chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) by IAmJSD · Pull Request #1228 · LeanerCloud/cloud-commitments-platform

IAmJSD · 2026-10-20T15:32:35Z

Summary

Fixes item A14-018 of #314: removes the deploy-aws-fargate caller job from deploy-all.yml, which could never run.

A14-040 (the sanity CLI range check) is not in this PR. ci_cd_sanity_tests/cmd/sanity/main.go doesn't exist in this repo and never has (git log --all -- 'ci_cd_sanity_tests/*' is empty). The audit pinned commit 3c0f8ac from before the repo split. That file now lives in LeanerCloud/cloud-commitments-go (ci_cd_sanity_tests/cmd/sanity/main.go on its main), and the dead check is still there. This PR therefore says Refs and leaves issue #314 open. A maintainer could move A14-040 to cloud-commitments-go (transfer it, or open a new issue) and then mark #314 done. If you'd rather mark #314 done when this merges, change Refs to Closes below.

Refs #314

Root cause

determine-deployment wrote the literal deploy-aws-fargate=false for every deploy_to value, so deploy-aws-fargate's if: needs.determine-deployment.outputs.deploy-aws-fargate == 'true' was never true. The "Deployment Plan" and "Deployment Results" summaries still printed an "AWS Fargate" line ("⏭️ AWS Fargate: Skipped"), which made it look like Fargate had been switched off on purpose. The workflows README also listed "Deploy AWS Fargate" as job 3 of the fan-out.

Fix

The issue gives two options and states no preference. Its "Note ..." sentence only says to re-check LeanerCloud/cloud-commitments-cli#1810 (now #196) if the job becomes reachable. This PR deletes the job instead, so it never becomes reachable. This removes dead code and adds no new deploy path.

.github/workflows/deploy-all.yml:

Removed the deploy-aws-fargate caller job, its determine-deployment output, the hard-coded echo "deploy-aws-fargate=false", the line in the plan summary, the notify.needs entry, the "AWS Fargate" block in the results summary, and its check_job call.
Added a short comment where the hard-coded line was. It says Fargate isn't part of this fan-out and to dispatch deploy-aws-fargate.yml directly.
Changed two comments that counted the caller jobs from "four" to "three".

.github/workflows/README.md: removed Fargate from the fan-out job list and renumbered it. Added a sentence pointing to the Fargate section for direct dispatch. Changed all to "AWS Lambda, GCP, and Azure", to match aws-only, which already says "AWS Lambda only".

deploy-aws-fargate.yml is unchanged and can still be dispatched directly with gh workflow run deploy-aws-fargate.yml -f environment=.... No deploy capability is lost: under every deploy_to value, AWS was already Lambda only.

Effect on notify (re: #196 / cli#1810): #196 explained why notify needs if: always() (or !cancelled()) by pointing out that deploy-aws-fargate was always skipped. With the job gone, that reason no longer applies, but the condition is still needed: any deploy_to other than all skips at least one remaining caller job (for example, gcp-only skips deploy-aws-lambda). notify's if: always() and the allowlist in check_job are unchanged.

Verification

All checks are static or local. No workflow was run, dispatched or triggered. deploy-all.yml, deploy-azure.yml and deploy-gcp.yml are disabled as of 2026-10-20, so there is no live-run evidence that this behaves correctly on GitHub-hosted runners.

Fail before, pass after: reachability of the caller jobs. This is a throwaway script, not added to the repo. It runs the real Set cloud providers step under bash -euo pipefail once for each deploy_to option, plus the release path where deploy_to is empty and defaults to all. It records which outputs come out true, then checks that each uses: caller job is gated on one of them.

$ python3 -I reach.py deploy-all.main.yml          # origin/main @ 2f1dbcad
ok   deploy-aws-lambda: reachable via deploy-aws-lambda
ok   deploy-gcp: reachable via deploy-gcp
ok   deploy-azure: reachable via deploy-azure
FAIL deploy-aws-fargate: gated on deploy-aws-fargate, which no deploy_to value sets to true
exit=1

$ python3 -I reach.py .github/workflows/deploy-all.yml   # this branch
ok   deploy-aws-lambda: reachable via deploy-aws-lambda
ok   deploy-gcp: reachable via deploy-gcp
ok   deploy-azure: reachable via deploy-azure
exit=0

reach.py

"""Check that every `uses:` caller job in deploy-all.yml can run for some deploy_to value.

Runs the real `Set cloud providers` step under bash once per deploy_to option
(plus the release path, where inputs.deploy_to is empty) and records which
outputs come out "true". A caller job gated on an output that is never "true"
is unreachable.
"""
import os, re, subprocess, sys, tempfile, yaml

wf = yaml.safe_load(open(sys.argv[1]))
on = wf.get("on", wf.get(True))
options = on["workflow_dispatch"]["inputs"]["deploy_to"]["options"]
det = wf["jobs"]["determine-deployment"]
script = next(s for s in det["steps"] if s.get("id") == "set-clouds")["run"]

true_outputs = set()
for value in options + [""]:  # "" = release trigger, no inputs
    body = script.replace("${{ inputs.deploy_to || 'all' }}", value or "all")
    assert "${{" not in body, body
    with tempfile.NamedTemporaryFile("r", delete=False) as out:
        subprocess.run(["bash", "-euo", "pipefail", "-c", body], check=True,
                       env={**os.environ, "GITHUB_OUTPUT": out.name})
        for line in open(out.name):
            k, _, v = line.strip().partition("=")
            if v == "true":
                true_outputs.add(k)

bad = []
for name, job in wf["jobs"].items():
    if "uses" not in job:
        continue
    m = re.fullmatch(r"needs\.determine-deployment\.outputs\.([\w-]+) == 'true'", job.get("if", "").strip())
    if not m:
        bad.append(f"{name}: unrecognized if: {job.get('if')!r}")
    elif m.group(1) not in true_outputs:
        bad.append(f"{name}: gated on {m.group(1)}, which no deploy_to value sets to true")
    else:
        print(f"ok   {name}: reachable via {m.group(1)}")
for b in bad:
    print("FAIL", b)
sys.exit(1 if bad else 0)

Lint, using the repo's pinned versions and flags:

actionlint .github/workflows/deploy-all.yml: actionlint 1.7.12 (scripts/actionlint-hook.py pins v1.7.12), with shellcheck 0.11.0 on PATH. Exit 0, no findings. actionlint also checks that every needs.<job> / needs.*.outputs.* reference resolves, so no dangling deploy-aws-fargate reference is left.
zizmor --offline --persona=pedantic --min-severity=medium .github/workflows/deploy-all.yml: zizmor 1.29.0, the same flags as .pre-commit-config.yaml and ci.yml. "No findings to report."
markdownlint .github/workflows/README.md: markdownlint-cli 0.47.0, the pinned hook rev. Exit 0.
check-yaml (PyYAML safe_load), trailing whitespace and end-of-file: clean.
git-secrets: ran --register-aws and --scan on the changed files plus .gitallowed, in a fresh git init temp repo with an isolated HOME. Clean. scripts/test-git-secrets-allowlist.sh passes: 137 PASS, 0 FAIL.
No Go, Terraform or frontend files changed, so go build, go vet, go test, golangci-lint, gocyclo, terraform and trivy don't apply to this diff.

Out of scope / follow-ups

A14-040 belongs in cloud-commitments-go; see the Summary.
These comments still mention the removed deploy-all.yml caller and are now stale:
- deploy-aws-fargate.yml, lines 17 and 99: the header says "Workflow call from deploy-all.yml", and a comment says "deploy-all.yml hardcodes this workflow off".
- terraform/environments/aws/ci-cd-permissions/role.tf:108-112: the OIDC trust-list comment says "workflow_call from deploy-all.yml".
None of this changes behavior. The trust entries themselves are still correct, because aws-fargate-<env> is still reachable through workflow_dispatch. I left deploy-aws-fargate.yml and its workflow_call trigger alone on purpose, to keep the Fargate workflow unchanged. A follow-up can update those comments and decide whether to keep the workflow_call trigger now that nothing calls it.
Overlap with sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147: it moves the Fargate ${{ }} expressions in deploy-all.yml into env:. Whichever PR merges second will get a textual conflict. To resolve it, keep this PR's deletions and drop sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147's DEPLOY_AWS_FARGATE* env entries.
I didn't add a CI guard for caller-job reachability, because that would mean wiring a new script into ci.yml. I can add one if you want it.

Labels

Please mirror #314's triage labels on this PR (I can't apply them): impact/internal, type/chore, triaged, priority/p3, severity/low, urgency/eventually, effort/xs.

🤖 Generated with Claude Code

…eanerCloud#314) deploy-all.yml wrote the literal `deploy-aws-fargate=false` for every `deploy_to` value, so the `deploy-aws-fargate` caller job's `if:` could never be true. The deployment plan and the aggregate summary still printed an "AWS Fargate" line, which read as if skipping Fargate were a configured choice, and the workflows README listed Fargate as job 3 of the fan-out. Remove the caller job, its hard-coded output, the plan and summary lines, its `needs` entry and its `check_job` call, and fix the README fan-out list. This deletes dead code and adds no new deploy path: deploy-aws-fargate.yml is unchanged and stays directly dispatchable. Refs LeanerCloud#314 (A14-018). A14-040, the sanity CLI range check, is in cloud-commitments-go, not this repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-20T15:32:43Z

Warning

Review limit reached

Run on-demand review

_{This review includes 2 billable files and costs up to $0.50.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: LeanerCloud/cloud-commitments-platform
Branch: main
File: .coderabbit.yaml
Commit: a9b7eb8
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 0ff2735e-e683-496c-8433-5a44453066a4

Commits

Reviewing files that changed from the base of the PR and between a9b7eb8 and 1978320.

Files selected for processing: 2

.github/workflows/README.md
.github/workflows/deploy-all.yml

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cristim · 2026-10-25T12:51:17Z

Independent review 2 (claude-fleet, cold): APPROVE 8593c38

Findings (none blocking; all are comment fixes):

[non-blocking] .github/workflows/deploy-aws-fargate.yml:17 says it is "Triggered by ... Workflow call from deploy-all.yml". After this PR, nothing calls it, so its workflow_call: trigger (:48) stays but is dormant.
[non-blocking] deploy-aws-fargate.yml:99 says "deploy-all.yml hardcodes this workflow off". It now drops it entirely.
[non-blocking] terraform/environments/aws/ci-cd-permissions/role.tf:111 justifies the aws-fargate-* OIDC subjects partly by "workflow_call from deploy-all.yml". That reason is stale, but the subjects are still needed for workflow_dispatch.
The body's claim that deploy-aws-fargate.yml is "unchanged" is accurate, but its comments now contradict this PR. A follow-up could fix the three comments and decide whether to keep the uncalled workflow_call trigger.

Attacked:

Unreachable on base:
- The only write of the output is the literal deploy-aws-fargate=false at deploy-all.yml:127, outside every deploy_to branch. Nothing else writes it.
- The job's if: (:186) is == 'true', so it can never pass.
- The triggers are workflow_dispatch, with 7 deploy_to choices, and release. On release, DEPLOY_TO falls back to 'all' and the output is still false.
- So every combination gives skipped.
- On base, notify's check_job false skipped always passed and the summary always printed "Skipped". The only visible change is that this always-"Skipped" summary line is gone.
Downstream references:
- No fargate token remains in head deploy-all.yml except the explanatory comment (:126).
- notify's needs is now determine-deployment, deploy-aws-lambda, deploy-gcp and deploy-azure. if: always() is intact, and every needs.X.result names an existing job.
- Other workflows (deploy-queue-watchdog.yml:72, rollback, cleanup-staging) reference deploy-aws-fargate.yml by filename, not this job.
- No test or script parses deploy-all.yml's job list.
Fargate still has an entry point: deploy-aws-fargate.yml keeps workflow_dispatch (:36-47, with an environment choice and clear_stale_lock), and the README still documents gh workflow run deploy-aws-fargate.yml.
Probe: re-injecting ${{ needs.deploy-aws-fargate.result }} into notify makes actionlint fail with "property "deploy-aws-fargate" is not defined". A dangling reference would therefore be caught. The file was restored and confirmed identical with cmp.

