← all branches

feat/tb-deploy

needs attentionviewing older commit
cf63bb1 · incrementalPR #261reviewed 2026-07-07 19:47 UTC4H · 4M · 7L
The branch
Purpose
Establish Batu's Tinybird deployment strategy: 3 long-lived workspaces (dev/stg/prod), ephemeral Forward branches per PR, per-env token split replacing a single shared TINYBIRD_TOKEN.
Goal
Automate Tinybird schema-CD and runtime token seeding across preview/staging/prod lanes with least-privilege token model captured as durable code.
Sub-goals
  • SG-1: Strategy rule doc + README de-stale; scoped runtime-vs-deploy token split
  • SG-2: Per-env metrics-SSM seed (preview→DEV, staging→STG, prod→PROD)
  • SG-4: Ephemeral per-PR Tinybird branch + cleanup
  • SG-5: Schema-CD — tinybird-staging / tinybird-prod jobs with WORKSPACE:DEPLOY token
  • SG-6: Fold per-env tokens + schema-CD into infrastructure.md / migration-pipeline.md
The changes (whole branch)
What
Added Tinybird Local CI job (`tb test run`) with throwaway container, fixture (metric.ndjson), and first pipe test (resolve_stream_window.yaml) covering dedup + priority-splice + bucket-format. Extracted shared CLI install step to $GITHUB_PATH. Timeout 8→15 min.
Why
`tb deploy --check` validates schema but cannot catch pipe logic bugs. Tinybird Local closes that gap with hermetic, token-free assertions that run on every push including fork PRs.
Areas
.github/workflows/pr-checks.yml+51−17infra/tinybird/fixtures/metric.ndjson+4−0infra/tinybird/tests/resolve_stream_window.yaml+14−0
Blast
3 files, +51 adds (this commit); CI-only — no TS, no DB schema, no API surface. Full branch: 14 files, +782/-108.
ci-infra-only tinybird-local-docker-required no-ts-changes
➖ci· no completed check-runs at cf63bb1➖coderabbit· no .coderabbit.yaml in repo

Findings · 14

correctness3

high

`tb test run` missing `--local` flag — may route to cloud, not local container

.github/workflows/pr-checks.yml:456

Step runs `tb --local deploy` then bare `tb test run` with no `--local`. Fix: `tb --local test run </dev/null`.

low

Trailing `sleep 5` fires on 40th failed health-check iteration

.github/workflows/pr-checks.yml

low

Container name pattern `tinybird-local.*healthy` assumed — dump `docker ps -a` on failure

.github/workflows/pr-checks.yml

security2

high

`curl -fsSL https://tinybird.co | sh` — no version pin or integrity check

.github/workflows/pr-checks.yml

Standard install pattern but executes arbitrary remote code. Pin to versioned release with SHA-256 or use tool-cache.

low

TB_HOST hardcoded fallback (us-east) silently wrong if workspace is on a different region

.github/workflows/pr-checks.yml

conventions2

low

Test YAML description uses auto-serialized escaped-string — use YAML literal block scalar (`|`)

infra/tinybird/tests/resolve_stream_window.yaml:3

low

Leading blank line in test YAML file

infra/tinybird/tests/resolve_stream_window.yaml:1

tests4

high

No `aggregator=mean` test — default / most-used production path (energy kWh)

infra/tinybird/tests/resolve_stream_window.yaml

high

No boundary tests for `to_ts` (exclusive) / `from_ts` (inclusive) — fencepost bug passes silently

infra/tinybird/tests/resolve_stream_window.yaml

medium

Priority splice only tested with src_a winning — add `[src_b, src_a]`-wins scenario

infra/tinybird/tests/resolve_stream_window.yaml

medium

No empty-window test — future WITH FILL regression would go undetected

infra/tinybird/tests/resolve_stream_window.yaml

improvement3

medium

Poll loop has no initial grace sleep — `docker ps` fires before image pull starts on cold runner

.github/workflows/pr-checks.yml

medium

No `tb local stop` teardown step — add `if: always()` to avoid stale container on re-runs

.github/workflows/pr-checks.yml

low

Tinybird Local log only shown on health-timeout — add `|| { cat /tmp/tb-local.log; exit 1; }` after deploy + test-run

.github/workflows/pr-checks.yml

History · 10 commits

  1. 5d30429safeincremental0H · 0M · 1L2026-07-08 23:04
  2. 19bac85needs attentionincremental0H · 5M · 6L2026-07-08 22:46
  3. 92e890aneeds attentionincremental0H · 1M · 3L2026-07-08 21:46
  4. e81a781needs attentionincremental0H · 4M · 4L2026-07-08 21:31
  5. 2eca91cneeds attentionfull5H · 13M · 12L2026-07-08 19:18
  6. cf63bb1needs attentionincremental4H · 4M · 7L2026-07-07 19:47current
  7. f43d034needs attentionincremental2H · 3M · 3L2026-07-07 18:35
  8. b7800c0needs attentionincremental1H · 2M · 7L2026-07-07 03:31
  9. 5aef105needs attentionfull6H · 9M · 2L2026-07-06 17:52
  10. 95b4484blockedfull3H · 8M · 4L2026-07-06 05:36