ci: typecheck/test/build + real-cloud e2e deploy - #11
Merged
Conversation
Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…le build The workspace id is an identifier, not a credential, so e2e-deploy reads it from vars.* rather than secrets.*. Also serialize the CI build job: the storefront is built by two turbo tasks that race on .next under parallelism. Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wmadden-electric
force-pushed
the
claude/cool-villani-cd10a9
branch
from
July 7, 2026 18:19
327d0f8 to
47535c5
Compare
wmadden
approved these changes
Jul 7, 2026
wmadden
pushed a commit
that referenced
this pull request
Jul 22, 2026
… requires The deploy path runs the alchemy CLI, whose command tree imports the Cloudflare provider namespace and platform services at load time — requiring @effect/platform-node and @effect/platform-bun. alchemy declares both as optional peerDependencies, so a package-manager install of an app depending only on @prisma/composer-prisma-cloud never installs them, and prisma-composer deploy dies before planning anything: Cannot find module "@effect/platform-node/NodeServices" from ".../node_modules/alchemy/src/Cloudflare/Workers/WorkerBridge.ts" (then the @effect/platform-bun/BunRuntime twin from Util/PlatformServices). This workspace never sees the failure because pnpm resolves the optional peers into its own tree, and any app developed inside a checkout inherits them through parent-directory module resolution — only a standalone install hits it, which is exactly the consumer this package is for. Surfaced by the open-chat port (its FRICTION.md #11), which had to declare both packages as app devDependencies to deploy at all. Declaring them as real dependencies here puts the knowledge where it belongs: this package pins alchemy exactly and always drives its CLI, so alchemy's "optional" peers are, for every consumer of this package, mandatory. Versions are the ones the workspace already resolves. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: willbot <w.a.madden+machine@gmail.com> Signed-off-by: Will Madden <madden@prisma.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Layers DCO enforcement and a real-cloud e2e deploy on top of the CI that #12 introduced, and fills the one gap that CI left: example artifacts (including the storefront's
next build) were never built by any job. Rebased onto currentmain.Changes
.github/workflows/ci.yml— adds abuildjob to chore(quality): Biome + strict TypeScript scaffolding and CI #12's existing lint / typecheck / test jobs:pnpm install --frozen-lockfile→turbo run build→ clean-tree check.typecheck/testdon't depend on^build, so nothing else exercised the example builds. Runs with--concurrency=1(see note below)..github/workflows/dco.yml— enforces aSigned-off-by:trailer on every commit in the PR range (merge commits excluded, standard DCO-bot behavior; this history has GitHub-style merge commits without their own trailer). Echo-stub pass onmerge_group..github/workflows/e2e-deploy.yml— deploysexamples/makerkit-helloto real Prisma Cloud, verifies it serves, then destroys it. Push tomain, same-repo PRs only (fork PRs excluded — secrets don't exist there), andworkflow_dispatch. Own concurrency group,cancel-in-progress: false.examples/makerkit-hello/alchemy.run.ts— stack name isprocess.env['HELLO_STACK_NAME'] ?? 'makerkit-hello'.lower()derives cloud resource ids from it, so e2e setshello-ci-${{ github.run_id }}to keep concurrent runs collision-free. Default unchanged.Reuses #12's
./.github/actions/setup(mise-based node + bun) as-is.Why / e2e design notes
if: always()), same job/dir as deploy: alchemy state is runner-local and dies with the runner, so a failed run that skips destroy orphans cloud resources nobody can clean up later. A destroy failure fails the workflow loudly. Skips only when no state dir exists."ok":1. A second deploy without rebuilding must reportto noop(idempotence; string verified against alchemy's CLI source)..alchemy/state/**/__stack_output__.json→.outputs.url), not deploy stdout.bunx --bun alchemy ...(under node it fails onCannot find package 'bun'), invoked directly rather than via the package'sdeployscript (which sources../../.env, absent in CI).contents: read, nopull_request_target, secrets viaenv:only,ALCHEMY_PASSWORDgenerated per run and masked before it touches$GITHUB_ENV.--concurrency=1on the build job — the storefront is built by two turbo tasks (its ownbuildand the parentstorefront-auth'sbuild:compute), which race on the shared.nextdir under parallelism and flakily fail from a cold cache. Serializing sidesteps it; the underlying duplicate-build is a separate follow-up.Setup required before the first e2e run
In Settings → Secrets and variables → Actions:
PRISMA_SERVICE_TOKEN— a Prisma Console service token (a real credential).PRISMA_WORKSPACE_ID— the target workspace id (an identifier, not a credential, so it's a repo variable, read viavars.*).The e2e workflow fails until both exist;
ci.ymlanddco.ymldon't depend on them.🤖 Generated with Claude Code