authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-10-05 19:53:50-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2026-10-05 19:53:50-07:00
log18c1210810cbdb798d28edda1826fa4de91992d1
treea528dddfdcc9ce593609993fb069f15d0dddfb76
parent9c49228f5425f644cff9b41ae88ca564d40d79fa
signature Signed by PGP key B5690EEEBB952194

fix(relay): stop forcing manual relay deploys by default (#13563)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2 files changed, 16 insertions(+), 15 deletions(-)

.github/workflows/deploy-relay.yml+5-5
......@@ -4,15 +4,15 @@ on:
44 push:
55 branches:
66 - main
7 # Alchemy does not redeploy the Worker when only a Config value read in its
8 # Init changes (alchemy-run/alchemy#1831), so a changed repository variable
9 # needs a forced deploy to reach production.
7 # Redeploys main after a variable or secret change. Alchemy redeploys the
8 # Worker when a value it reads changes, so force is rarely needed, and it
9 # replaces the Postgres runtime role (alchemy-run/alchemy#1832).
1010 workflow_dispatch:
1111 inputs:
1212 force:
13 description: Redeploy every resource, including ones with no detected changes
13 description: Redeploy every resource, including ones with no detected changes. Replaces the Postgres runtime role.
1414 type: boolean
15 default: true
15 default: false
1616
1717permissions:
1818 contents: read
docs/operations/release.md+11-10
......@@ -140,10 +140,11 @@ Required `production` environment secrets:
140140- `CLERK_SECRET_KEY`
141141- `APNS_PRIVATE_KEY`
142142
143The relay Worker reads these variables and secrets when it is deployed. Alchemy does not redeploy the
144Worker when only one of these values changes ([alchemy-run/alchemy#1831](https://github.com/alchemy-run/alchemy/issues/1831)),
145so a push to `main` without relay code changes leaves the old value in place. After changing one, run
146the **Deploy T3 Connect relay** workflow manually from `main` with **force** checked.
143After changing a variable or secret, run the **Deploy T3 Connect relay** workflow manually from
144`main` with **force** unchecked. Alchemy compares the values the Worker reads and redeploys it when
145one changed. Check **force** only to redeploy resources with no detected change: a forced run also
146replaces the Postgres runtime role and its password
147([alchemy-run/alchemy#1832](https://github.com/alchemy-run/alchemy/issues/1832)).
147148
148149The account-scoped repository credentials are consumed by Alchemy while provisioning relay stages; they
149150are not bound into the relay Worker. The production deployment uses an Axiom personal access token,
......@@ -168,7 +169,7 @@ because those builds register recovery and replace a deleted tunnel after wake.
1681691. Deploy the relay and migration with cleanup `off`.
1691702. Release the server build and confirm current hosts register recovery. Older hosts stay marked
170171 legacy and are never candidates.
1713. Set `dry-run`, run a forced relay deploy, and read the sweep counters (`scanned`, `wouldDelete`,
1723. Set `dry-run`, run a relay deploy, and read the sweep counters (`scanned`, `wouldDelete`,
172173 `skippedLegacy`, `skippedOrphan`, `failed`, `truncated`) across several sweeps. Each sweep records
173174 them, and the active `mode`, as `relay.managed_endpoint_reaper.*` attributes on its
174175 `relay.managed_endpoint_reaper.sweep` span in Axiom.
......@@ -178,10 +179,10 @@ because those builds register recovery and replace a deleted tunnel after wake.
178179The job runs every five minutes with a five-minute grace period for tunnels that lost their
179180connector, so a candidate is usually removed five to ten minutes after it goes down. Tunnels that
180181never connected wait an hour. One sweep attempts at most 100 deletions, so a backlog takes longer.
181Changing `RELAY_TUNNEL_CLEANUP_MODE`, including turning cleanup off during an incident, needs a forced
182relay deploy. Confirm the new `mode` on the next sweep span.
182Changing `RELAY_TUNNEL_CLEANUP_MODE`, including turning cleanup off during an incident, needs a relay
183deploy without force. Confirm the new `mode` on the next sweep span.
183184
184To roll back, set cleanup to `off` and run a forced relay deploy before downgrading any host. Keep the
185To roll back, set cleanup to `off` and run a relay deploy before downgrading any host. Keep the
185186recovery endpoints deployed while current server builds are in use. The nullable columns can stay.
186187
187188### Disposable-host canary
......@@ -201,8 +202,8 @@ stage, test Cloudflare account, disposable host, and disposable T3 home. Keep pr
201202 and pause it with `kill -STOP <first-pid>`. Wait until Cloudflare reports it down for over five
202203 minutes.
2032045. Confirm dry-run counts the first tunnel in `wouldDelete` and the second in `skippedLegacy`.
2046. Set cleanup `enabled` on the disposable stage and deploy it with `--force`. Confirm in the test
205 Cloudflare account that the first tunnel is deleted and the legacy tunnel still exists.
2056. Set cleanup `enabled` on the disposable stage and deploy. Confirm in the test Cloudflare account
206 that the first tunnel is deleted and the legacy tunnel still exists.
2062077. Resume the first child with `kill -CONT <first-pid>`. Confirm the running server detects the
207208 repeated rejection, requests recovery, and becomes reachable at the same hostname without a
208209 restart.