Verified locally:

actionlint on head deploy-all.yml and deploy-aws-fargate.yml, and on base deploy-all.yml: rc 0.
act -l, act workflow_dispatch -l and act release -l on deploy-all.yml all show the same graph:
- stage 0, determine-deployment;
- stage 1, deploy-aws-lambda, deploy-gcp and deploy-azure;
- stage 2, notify.
bash scripts/test-aws-tfstate-platform-key.sh on head: rc 0.
git merge-tree --write-tree origin/main 8593c382: clean.
diff -rq of base vs head: only deploy-all.yml and .github/workflows/README.md differ.
No cloud or API calls.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

cristim · 2026-10-25T17:07:57Z

VERDICT: REQUEST_CHANGES 8593c38

The code change is correct and complete for A14-018: the unreachable deploy-aws-fargate caller job and every reference to it are removed from deploy-all.yml, and the README fan-out list is updated. Merges cleanly onto current origin/main (merge-tree exit 0), and also merges cleanly stacked on #1226. One blocking finding concerns PR metadata, not code.

Findings:

blocking PR body - the body intends Refs #314 and says chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 must stay open for A14-040. But GitHub parses the phrases "doesn't close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314", "and then close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" and "If you'd rather close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" as closing keywords. gh pr view 1228 --json closingIssuesReferences currently returns [314]. Failure scenario: merging auto-closes chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 while A14-040 (the duplicate range check, now in cloud-commitments-go) is still unaddressed, which is the opposite of what the body says. Fix: reword those three sentences so none reads "close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" (for example "leaves chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 open"), then confirm closingIssuesReferences is [].
nit .github/workflows/deploy-aws-fargate.yml:17,99 and terraform/environments/aws/ci-cd-permissions/role.tf:108-112 - comments still mention the deploy-all.yml caller. Already listed as a follow-up in the body. No behavior change.

Attacked:

Completeness: grepped the head tree for deploy-aws-fargate in deploy-all.yml. Only the new explanatory comment remains. The output, the echo, the plan line, notify.needs, the results block and check_job are all removed.
Scripts and tests: grepped scripts/, tests/, internal/ and cmd/ for references to deploy-all job names. Only scripts/test-aws-tfstate-platform-key.sh mentions deploy-aws-fargate.yml, about the called workflow itself, which this PR leaves unchanged.
notify still has if: always(). Lambda, GCP and Azure gating is unchanged.
deploy-aws-fargate.yml is unchanged and is still workflow_dispatch-able. The README Fargate section already says "Manual dispatch only", and the new anchor #aws-fargate-deployment resolves to that heading.
Issue claim: the repo has no ci_cd_sanity_tests/ directory, so excluding A14-040 is justified.
actionlint 1.7.12 (shellcheck on PATH): exit 0. zizmor --offline --persona=pedantic --min-severity=medium: no findings.
Mutation probe 1: re-added deploy-aws-fargate to notify.needs. actionlint fails with job "notify" needs job "deploy-aws-fargate" which does not exist [job-needs]. Restored.
Mutation probe 2: re-added the check_job line for deploy-aws-fargate. actionlint fails with property "deploy-aws-fargate" is not defined on both the outputs and the needs objects. Restored. Restored file: actionlint exit 0.
Both probes confirm the body's claim that actionlint catches any dangling reference to the removed job.

