ci: sync Terraform-managed workflows from dev to main - #28
Closed
notchjpl wants to merge 1 commit into
Closed
Conversation
Adds the buildtime step + BUILD_TIME build-arg and the argo/ paths-ignore guard, which Terraform writes to the dev branch only. aws_prod_release.yml on main is the file that runs for release builds, so without this prod images are built without BUILD_TIME. Workflow files only - no application code and no argo overlay digest pin.
notchjpl
requested review from
LinaBell,
cpsiaki and
liebeskind
as code owners
August 16, 2026 21:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the Terraform-managed GitHub Actions workflows on
mainup to date withdev.Why
These workflows are generated from
config_texts/github_metaversecloud.tfand written by Terraform to thedevbranch only, somainnever received the recent changes:buildtimestep plus aBUILD_TIMEbuild-arg, stamping the image build time into the imagepaths-ignore: ['argo/**']on the dev build triggermainis what matters for production: areleaseevent builds from the tag, and the tag points at amaincommit, soaws_prod_release.ymlon main is the file that actually runs for prod builds. Until it carries theBUILD_TIMEbuild-arg, prod images are built without it and/api/system/healthreportsBUILD_TIME: "NOT SET".Why
paths-ignoremattersIt is now the only guard against a rebuild loop. Argo CD Image Updater writes the image digest back to
dev; that commit used to be marked[skip ci], but[skip ci]also suppressespull_requestevents — keyed on the PR HEAD commit — which silently killed everydev -> mainrelease PR: no run, no check suite, no Auto Release.[skip ci]has been removed and replaced by the path filter, which cannot leak into PR events.Scope
Only these files are touched, copied verbatim from
dev:.github/workflows/aws_dev_release_gitops.yml.github/workflows/aws_prod_release.ymlDeliberately not included: application code,
argo/overlays/dev/kustomization.yaml(the Image Updater digest pin, which belongs on the deploy branch only under the two-branch contract), and any other unreleaseddevwork. This branch is cut frommainand carries the workflow files alone, so merging it will not drag unreleased changes intomain.Legacy workflow files present on
mainbut removed ondevare left untouched — that cleanup is a separate decision.