← all branches

feat/tb-deploy

needs attentionviewing older commit
5aef105 · fullPR #261reviewed 2026-07-06 17:52 UTC6H · 9M · 2L
The branch
Purpose
Replace shared admin TINYBIRD_TOKEN with per-env least-privilege tokens and automate Tinybird schema deployment lifecycle.
Goal
Wires Tinybird deploy strategy: 3 workspaces, ephemeral per-PR branches, per-env token split, schema-CD in CI, and a durable rule doc as SSOT.
Sub-goals
  • SG-1: Strategy rule doc + token model
  • SG-2: Per-env metrics-SSM seed
  • SG-3: Vercel per-env tokens
  • SG-4: Ephemeral per-PR branch + cleanup
  • SG-5: Schema-CD jobs
  • SG-6: Fold into shared rules
The changes (whole branch)
What
Added tinybird-deployment.md rule doc (250 lines), updated 5 GHA workflows, added TOKEN declarations to datafiles, updated README and rule docs.
Why
Shared admin token violated ADR-011; first staging metrics deploy failed due to missing SSM params.
Areas
.github/workflows+369−46.claude/rules+274−2infra/tinybird+70−43
Blast
11 files, +713/-91 lines across CI workflows (5), infra/tinybird (3), and .claude/rules (3). No TypeScript changes.
secrets-contract ci-pipeline
➖typecheck· no TypeScript changes➖tests· CI/infra/docs only➖coderabbit· no .coderabbit.yaml➖gh-ci-checks· check API not accessible

Findings · 16

correctness3

high

tb deploy --check uses admin token — breaks when token hardening ships

.github/workflows/pr-checks.yml:414

high

tinybird-prod runs in parallel with cdk-deploy — schema before Lambda update risk

.github/workflows/r_p.yml:311

medium

tb_provision token extraction may target different workspace than create step

.github/workflows/preview-provision.yml:334

security4

high

curl-pipe-to-sh for tb CLI — no version pin or hash (5 workflows)

.github/workflows/staging-update.yml:223

medium

BRANCH_TOKEN written to GITHUB_OUTPUT before add-mask

.github/workflows/preview-provision.yml:339

medium

Legacy admin workspace token emitted to GITHUB_OUTPUT without add-mask

.github/workflows/preview-provision.yml:282

medium

Admin token seeded to dev SSM — deferred hardening

.github/workflows/preview-provision.yml:825

conventions3

high

Branch cap inconsistency: rule doc says 4, README says 6

infra/tinybird/README.md:87

medium

tinybird-deployment.md frontmatter missing pr-checks.yml

.claude/rules/tinybird-deployment.md:2

medium

Malformed markdown table in migration-pipeline.md

.claude/rules/migration-pipeline.md:63

tests4

high

tinybird-check silently succeeds when TINYBIRD_TOKEN_DEV is unset

.github/workflows/pr-checks.yml:417

high

tinybird-check validates against shared dev workspace — not a clean reference

.github/workflows/pr-checks.yml:427

medium

tinybird-check has no job-level path guard — always success

.github/workflows/pr-checks.yml:387

medium

awk token extraction is fragile — silent fallback if CLI output format changes

.github/workflows/preview-provision.yml:334

improvement2

medium

tb CLI install duplicated across 5 workflows — candidate for composite action

.github/workflows/staging-update.yml:223

low

Staging tinybird-staging runs --check then deploy — check is redundant

.github/workflows/staging-update.yml:230

History · 10 commits

  1. 5d30429safeincremental0H · 0M · 1L2026-07-08 23:04
  2. 19bac85needs attentionincremental0H · 5M · 6L2026-07-08 22:46
  3. 92e890aneeds attentionincremental0H · 1M · 3L2026-07-08 21:46
  4. e81a781needs attentionincremental0H · 4M · 4L2026-07-08 21:31
  5. 2eca91cneeds attentionfull5H · 13M · 12L2026-07-08 19:18
  6. cf63bb1needs attentionincremental4H · 4M · 7L2026-07-07 19:47
  7. f43d034needs attentionincremental2H · 3M · 3L2026-07-07 18:35
  8. b7800c0needs attentionincremental1H · 2M · 7L2026-07-07 03:31
  9. 5aef105needs attentionfull6H · 9M · 2L2026-07-06 17:52current
  10. 95b4484blockedfull3H · 8M · 4L2026-07-06 05:36