IAmJSD · 2026-10-25T17:15:41Z

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: REQUEST_CHANGES 8593c38205df2e4cf53ad5aaa8d02d95e859ae11

Blocking:

PR body: the body means Refs #314 and says chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 must stay open for A14-040, but its Summary paragraph contains "close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" three times ("doesn't close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314", "and then close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314", "If you'd rather close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314"). GitHub parses those as closing keywords: gh pr view 1228 --json closingIssuesReferences returns [314] on this head. Failure scenario: merging auto-closes chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 while A14-040 (the duplicate range check, now in cloud-commitments-go) is still open work, which is the opposite of what the body asks for. Fix: reword those sentences so no closing keyword sits directly before #314 (for example "leave chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 open", "then mark chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 done", "switch this PR to closing it"), and check that closingIssuesReferences comes back empty. The body is the only change needed; the code is fine. (An earlier review raised this first. I missed it in my own pass and confirmed it before posting.)

Non-blocking:

Product choice, not a defect: chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 offered "add an aws-fargate deploy_to value" or "delete the caller", and this PR deletes it. That is the conservative option (no new deploy path, no change to what all actually did), and it matches current behavior exactly. If the owner wants Fargate in the fan-out later, the new comment in set-clouds says what's needed.
Stale comments the PR already lists: deploy-aws-fargate.yml:17,99 and terraform/environments/aws/ci-cd-permissions/role.tf:111 still mention deploy-all as a caller. A follow-up could also decide whether deploy-aws-fargate.yml keeps its now-unused workflow_call trigger.
Will conflict textually with sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147 (still open). The resolution the PR body gives is right.

Attacked:

Ran the real set-clouds step under bash -euo pipefail for every deploy_to option. Every option emits only deploy-aws-lambda/deploy-gcp/deploy-azure, and every remaining caller job is reachable for at least one value. notify.needs is now determine-deployment, deploy-aws-lambda, deploy-gcp, deploy-azure, if: always() is unchanged, and the check_job allowlist still covers each remaining job, so a partial deploy_to still reaches notify.
actionlint v1.7.12 (repo pin, shellcheck on PATH) on deploy-all.yml exits 0, which also proves there are no dangling needs.deploy-aws-fargate / outputs.deploy-aws-fargate refs. PyYAML safe_load is ok. No new ${{ }} in run blocks (the change only removes them). The README anchor #aws-fargate-deployment resolves.
Confirmed the Refs #314 call: ci_cd_sanity_tests/ doesn't exist in this repo, and ci_cd_sanity_tests/cmd/sanity/main.go is on cloud-commitments-go's main. A14-040 can't be done here, so Refs (not Closes) is correct. git merge-tree against origin/main and against docs(ci): replace stale AZURE_CREDENTIALS setup with the OIDC secrets #1226 (same README) is clean. Not run: zizmor and markdownlint (not installed here), and no workflow was dispatched.

Body-stale: the Summary's "This PR therefore says Refs and doesn't close #314" is false in effect: GitHub links #314 as closed-by-this-PR (see Blocking).

_{Reviewer: rB3. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

IAmJSD · 2026-10-25T17:16:28Z

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8593c38205df2e4cf53ad5aaa8d02d95e859ae11

This supersedes my earlier REQUEST_CHANGES (rB3) on this same head, 8593c38. The only blocker was in the PR body, and it is fixed.

Blocking:

none. I re-checked at 8593c38. gh pr view 1228 --json closingIssuesReferences now returns []. The body's chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 references are "Fixes item A14-018 of chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" (the keyword is followed by "item", not "chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314", so GitHub doesn't parse it, as the empty closingIssuesReferences confirms), "leaves issue chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 open", "mark chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 done" (twice) and Refs #314. The branch's only commit message says Refs #314 (A14-018) and has no closing keyword. Merging won't close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314.

Non-blocking:

Product choice, not a defect: chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 offered "add an aws-fargate deploy_to value" or "delete the caller", and this PR deletes it. That is the conservative option (no new deploy path, no change to what all actually did). If the owner wants Fargate in the fan-out later, the new comment in set-clouds says what's needed.
Stale comments the PR already lists: deploy-aws-fargate.yml:17,99 and terraform/environments/aws/ci-cd-permissions/role.tf:111 still mention deploy-all as a caller. A follow-up could also decide whether deploy-aws-fargate.yml keeps its now-unused workflow_call trigger.
Will conflict textually with sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147 (still open). The resolution the PR body gives is right.
If someone later edits the body, keep "Fixes" from landing directly before "chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314"; "Fixes item ... of chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" is safe only because of the words in between.

