAGS="
"PUBLIC_APPWRITE_MULTI_REGION=true"
"PUBLIC_CONSOLE_MOCK_AI_SUGGESTIONS=false"
"PUBLIC_GROWTH_ENDPOINT=${{ vars.VITE_APPWRITE_GROWTH_ENDPOINT }}"
"PUBLIC_STRIPE_KEY=${{ secrets.PUBLIC_STRIPE_KEY_STAGE }}"
"PUBLIC_CONSOLE_FINGERPRINT_KEY=${{ secrets.PUBLIC_CONSOLE_FINGERPRINT_KEY_STAGE }}"
publish-self-hosted:
runs-on: ubuntu-latest
steps:
Expand Down
94 changes: 94 additions & 0 deletions .github/workflows/staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
name: Staging deployment

on:
workflow_dispatch:
push:
branches:
- main

concurrency:
group: ${{ github.workflow }}
cancel-in-progress: false

env:
ENVIRONMENT: staging
DECLARATIVE_OWNER: appwrite-labs
DECLARATIVE_REPOSITORY: cloud-applications
DECLARATIVE_ALIAS: cloud-console
IMAGE_NAME: appwrite/console-cloud-stage
TAG: ${{ github.sha }}

jobs:
build:
environment: staging
runs-on: ubuntu-latest
steps:
- name: Checkout the repo
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Build and push Docker image
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ env.IMAGE_NAME }}:${{ env.TAG }}
build-args: |
"PUBLIC_CONSOLE_MODE=cloud"
"PUBLIC_CONSOLE_FEATURE_FLAGS="
"PUBLIC_APPWRITE_MULTI_REGION=true"
"PUBLIC_CONSOLE_MOCK_AI_SUGGESTIONS=false"
"PUBLIC_GROWTH_ENDPOINT=${{ vars.VITE_APPWRITE_GROWTH_ENDPOINT }}"
"PUBLIC_STRIPE_KEY=${{ secrets.PUBLIC_STRIPE_KEY_STAGE }}"
"PUBLIC_CONSOLE_FINGERPRINT_KEY=${{ secrets.PUBLIC_CONSOLE_FINGERPRINT_KEY_STAGE }}"

deploy:
needs: build
runs-on: ubuntu-latest
# Shared across the staging and production workflows so their deploy
# jobs never push to cloud-applications at the same time.
concurrency:
group: declarative-deploy
cancel-in-progress: false
steps:
- name: Get token for ${{ env.DECLARATIVE_REPOSITORY }}
id: app-token
uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
with:
app-id: ${{ vars.DECLARATIVE_DEPLOYMENT_GITHUB_APP_ID }}
private-key: ${{ secrets.DECLARATIVE_DEPLOYMENT_GITHUB_APP_PRIVATE_KEY }}
owner: ${{ env.DECLARATIVE_OWNER }}
repositories: ${{ env.DECLARATIVE_REPOSITORY }}

- name: Checkout ${{ env.DECLARATIVE_REPOSITORY }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ env.DECLARATIVE_OWNER }}/${{ env.DECLARATIVE_REPOSITORY }}
token: ${{ steps.app-token.outputs.token }}
Comment thread
greptile-apps[bot] marked this conversation as resolved.
# Don't leave the write-capable token in .git/config for later steps.
persist-credentials: false

- name: Update image tag
run: yq -i '.[strenv(DECLARATIVE_ALIAS)].image.tag = strenv(TAG)' ${{ env.ENVIRONMENT }}/cloud/default.yaml

- name: Commit and push
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add ${{ env.ENVIRONMENT }}/cloud/default.yaml
if git diff --cached --quiet; then
echo "No changes to commit"
else
git commit -m "chore(${{ env.ENVIRONMENT }}): console image tag to ${{ env.TAG }}"
git push "https://x-access-token:${GH_TOKEN}@github.com/${{ env.DECLARATIVE_OWNER }}/${{ env.DECLARATIVE_REPOSITORY }}.git" HEAD:main
fi