Skip to content

ci: run deploy-integration only for installer changes #695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BorisTyshkevich merged 1 commit into from
Oct 26, 2026
Merged

ci: run deploy-integration only for installer changes #695

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,14 +100,17 @@ jobs:
- '.github/workflows/**'
- 'packages/**'
# #692: the installer integration test (real Keeper + 2x2 ClickHouse
# cluster in Docker). The installer, its tests, and the workflow.
# cluster in Docker, ~5 min per image). Deliberately narrow: only the
# shipped installer files, the harness, and this workflow. SPA
# source, deps (package.json), Caddy/Helm/k8s, and the unit-level
# installer tests (covered by the `test` job) do not trigger it.
deploy:
- 'deploy/**'
- 'deploy/install.sh'
- 'deploy/uninstall.sh'
- 'deploy/lib/**'
- 'deploy/http_handlers.xml'
- 'tests/deploy/**'
- 'tests/helpers/deploy-*'
- 'tests/unit/*-script.test.js'
- 'package.json'
- '.github/workflows/**'
- '.github/workflows/ci.yml'
docker:
- 'Dockerfile'
- 'deploy/caddy/**'
Expand Down Expand Up @@ -427,11 +430,14 @@ jobs:
# /sql and /sql/config.json serve after install, upgrade, repair, partial
# failure, and uninstall. Matrix over the supported server flavours; pin exact
# tags so a moving image cannot turn this red unrelated to the diff.
# Runs only on PRs touching the installer (see the `deploy` filter), release
# tags, and manual dispatch — not on every push to main, and not nightly:
# the images are pinned, so an unchanged installer cannot drift.
deploy-integration:
needs: changes
if: >-
github.event_name == 'push' ||
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
(github.event_name == 'pull_request' && needs.changes.outputs.deploy == 'true')
runs-on: ubuntu-latest
timeout-minutes: 30
Expand Down
5 changes: 4 additions & 1 deletion .wiki/Deployment-and-Security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,10 @@ the target of a remote-source statement). Needs a cluster `<secret>` and the
documented minimal grants. `npm run test:deploy` (`tests/deploy/`, CI job
`deploy-integration`) runs it against Keeper + 2x2 ClickHouse on exact tags
(26.3.18.32, Antalya 25.8.33) and asserts byte-exact files on every node,
including a node killed mid-run. The release bundle ships `deploy/` (install.sh,
including a node killed mid-run. The job runs only on PRs that touch the
installer files (`deploy/install.sh`, `uninstall.sh`, `lib/`,
`http_handlers.xml`), `tests/deploy/`, or `ci.yml`, plus release tags and
manual dispatch — never for SPA-only changes or on every push to `main`. The release bundle ships `deploy/` (install.sh,
uninstall.sh, lib/) for use with `--artifact`. One installer at a time (no lock);
`--ddl-timeout` must be >= 1; the password reaches only `clickhouse-client`.

Expand Down
Loading