Attacked:

Unchanged from my earlier pass. Ran the real set-clouds step under bash -euo pipefail for every deploy_to option: every remaining caller job is reachable, notify.needs and check_job are consistent, and if: always() is kept. actionlint v1.7.12 on deploy-all.yml exits 0, with no dangling deploy-aws-fargate refs. PyYAML is ok and the README anchor resolves. Refs is correct because A14-040's file only exists in cloud-commitments-go. git merge-tree against origin/main and docs(ci): replace stale AZURE_CREDENTIALS setup with the OIDC secrets #1226 is clean.
This round: re-read the body and the commit message, and checked closingIssuesReferences.

Body-stale: none

_{Reviewer: rB3. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

IAmJSD · 2026-10-26T00:32:22Z

Reply to the REQUEST_CHANGES review on 8593c38, point by point:

blocking, PR body ("close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314" phrasing parsed as closing keywords): fixed in the PR body only, with no code change. The three sentences now read "leaves issue chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 open" and "mark chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 done", and the reference line is Refs #314. I checked again just now: gh pr view 1228 --json closingIssuesReferences returns [], so merging won't close chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314. The branch's only commit message says Refs #314 (A14-018) and has no closing keyword. rB3 confirmed the same thing on this head in its follow-up APPROVE above.
nit, deploy-aws-fargate.yml:17,99 and terraform/environments/aws/ci-cd-permissions/role.tf:108-112 still mention the deploy-all caller: not changed in this PR. These are comments only, with no behavior change, and the PR body already lists them as a follow-up together with the question of whether deploy-aws-fargate.yml keeps its now-unused workflow_call trigger. Keeping this PR to the deploy-all.yml and README change keeps it small.

Status note: since your review, #1147 has merged (acd20b3). It moved the deploy-all.yml ${{ }} expressions into env:, so this branch now conflicts with main (mergeStateStatus: DIRTY) in three hunks: the plan echo, the Fargate results block and the check_job lines. This is the overlap the PR body predicted. The resolution is the one the body gives: keep this PR's deletions, and in main's env-based form drop DEPLOY_AWS_FARGATE / DEPLOY_AWS_FARGATE_RESULT (the env entries, the plan echo line, the results block and the check_job line). The branch still needs that merge from main before it can merge. This reply does not include a push.

Checks: none re-run, because there is no new commit. Your actionlint and zizmor results and rB3's set-clouds and actionlint runs all cover 8593c38.

Head (unchanged): 8593c38

Conflict: .github/workflows/deploy-all.yml, three hunks against LeanerCloud#1147, which moved every run-block ${{ }} into env:. Kept main's env-variable form throughout (the injection hardening must stay) and dropped the AWS Fargate lines LeanerCloud#1147 added to the plan summary, the result summary and check_job, plus the three DEPLOY_AWS_FARGATE* env entries that pointed at the deploy-aws-fargate job this PR removes. This is the resolution the PR body describes. actionlint and zizmor are clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

IAmJSD · 2026-10-26T00:33:47Z

Merged origin/main (now 19783209) to clear the conflict with #1147 in deploy-all.yml. I kept main's env-variable form everywhere, so the run-block injection hardening stays, and dropped the AWS Fargate lines #1147 added plus the three DEPLOY_AWS_FARGATE* env entries that pointed at the removed job. This is the resolution the PR body describes. actionlint 1.7.12 and the zizmor injection audit (pre-commit) are clean; secrets scan clean. Needs a fresh review at this head.

