| 1 | #!/usr/bin/env node |
| 2 | // Deploys g1t to Cloudflare from deploy/stack.jsonc: only what changed since |
| 3 | // each Worker's live commit, migrations first, then stage by stage. |
| 4 | // docs.g1t.sh/guides/deploy-to-cloudflare/ is the guide. |
| 5 | // |
| 6 | // node scripts/deploy.mjs plan what would deploy, and why (read-only) |
| 7 | // node scripts/deploy.mjs deploy migrations, then every changed unit |
| 8 | // node scripts/deploy.mjs deploy --only web,api just these (if changed; --force: anyway) |
| 9 | // node scripts/deploy.mjs build --only events build as a deploy would, upload nothing |
| 10 | // node scripts/deploy.mjs migrate pending D1 migrations only |
| 11 | // node scripts/deploy.mjs manifest [--check] the resolved manifest, or its problems |
| 12 | // node scripts/deploy.mjs doctor which units lack their secrets |
| 13 | // node scripts/deploy.mjs install --only a,b npm ci of just what those units need (CI) |
| 14 | // node scripts/deploy.mjs build-base build and push the runner's base image (Docker) |
| 15 | // node scripts/deploy.mjs image make the runner's image for this checkout in the registry (--no-push: build it with Docker) |
| 16 | // |
| 17 | // Flags: --all (every unit, changed or not), --only a,b, --skip a,b, |
| 18 | // --force, --concurrency N (default 4), --stage core (one stage), |
| 19 | // --json (plan), --out FILE (plan), --no-migrations, --allow-dirty, |
| 20 | // --rebuild-image, --rebuild-base, --since REV (Workers with no recorded |
| 21 | // commit are taken to run REV); for build-base and image, --no-push, and |
| 22 | // for build-base, --no-cache. |
| 23 | |
| 24 | import { appendFileSync, mkdirSync, writeFileSync } from "node:fs"; |
| 25 | import { tmpdir } from "node:os"; |
| 26 | import { join } from "node:path"; |
| 27 | |
| 28 | import { BINARY, OUT_DIR } from "./build-runner.mjs"; |
| 29 | import { ensureWorkerBuild } from "./build-rust-worker.mjs"; |
| 30 | import { |
| 31 | annotation, |
| 32 | apiAuth, |
| 33 | applyMigrations, |
| 34 | DEPLOY_RETRY_WAITS_MS, |
| 35 | dockerAvailable, |
| 36 | exec, |
| 37 | jsonFrom, |
| 38 | lastLines, |
| 39 | pendingMigrations, |
| 40 | readLive, |
| 41 | retryableDeploy, |
| 42 | versionFrom, |
| 43 | wrangler, |
| 44 | wranglerEnv, |
| 45 | wranglerError, |
| 46 | } from "./deploy/cloudflare.mjs"; |
| 47 | import { |
| 48 | baseInputs, |
| 49 | baseState, |
| 50 | baseTag, |
| 51 | baseVersions, |
| 52 | buildBase, |
| 53 | buildRunnerImage, |
| 54 | diskReport, |
| 55 | dockerHas, |
| 56 | dockerLogin, |
| 57 | imageSize, |
| 58 | makeRunnerImage, |
| 59 | pushImage, |
| 60 | readBaseLock, |
| 61 | registryHas, |
| 62 | removeDeployConfig, |
| 63 | runnerRef, |
| 64 | writeBaseLock, |
| 65 | writeDeployConfig, |
| 66 | } from "./deploy/image.mjs"; |
| 67 | import { decide, git, planJson, pool, table } from "./deploy/plan.mjs"; |
| 68 | import { reportDeployment } from "./deploy/report.mjs"; |
| 69 | import { ROOT, byStage, codeStages, containersRollout, findWranglerConfigs, npmCiArgs, npmWorkspace, pick, problems, resolvedStack, waves } from "./deploy/stack.mjs"; |
| 70 | import { withDeployWindow } from "./deploy/status-window.mjs"; |
| 71 | import { publishWebAssets, verifyWebAssets } from "./deploy/web-assets.mjs"; |
| 72 | |
| 73 | const USAGE = "usage: node scripts/deploy.mjs plan|deploy|build|migrate|manifest|doctor|install|build-base|image [--all] [--only a,b] [--skip a,b] [--force] [--rollback] [--concurrency N] [--stage S] [--json]"; |
