1name: Deploy T3 Connect relay
2
3on:
4 push:
5 branches:
6 - main
7 # Redeploys main after a variable or secret change. Alchemy redeploys the
8 # Worker when a value it reads changes, so force is rarely needed, and it
9 # replaces the Postgres runtime role (alchemy-run/alchemy#1832).
10 workflow_dispatch:
11 inputs:
12 force:
13 description: Redeploy every resource, including ones with no detected changes. Replaces the Postgres runtime role.
14 type: boolean
15 default: false
16
17permissions:
18 contents: read
19 id-token: none
20 statuses: write
21
22concurrency:
23 group: relay-production
24 cancel-in-progress: false
25
26jobs:
27 deploy_relay:
28 name: Deploy production relay
29 # A manual run from another branch would deploy that branch to production.
30 if: github.ref == 'refs/heads/main'
31 runs-on: blacksmith-8vcpu-ubuntu-2404
32 timeout-minutes: 15
33 environment:
34 name: production
35 env:
36 CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
37 PLANETSCALE_ORGANIZATION: ${{ vars.PLANETSCALE_ORGANIZATION }}
38 AXIOM_ORG_ID: ${{ vars.AXIOM_ORG_ID }}
39 RELAY_DOMAIN: ${{ vars.RELAY_DOMAIN }}
40 RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }}
41 RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
42 RELAY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_TUNNEL_CLEANUP_MODE }}
43 RELAY_LEGACY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_LEGACY_TUNNEL_CLEANUP_MODE }}
44 CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
45 CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
46 APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}
47 APNS_TEAM_ID: ${{ vars.APNS_TEAM_ID }}
48 APNS_KEY_ID: ${{ vars.APNS_KEY_ID }}
49 APNS_BUNDLE_ID: ${{ vars.APNS_BUNDLE_ID }}
50 ALCHEMY_TELEMETRY_DISABLED: "1"
51 steps:
52 - name: Checkout
53 uses: actions/checkout@v6
54 with:
55 sparse-checkout: |
56 /*
57 !/.repos/
58 sparse-checkout-cone-mode: false
59
60 - name: Setup Vite+
61 uses: voidzero-dev/setup-vp@v1
62 with:
63 node-version-file: package.json
64 cache: true
65 run-install: |
66 args:
67 - --filter=t3code-relay...
68
69 - name: Deploy production relay stage
70 run: vp run --filter t3code-relay deploy --stage prod --yes --no-input ${{ inputs.force && '--force' || '' }}
71 env:
72 # The PublishClientConfig action writes the client env here instead
73 # of the repo-root .env; nothing on the runner reads it.
74 T3CODE_RELAY_CLIENT_CONFIG_ENV: ${{ runner.temp }}/relay-client-config.env
75 CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
76 PLANETSCALE_API_TOKEN_ID: ${{ secrets.PLANETSCALE_API_TOKEN_ID }}
77 PLANETSCALE_API_TOKEN: ${{ secrets.PLANETSCALE_API_TOKEN }}
78 AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
79 CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
80 APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
81 FCM_SERVICE_ACCOUNT: ${{ secrets.FCM_SERVICE_ACCOUNT }}
82
83 - name: Publish relay deploy commit status
84 uses: actions/github-script@v8
85 with:
86 script: |
87 await github.rest.repos.createCommitStatus({
88 owner: context.repo.owner,
89 repo: context.repo.repo,
90 sha: context.sha,
91 state: "success",
92 context: "Relay deploy / production",
93 description: "Relay production deploy completed.",
94 target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
95 });