Skip to content

Move the deploy pipelines' multi-line steps into tested scripts - #763

Draft
anth-volk wants to merge 5 commits into
ci-scripts-exceptionsfrom
ci-scripts-deploy
Draft

anth-volk wants to merge 5 commits into
ci-scripts-exceptionsfrom
ci-scripts-deploy

Conversation

@anth-volk

Copy link
Copy Markdown
Contributor

Fixes #761

Same-Repository Draft PR Check

  • This PR is a draft.
  • This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

Phase 1 step 1.7, part 2: the production deploy pipelines (simulation-deploy.reusable.yml, simulation-deploy.yml). Stacked on the part 1 PR.

The remaining 13 multi-line blocks are fixed.

Moved into tested scripts:

Step Script
Capture stable service state cloud-run-simulation-entry-stable-state.sh
Resolve exact candidate metadata cloud-run-simulation-entry-candidate.sh
Publish active routing state modal-publish-routing.sh
Select the v2 application name stage12-v2-application-name.sh
Validate v2 workers stage12-validate-v2-workers.sh
Stage 12 result check stage12-deployment-ready.sh
Deployment result check simulation-deployment-ready.sh

Other changes:

  • Build and push the entrypoint image are now separate steps. If the build fails, the push is still skipped.
  • Four backslash-continued commands are now single lines.
  • The executor app name is a one-line echo.

Behaviour is unchanged. A PyYAML comparison of the old and new workflows shows identical job if/needs/env/outputs/permissions/environment and identical step id/if/working-directory. The only env: change adds ENTRYPOINT_SERVICE: ${{ inputs.entrypoint_service }} to the two Cloud Run steps. Each script body equals the old inline code, with ${{ inputs.* }} replaced by a variable.

Points to review:

  • The scripts add set -u; every variable they read comes from env: or the runner.
  • The routing and v2-validation scripts now reject an empty Modal environment. That input is required, so this can't happen in practice.
  • Two scripts keep #!/bin/bash, because an existing executor test requires it for modal-*/simulation-* scripts.

The multi-line baseline is now empty, so sim.ci.multiline-run-is-script moves to enforced. Every workflow run: step is now a single line.

Testing

  • New tests/test_deploy_workflow_scripts.py: 39 tests using fake gcloud/uv and the real jq. They assert exact arguments, the full $GITHUB_OUTPUT text and exit codes, including failure paths and every combination of job results.
  • Entry tests: 224 pass. Executor test_modal_scripts.py: 60 pass, or 77 including the manifest and package-update tests.
  • Both guards pass, and guard --base-ref ci-scripts-exceptions passes.
  • actionlint is clean on all workflows, and all scripts are executable.

🤖 Generated with Claude Code

anth-volk and others added 5 commits October 13, 2026 00:29
deploy_entrypoint now captures the stable service state and resolves the
candidate metadata with cloud-run-simulation-entry-stable-state.sh and
cloud-run-simulation-entry-candidate.sh. Their bodies are the former inline
shell unchanged, except that the service name comes from the step's env:
instead of an interpolated expression; the $GITHUB_OUTPUT names and values,
step ids and job outputs are unchanged. Tests run them against fake gcloud
output with the real jq. Building and pushing the image become two
single-line steps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
update_routing now runs modal-publish-routing.sh with the Modal environment
as its argument, as the other Modal scripts do; its body is the former
inline shell, so the publisher receives the same arguments and --force-latest
only when FORCE_LATEST is true. Tests assert on the exact publisher calls.

The UK private-data credential sync was one backslash-continued command and
is now one line. The executor app name step substitutes the version inside
its single echo instead of through a temporary variable; the output is the
same for any version string.

The workflow-text tests now look for the force-latest flag in the script and
keep the routing publisher out of the Stage 12 jobs by script name too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
deploy_stage12_v2 now selects the v2 application name and validates the
deployed workers with stage12-v2-application-name.sh and
stage12-validate-v2-workers.sh, and stage12_v2_ready checks the job results
with stage12-deployment-ready.sh. Their bodies are the former inline shell,
so they write the same name= and file= outputs, and a failing bundle lookup
or validation still fails the step before anything is written. Tests cover
the outputs, the exact uv calls, the failure paths and every combination of
requested and skipped Stage 12 jobs.

The packaged-bundle validation and the v2 manifest publication were one
backslash-continued command each and are now one line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
deployment_ready now runs simulation-deployment-ready.sh, the former inline
checks unchanged: every phase must succeed, and the promotion must succeed
when requested and be skipped otherwise. Tests cover each combination; the
existing guard test now finds the result checks in the script and the
results in the step's env:. The deployment summary call was one
backslash-continued command and is now one line.

That removes the last multi-line run: block, so
sim.ci.multiline-run-is-script is enforced with an empty baseline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@anth-volk
anth-volk added this pull request to stack #755 October 12, 2026 20:30

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant