← all branches

feat/tb-deploy

needs attentionviewing older commit
92e890a · incrementalPR #261reviewed 2026-07-08 21:46 UTC0H · 1M · 3L · 3I
The branch
Purpose
Replace Batu's single shared Tinybird admin token with per-environment workspace isolation (dev/stg/prod) plus ephemeral per-PR Forward branches, establishing a reproducible deployment path
Goal
Full per-env least-privilege token split, durable schema-CD lane, and a tinybird-deployment.md rule doc automating what was bootstrapped manually for stg/prod workspaces
Sub-goals
  • SG-1: Strategy rule doc + README de-stale; scoped runtime vs CI-only deploy token split
  • SG-2: Per-env metrics-SSM seed across all three lanes (preview/staging/prod)
  • SG-3: Vercel per-env tokens (operator action + doc)
  • SG-4: Ephemeral per-PR Tinybird Forward branch provisioning + cleanup on PR close
  • SG-5: Schema-CD — tinybird-staging (auto on merge) + tinybird-prod (gated) jobs
  • SG-6: Fold per-env tokens + schema-CD into infrastructure.md and migration-pipeline.md
The changes (whole branch)
What
Added per-env workspace token split, ephemeral per-PR Forward branches, three-lane schema-CD, composite tb-install action replacing curl|sh, CI least-privilege permissions hardening, and the tinybird-deployment.md SSOT
Why
Replace a single shared admin token with least-privilege per-env tokens; mirror the DB migration pipeline three-lane shape for Tinybird schema; eliminate supply-chain risk from unpinned curl|sh installer
Areas
.claude/rules/+280−2.github/+512−55infra/tinybird/+118−58
Blast
15 files, +929/-109 branch-wide; CI/infra/docs only, no application code
TINYBIRD_DEPLOY_TOKEN_STG and _PROD secrets still pending — schema-CD jobs skip cleanly until set 4-branch-per-workspace cap: tmp_ci_ cleanup on PR close is critical to avoid blocking new previews
➖ci-checks· GraphQL statusCheckRollup not accessible with current token scope➖coderabbit· No .coderabbit.yaml in repo; CodeRabbit has paused reviews on this branch

Findings · 7

correctness2

low

tb --version verifies local PATH but not the GITHUB_PATH entry

.github/actions/tb-install/action.yml:29

The 'export PATH=$HOME/.local/bin:$PATH' on line 32 proves the binary is at ~/.local/bin for this shell block only. If uv placed tb at a different path, tb --version correctly fails and the step fails (good). But if GITHUB_PATH was appended with the wrong path while uv placed tb at the right one, tb --version passes while downstream steps get a broken PATH. Minor: in practice uv always installs to its standard tool dir.

info

tinybird-prod DAG ordering guarantees no race with rollback

.github/workflows/release-promote.yml:863

tinybird-prod needs [preflight, cdk-deploy] and completes well before rollback's deepest dependency (postflight through vercel-promote, stripe-bootstrap, db-migrate). Omitting it from rollback's needs array introduces no race condition.

security1

info

PyPI version pin comment documents the risk acceptance clearly

.github/actions/tb-install/action.yml:9

The comment correctly notes PyPI immutability for published releases as the primary mitigation, and names --generate-hashes as the stronger path. Transitive deps are not hash-locked (a narrow residual gap), but acceptable for a CLI tool where tokens are short-lived.

conventions1

info

Rollback exclusion of tinybird-prod is correct and well-documented

.github/workflows/release-promote.yml:856

Removing tinybird-prod from the rollback job needs/if is correct per Forward's create-promote-remove model (failed deploy = no promotion, previous schema stays live). The inline comment captures all three reasons accurately and aligns with tinybird-deployment.md SSOT. No ADR violation.

tests2

medium

No isolated smoke test for the tb-install composite action

.github/actions/tb-install/action.yml:1

The composite action is exercised indirectly via tinybird-check (install then tb test), but only when infra/tinybird/ or tb-install/ files change. A broken action that still passes tb --version would surface 6+ minutes in, after Docker image pull. A dedicated step that calls the action and asserts tb --version exits 0 in isolation would give faster signal. Carry-over from round 4.

low

Trigger expansion won't fire if only a calling workflow's version pin changes

.github/workflows/pr-checks.yml:411

The path filter now includes .github/actions/tb-install/ so action-file changes are exercised. But if a caller bumps only a with:version override without touching action.yml itself, the trigger won't fire. Low risk: all callers currently use the default version.

improvement1

low

--force flag in uv tool install prevents cache reuse

.github/actions/tb-install/action.yml:28

uv's setup action includes a tool cache; --force bypasses it and always reinstalls, adding ~5-10s per run. uv tool install is idempotent on version match, so omitting --force is safe.

History · 10 commits

  1. 5d30429safeincremental0H · 0M · 1L2026-07-08 23:04
  2. 19bac85needs attentionincremental0H · 5M · 6L2026-07-08 22:46
  3. 92e890aneeds attentionincremental0H · 1M · 3L2026-07-08 21:46current
  4. e81a781needs attentionincremental0H · 4M · 4L2026-07-08 21:31
  5. 2eca91cneeds attentionfull5H · 13M · 12L2026-07-08 19:18
  6. cf63bb1needs attentionincremental4H · 4M · 7L2026-07-07 19:47
  7. f43d034needs attentionincremental2H · 3M · 3L2026-07-07 18:35
  8. b7800c0needs attentionincremental1H · 2M · 7L2026-07-07 03:31
  9. 5aef105needs attentionfull6H · 9M · 2L2026-07-06 17:52
  10. 95b4484blockedfull3H · 8M · 4L2026-07-06 05:36