ci(relay): add Deploy Relay workflow (Fly)

Merged
KI
4mo ago
+43-0

Summary

The relay ships to Fly, not Vercel, and was never wired into CI. deploy-production.yml (on push to main) deploys only DB / API / Web / Marketing / Admin — all Vercel. So relay changes silently never deployed: a merged relay fix stays dark until someone remembers to run the manual Fly deploy. This is exactly what happened with the descriptive-Forbidden relay fix in #5573.

This adds a dedicated Deploy Relay workflow that reuses the canonical apps/relay/scripts/deploy.sh (the same fly scale + rolling deploy + smoke-test a human would run — single source of truth, no duplicated deploy logic).

Design choices

  • Dedicated workflow, not a job in deploy-production.yml. A 7-region rolling Fly deploy mutates the live fleet and is too heavy to run on every unrelated push to main. So it's path-filtered to apps/relay/** + packages/shared/** (the runtime code the relay bundles) + the workflow file.
  • workflow_dispatch included so it can be force-run — notably to ship the relay fix from #5573, which merged before this workflow existed and so won't be picked up by the path filter retroactively.
  • concurrency: deploy-relay (no cancel) so two rolling deploys never overlap.
  • Reuses the existing pinned actions/checkout SHA; installs flyctl via the official installer (mirrors how the Vercel jobs install their CLI).

Required before this works

  • Add a FLY_API_TOKEN secret to the production environment (repo Settings → Environments → production). Without it the deploy step fails fast.

Test plan

  • Workflow YAML parses; triggers = push (path-filtered) + workflow_dispatch.
  • After merge + secret: Run workflow manually once to ship #5573's relay change, and confirm the smoke test passes for all 7 regions.

Follow-up (optional)

  • Consider pinning flyctl install to a SHA-pinned superfly/flyctl-actions/setup-flyctl to match the repo's action-pinning discipline.
Open in Stage

Summary by cubic

Adds a dedicated GitHub Actions workflow to deploy the relay to Fly on relevant changes, using the canonical apps/relay/scripts/deploy.sh, preventing overlapping deploys, and hardening checkout by not persisting credentials.

  • New Features

    • New workflow: .github/workflows/deploy-relay.yml.
    • Triggers on push to main (path-filtered) and workflow_dispatch for manual runs.
    • Uses concurrency: deploy-relay (no cancel) to avoid overlapping rolling deploys.
    • Installs flyctl and runs apps/relay/scripts/deploy.sh (scale, rolling deploy, smoke test) in the production environment.
    • Hardened checkout with persist-credentials: false since the deploy reads only the working tree.

  • Migration

    • Add FLY_API_TOKEN secret to the production environment before running.
    • After adding the secret, run the workflow once to deploy any previously merged relay changes.

Summary by CodeRabbit

  • Chores
    • Added an automated deployment workflow for the relay service to Fly.io on merges to the main branch when relevant files change.
    • Added the ability to manually trigger relay deployments.
    • Prevented overlapping relay deployment runs via deployment concurrency settings.