From cb151afa980d38de06289fa3c7722068e681ee4f Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Thu, 20 Aug 2026 23:48:55 +0200 Subject: [PATCH] feat(ci): add the deploy-preview workflow PLATFORM.md already documents PLATFORM.md states that a PR touching platform/ gets a scorecard comment from deploy-preview.yml. The file did not exist, so deployment changes here merged with no readiness gate at all -- the only service repository in that position. It was not addable before: knowledge-ingest-worker declares no health path, which the SC-11 health_declared check treated as a failure, so adding the workflow would have turned every platform/ PR red. With the worker now explicitly exempt the scorecard passes, and the gate reports something true. Configuration matches the other six repositories and the values already used by publish.yml: deploy-dir platform, schema-version 0.20.0, the same digest-pinned context ref, environments production. --- .github/workflows/deploy-preview.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/deploy-preview.yml diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml new file mode 100644 index 0000000..026d0dc --- /dev/null +++ b/.github/workflows/deploy-preview.yml @@ -0,0 +1,27 @@ +# Deploy Preview for deploy-platform service repos. +# +# Any PR touching platform/ gets a full render + validation and a sticky +# "Deploy Preview" comment with the SC-11 readiness scorecard. +name: Deploy Preview + +on: + pull_request: + paths: + - 'platform/**' + +permissions: {} + +jobs: + deploy-preview: + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-validate.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 + with: + deploy-dir: platform + schema-version: 0.20.0 + image-lock-path: platform/images.lock.json + context-ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:9479bc22ae11183c0b68f257d2c1a21455be8c3cff602d3a491ea3ff31d01fe3 + environments: production + comment: true + permissions: + contents: read + packages: read + pull-requests: write