| 74 | |
| 75 | function parseArgs(argv) { |
| 76 | const opts = { command: argv[0], only: [], skip: [], concurrency: 4, force: false, all: false, json: false }; |
| 77 | for (let i = 1; i < argv.length; i++) { |
| 78 | const arg = argv[i]; |
| 79 | const [flag, inline] = arg.split(/=(.*)/s); |
| 80 | const value = () => inline ?? argv[++i]; |
| 81 | if (flag === "--only") opts.only.push(value()); |
| 82 | else if (flag === "--skip") opts.skip.push(value()); |
| 83 | else if (flag === "--concurrency") opts.concurrency = Number(value()); |
| 84 | else if (flag === "--stage") opts.stage = value(); |
| 85 | else if (flag === "--all") opts.all = true; |
| 86 | else if (flag === "--force") opts.force = true; |
| 87 | else if (flag === "--rollback") opts.rollback = true; |
| 88 | else if (flag === "--json") opts.json = true; |
| 89 | else if (flag === "--check") opts.check = true; |
| 90 | else if (flag === "--no-migrations") opts.noMigrations = true; |
| 91 | else if (flag === "--allow-dirty") opts.allowDirty = true; |
| 92 | else if (flag === "--rebuild-image") opts.rebuildImage = true; |
| 93 | else if (flag === "--rebuild-base") opts.rebuildBase = true; |
| 94 | else if (flag === "--no-push") opts.noPush = true; |
| 95 | else if (flag === "--no-cache") opts.noCache = true; |
| 96 | else if (flag === "--out") opts.out = value(); |
| 97 | else if (flag === "--since") opts.since = value(); |
| 98 | else if (flag === "--github-output") opts.githubOutput = true; |
| 99 | else throw new Error(`unknown flag ${arg}\n${USAGE}`); |
| 100 | } |
| 101 | if (!Number.isInteger(opts.concurrency) || opts.concurrency < 1) throw new Error("--concurrency is a whole number, 1 or more"); |
| 102 | return opts; |
| 103 | } |
| 104 | |
| 105 | /** The units a command works on: --only (or all), less --skip, in --stage. */ |
| 106 | function selected(stack, opts) { |
| 107 | let units = opts.only.length ? pick(stack, opts.only) : [...stack.units]; |
| 108 | const skipped = pick(stack, opts.skip); |
| 109 | units = units.filter((u) => !skipped.includes(u)); |
| 110 | if (opts.stage) { |
| 111 | if (!codeStages(stack).includes(opts.stage)) throw new Error(`--stage is one of ${codeStages(stack).join(", ")}`); |
| 112 | units = units.filter((u) => u.stage === opts.stage); |
| 113 | } |
| 114 | // Manifest order, whatever order they were named in. |
| 115 | return stack.units.filter((u) => units.includes(u)); |
| 116 | } |
| 117 | |
| 118 | const log = (...args) => console.error(...args); |
| 119 | |
| 120 | /** |
| 121 | * The plan for a workflow (.g1t/workflows/deploy.yml): job outputs in |
| 122 | * $GITHUB_OUTPUT, and the plan as a table in $GITHUB_STEP_SUMMARY. |
| 123 | */ |
| 124 | function writeGithubOutputs(data, p) { |
| 125 | const lines = [ |
| 126 | `commit=${data.commit}`, |
| 127 | `migrate=${data.migrations.length > 0}`, |
| 128 | `migrate_units=${data.migrations.map((m) => m.unit).join(",")}`, |
| 129 | `deploying=${data.units.filter((u) => u.deploy).map((u) => u.unit).join(",")}`, |
| 130 | ]; |
| 131 | for (const [stage, { jobs }] of Object.entries(data.stages)) { |
| 132 | // A matrix needs one entry; an empty stage's job is skipped by its `if`. |
| 133 | const include = jobs.length ? jobs : [{ group: "none", units: "" }]; |
| 134 | lines.push(`has_${stage}=${jobs.length > 0}`, `${stage}=${JSON.stringify({ include })}`); |
| 135 | } |
| 136 | if (data.migration_errors.length) { |
| 137 | // The units, then why for the first: one cause (a token, say) is usually all of them. |
| 138 | throw new Error(`Could not read pending migrations: ${data.migration_errors.map((e) => e.unit).join(", ")} |
| 139 | ${data.migration_errors[0].error}`); |
| 140 | } |
| 141 | if (process.env.GITHUB_OUTPUT) appendFileSync(process.env.GITHUB_OUTPUT, `${lines.join("\n")}\n`); |
| 142 | else console.log(lines.join("\n")); |
| 143 | if (process.env.GITHUB_STEP_SUMMARY) { |
| 144 | const rows = p.decisions.map((d) => `| ${d.unit.id} | ${d.unit.stage} | ${d.deploy ? "deploy" : ""} | ${d.since ? d.since.slice(0, 12) : "?"} | ${d.reason.replaceAll("|", "\\|")} |`); |
| 145 | const pending = data.migrations.map((m) => `- ${m.database}: ${m.pending.join(", ")}`); |
| 146 | appendFileSync( |
| 147 | process.env.GITHUB_STEP_SUMMARY, |
| 148 | [`## Deploy plan for ${data.commit.slice(0, 12)}`, "", "| unit | stage | action | live | why |", "| --- | --- | --- | --- | --- |", ...rows, "", pending.length ? "### Pending migrations" : "", ...pending, ""].join("\n"), |
| 149 | ); |
| 150 | } |
| 151 | } |
| 152 | |
| 153 | const seconds = (ms) => `${(ms / 1000).toFixed(1)}s`; |
| 154 | |
| 155 | /** `fn`, called the first time it is wanted and then remembered. */ |
| 156 | const once = (fn) => { |
| 157 | let answer = null; |
| 158 | return () => (answer ??= fn()); |
| 159 | }; |
| 160 | |
| 161 | /** Reads what each unit runs and what its database is waiting for. */ |
| 162 | async function survey(units, opts) { |
| 163 | const live = {}; |
| 164 | const migrations = {}; |
| 165 | const tasks = [ |
| 166 | ...(opts.noLive ? [] : units).map((unit) => async () => { |
| 167 | live[unit.id] = await readLive(unit); |
| 168 | }), |
| 169 | ...(opts.noMigrations ? [] : units.filter((u) => u.d1)).map((unit) => async () => { |
| 170 | migrations[unit.id] = await pendingMigrations(unit); |
| 171 | }), |
| 172 | ]; |
| 173 | // Through the API every read starts at once (the requests themselves are |
| 174 | // held to API_CONCURRENCY); through Wrangler, a few processes at a time. |
| 175 | await pool(tasks, apiAuth() ? tasks.length : Math.max(8, opts.concurrency * 2), (task) => task()); |
| 176 | return { live, migrations }; |
| 177 | } |
| 178 | |
| 179 | async function plan(stack, opts) { |
| 180 | const units = selected(stack, opts); |
| 181 | const head = git.head(); |
| 182 | const { live, migrations } = await survey(units, opts); |
| 183 | // --since: what a Worker with no recorded commit is taken to run (once, |
| 184 | // to adopt Workers deployed before this tool), for example --since HEAD~3. |
| 185 | if (opts.since) { |
| 186 | const since = git.resolve(opts.since); |
| 187 | for (const unit of units) { |
| 188 | const found = live[unit.id]; |
| 189 | if (found && !found.sha && !found.missing && !found.error) live[unit.id] = { ...found, sha: since, assumed: true }; |
| 190 | } |
| 191 | } |
| 192 | const decisions = decide(units, { live, head, force: opts.force || opts.all, rollback: opts.rollback }); |
| 193 | return { head, units, live, migrations, decisions }; |
| 194 | } |
| 195 | |
| 196 | function buildPlan(stack, opts) { |
| 197 | const units = selected(stack, opts); |
| 198 | return { |
| 199 | head: git.head(), |
| 200 | units, |
| 201 | live: {}, |
| 202 | migrations: {}, |
| 203 | decisions: units.map((unit) => ({ unit, deploy: true, reason: "build", since: null, files: [], image: false })), |
| 204 | }; |
| 205 | } |
| 206 | |
| 207 | function printPlan(stack, { head, decisions, migrations, live }) { |
| 208 | console.log(`Deploying ${head.slice(0, 12)} (${git.subject()})\n`); |
| 209 | const rows = decisions.map((d) => [ |
| 210 | d.unit.id, |
| 211 | d.unit.stage, |
| 212 | d.deploy ? "deploy" : "-", |
| 213 | d.since ? d.since.slice(0, 12) + (live[d.unit.id]?.assumed ? "*" : "") : "?", |
| 214 | d.unit.d1 ? (migrations[d.unit.id]?.error ? "error" : String(migrations[d.unit.id]?.pending?.length ?? "-")) : "", |
| 215 | d.reason + (d.image ? "; image rebuilds" : ""), |
| 216 | ]); |
| 217 | console.log(table(rows, ["unit", "stage", "action", "live", "migrations", "why"])); |
| 218 | if (decisions.some((d) => live[d.unit.id]?.assumed)) console.log("* taken from --since: no commit was recorded for it"); |
| 219 | const pending = Object.entries(migrations).filter(([, m]) => m.pending?.length); |
| 220 | if (pending.length) { |
| 221 | console.log("\nPending migrations:"); |
| 222 | for (const [id, m] of pending) console.log(` ${stack.units.find((u) => u.id === id).d1.database}: ${m.pending.join(", ")}`); |
| 223 | } |
| 224 | for (const [id, m] of Object.entries(migrations).filter(([, m]) => m.error)) { |
| 225 | console.log(`\nCould not list ${id}'s migrations:\n${m.error}`); |
| 226 | } |
| 227 | const deploying = decisions.filter((d) => d.deploy).map((d) => d.unit); |
| 228 | console.log( |
| 229 | deploying.length |
| 230 | ? `\n${deploying.length} to deploy: ${byStage(stack, deploying).map((g) => `${g.stage} (${g.units.map((u) => u.id).join(", ")})`).join(" -> ")}` |
| 231 | : "\nNothing to deploy.", |
| 232 | ); |
| 233 | } |
| 234 | |
| 235 | /** Output of one unit, prefixed, to the terminal and a log file. */ |
| 236 | function unitLogger(id) { |
| 237 | const dir = join(tmpdir(), "g1t-deploy"); |
| 238 | mkdirSync(dir, { recursive: true }); |
| 239 | const file = join(dir, `${id}.log`); |
| 240 | const lines = []; |
| 241 | return { |
| 242 | file, |
| 243 | line: (text) => { |
| 244 | lines.push(text); |
| 245 | if (text.trim()) log(`[${id}] ${text}`); |
| 246 | }, |
| 247 | save: () => writeFileSync(file, `${lines.join("\n")}\n`), |
| 248 | }; |
| 249 | } |
| 250 | |
| 251 | /** |
| 252 | * The runner's image for this checkout, by registry reference: already in |
| 253 | * the registry (built by an earlier deploy, `deploy.mjs image`, or on |
| 254 | * another machine), or made here. Pushing, it is made in the registry |
| 255 | * (scripts/deploy/registry.mjs: the base's layers and one with the |
| 256 | * binary, nothing pulled), which needs no Docker and no room for the |
| 257 | * base; if that fails and Docker answers, it is built and pushed with |
| 258 | * Docker. A dry run builds it with Docker and pushes nothing. `docker` is |
| 259 | * asked only when needed: asking starts a job's Docker Engine. Returns |
| 260 | * { ref, note }. |
| 261 | */ |
| 262 | async function runnerImage(unit, { dryRun, docker, rebuildImage, rebuildBase }, out) { |
| 263 | let base = baseState(unit); |
| 264 | if (!base.current || rebuildBase) { |
| 265 | if (!rebuildBase) { |
| 266 | throw new Error( |
| 267 | `${unit.image.base.context} has changed since ${unit.image.base.lock} was written${base.lock ? "" : " (the base has never been built)"}. Build and push the base, and commit ${unit.image.base.lock}: node scripts/deploy.mjs build-base`, |
| 268 | ); |
| 269 | } |