IAmJSD · 2026-10-26T00:45:52Z

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 19783209a6e58801401d4fa05de93b36d25dbc69

Blocking:

none

Non-blocking:

.github/workflows/ci.yml:261-262: the zizmor job's comment still says zizmor 1.31 "reports 4 more low findings on the local reusable-workflow calls in deploy-all.yml". With the Fargate caller gone there are three. The 35/24 baseline counts in the same comment may also have moved. It's only a comment, so I'd fix it in the same follow-up as the stale deploy-aws-fargate.yml:17,99 and role.tf:108-112 comments the PR already lists.
Issue chore(ci): unreachable Fargate caller job in deploy-all, dead range check in sanity CLI #314 offers two options (add an aws-fargate deploy_to value, or delete the caller). This PR deletes it. That's a small product choice: all now explicitly means Lambda + GCP + Azure. Nothing is lost compared with main, where Fargate was never deployed by the fan-out.

Attacked:

Parsed deploy-all.yml with PyYAML. The jobs are determine-deployment, deploy-aws-lambda, deploy-gcp, deploy-azure, notify, and notify.needs lists exactly those three callers plus determine-deployment. No needs.deploy-aws-fargate or outputs.deploy-aws-fargate reference is left; the only mention is the new comment. notify keeps if: always() and the check_job allowlist, so partial deploy_to values still skip correctly.
Checked what else reads the workflow files: deploy-queue-watchdog.yml, scripts/test-init-backend.sh and scripts/test-aws-tfstate-platform-key.sh reference deploy-aws-fargate.yml, which is unchanged. Both scripts pass (24/0 and 26/0). deploy-aws-fargate.yml keeps workflow_dispatch.
secrets-scan.sh printed "clean; planted key flagged". GitHub reports MERGEABLE/CLEAN. actionlint and zizmor aren't installed here, so I relied on the YAML parse and a grep for dangling references. No workflow was run.
Refs #314 is correct: A14-040 (the sanity CLI) lives in cloud-commitments-go and isn't fixed here.

Body-stale:

none

_{Reviewer: rB25. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

IAmJSD · 2026-10-26T01:13:50Z

Local verification at 19783209a6e58801401d4fa05de93b36d25dbc69 merged onto main (e3fce4a8), together with #1222, #1228 in that order (combined tree c70f8394, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

IAmJSD · 2026-10-26T01:13:56Z

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on 19783209, green CI, and the combined-tree verification above. Squash-merged at exactly 19783209a6e58801401d4fa05de93b36d25dbc69.

IAmJSD added impact/internal Team-internal only type/chore Maintenance / non-user-visible triaged Item has been triaged priority/p3 Polish / idea / may never ship severity/low Minor harm urgency/eventually No deadline effort/xs Trivial / one-liner labels Oct 20, 2026

This was referenced Oct 21, 2026

sec(ci): move the remaining run-block ${{ }} interpolations into env (#155) #1147

Merged

chore(ci): make local gates fail honestly and pin pre-commit hook repos (#349, slice 1) #1307

Merged

IAmJSD mentioned this pull request Oct 25, 2026

Changes waiting for the first Azure/GCP deploy after the 2026-10-20 pause #1413

Open

7 of 10 tasks

cristim mentioned this pull request Oct 25, 2026

docs(ci): replace stale AZURE_CREDENTIALS setup with the OIDC secrets #1226

Merged

IAmJSD mentioned this pull request Oct 26, 2026

chore(gitignore): ignore root artifacts written by Make targets #1222

Merged

IAmJSD marked this pull request as ready for review October 26, 2026 01:13

IAmJSD merged commit 99f0b61 into LeanerCloud:main Oct 26, 2026
38 checks passed

Navigation Menu

Repository navigation

chore(ci): drop the unreachable Fargate caller job from deploy-all (#314) - #1228

chore(ci): drop the unreachable Fargate caller job from deploy-all (#314)#1228
IAmJSD merged 2 commits into
LeanerCloud:mainfrom
IAmJSD:fix/issue-314

IAmJSD commented Oct 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Review limit reached

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

IAmJSD commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Fix

Verification

Out of scope / follow-ups

Labels

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

IAmJSD commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading