feat/tb-deploy

PyPI package pinned by version only — no content hash

.github/actions/tb-install/action.yml:23

uv tool install 'tinybird==4.6.9' pins by version string but not by artifact hash. A tampered or yanked-then-republished PyPI wheel at this version could execute arbitrary code in jobs that hold TINYBIRD_DEPLOY_TOKEN_PROD and similar secrets. The astral-sh/setup-uv action is correctly pinned to a commit SHA, making this asymmetry notable. Fix: generate a hash pin via uv pip compile --generate-hashes and pass --hash sha256:<digest> to the install command.

Tinybird deploy failure now triggers full PITR DB rollback

.github/workflows/release-promote.yml:860

needs.tinybird-prod.result == 'failure' now triggers rollback including PITR DB restore. Tinybird schema changes are expand-only per the deployment rule doc, so a Tinybird deploy failure does not require DB rollback. A transient Tinybird API or network error could induce an unnecessary prod DB PITR restore of ~1-5 minutes. Consider separating Tinybird failure handling from the DB PITR trigger, or documenting this as an accepted trade-off.

tinybird-prod in rollback needs — no corresponding Tinybird rollback step

.github/workflows/release-promote.yml:856

The rollback job now lists tinybird-prod in its needs and fires when needs.tinybird-prod.result == 'failure'. However, the rollback job contains no tb command to revert a Tinybird schema deployment. It only handles CDK CloudFormation rollback, Vercel re-promotion, and DB PITR. This asymmetry misleads operators during an incident. Convention (matching db-backup): add an explicit comment noting that Tinybird schema rollback is intentionally unhandled here and describe the manual recovery path.

Silent continue-on-error CLI install degradation is not surfaced

.github/workflows/preview-provision.yml:297

continue-on-error: true on the tb-install step in preview-provision and preview-deprovision means a broken uv install shows a green step while subsequent code falls through and exits 0 with a warning. The job appears fully green while the preview silently runs against the shared dev workspace. Add a job summary notice or a step output flag to make the degradation observable in the PR UI.

No smoke-test workflow for the composite action

.github/actions/tb-install/action.yml

There is no workflow that directly exercises .github/actions/tb-install in isolation. Install failures only surface as buried failures inside provision/deprovision/staging runs rather than as fast, targeted signals. A PR-gated self-test (uses: ./.github/actions/tb-install then asserts tb --version) would prove the mechanism works as described.

No tb --version verification step in composite action

.github/actions/tb-install/action.yml

The action appends $HOME/.local/bin to GITHUB_PATH but does not run tb --version as a verification step. If uv places the binary at an unexpected location, the action exits 0 while tb is missing from PATH in subsequent steps.

Branch slugification duplicated across provision and deprovision

.github/workflows/preview-deprovision.yml

The TB_SLUG derivation and BR convention appear identically in both preview-provision.yml and preview-deprovision.yml. If the two implementations drift, deprovision deletes the wrong branch and the 4-branch cap leaks. Extract to a shared composite action output, or store the computed branch name at provision time and read it back at deprovision time.

--force in uv tool install prevents cache reuse

.github/actions/tb-install/action.yml:23

--force causes uv to reinstall the tinybird tool even if the exact version is already present. If astral-sh/setup-uv's cache key ever covers the tool install directory, --force would negate it. Removing --force makes the install idempotent by default.

skip_cdk + tinybird ordering bypass undocumented

.github/workflows/release-promote.yml

tinybird-prod needs cdk-deploy enforces expand/contract ordering. However, if an operator passes skip_cdk: true but not skip_tinybird: true, GitHub Actions treats the skipped cdk-deploy as a satisfied dependency and tinybird-prod runs without the CDK gate. Documenting this in the dispatch input descriptions prevents a mis-invocation from violating the ordering invariant.