| 270 | if (!(await docker())) throw new Error("--rebuild-base needs Docker."); |
| 271 | await newBase(unit, { push: !dryRun, onLine: out.line }); |
| 272 | base = baseState(unit); |
| 273 | } |
| 274 | if (!base.pushed && !dryRun) throw new Error(`${unit.image.base.lock} records a base that was never pushed: node scripts/deploy.mjs build-base`); |
| 275 | const ref = runnerRef(unit); |
| 276 | const tag = ref.split(":").pop(); |
| 277 | if (!rebuildImage) { |
| 278 | if (dryRun && (await docker()) && (await dockerHas(ref))) return { ref, note: `image ${tag} already built here` }; |
| 279 | if (!dryRun) { |
| 280 | try { |
| 281 | if (await registryHas(ref)) return { ref, note: `image ${tag} already in the registry` }; |
| 282 | } catch (error) { |
| 283 | out.line(`could not ask the registry for ${tag}: ${error.message ?? error}`); |
| 284 | } |
| 285 | } |
| 286 | } |
| 287 | if (dryRun && !(await docker())) { |
| 288 | throw new Error(`its image ${tag} is not built here, and Docker does not answer here: a dry run builds it with Docker.`); |
| 289 | } |
| 290 | const started = Date.now(); |
| 291 | const binary = await exec(process.execPath, [join(ROOT, "scripts/build-runner.mjs")], { onLine: out.line }); |
| 292 | if (binary.code !== 0) throw new Error(`the runner binary did not build:\n${lastLines(binary.out)}`); |
| 293 | if (!dryRun) { |
| 294 | try { |
| 295 | await makeRunnerImage({ ref, base: base.ref, binary: BINARY, onLine: out.line }); |
| 296 | return { ref, note: `image ${tag} made in the registry in ${seconds(Date.now() - started)}` }; |
| 297 | } catch (error) { |
| 298 | if (!(await docker())) { |
| 299 | throw new Error(`its image ${tag} could not be made in the registry (${error.message ?? error}), and Docker does not answer here to build it instead.`); |
| 300 | } |
| 301 | out.line(`could not make ${tag} in the registry (${error.message ?? error}); building it with Docker instead`); |
| 302 | } |
| 303 | } |
| 304 | // With Docker: the base is pulled and unpacked on this disk, so what the |
| 305 | // disk held is logged before and after, and when it fails. |
| 306 | await diskReport(out.line, "before the build"); |
| 307 | try { |
| 308 | if (!dryRun) await dockerLogin({ push: true }); |
| 309 | await buildRunnerImage(unit, { ref, base: base.ref, binaryDir: OUT_DIR, onLine: out.line }); |
| 310 | if (!dryRun) await pushImage(ref, { onLine: out.line }); |
| 311 | } finally { |
| 312 | await diskReport(out.line, "after the build"); |
| 313 | } |
| 314 | return { ref, note: `image ${tag} ${dryRun ? "built" : "built and pushed"} with Docker in ${seconds(Date.now() - started)}` }; |
| 315 | } |
| 316 | |
| 317 | /** Builds the base (and pushes it unless `push` is false), and writes its lock. */ |
| 318 | async function newBase(unit, { push = true, noCache = false, onLine = log } = {}) { |
| 319 | const started = Date.now(); |
| 320 | const inputs = baseInputs(unit); |
| 321 | const tag = baseTag(inputs); |
| 322 | const previous = readBaseLock(unit); |
| 323 | // Logged in, the base it replaces is pulled as cache. |
| 324 | if (push || previous?.pushed) { |
| 325 | try { |
| 326 | await dockerLogin({ push }); |
| 327 | } catch (error) { |
| 328 | if (push) throw error; |
| 329 | onLine(`not logged in to the registry, so no cache from it: ${error.message ?? error}`); |
| 330 | } |
| 331 | } |
| 332 | const ref = await buildBase(unit, { tag, previous: previous?.pushed ? previous.image : null, onLine, noCache }); |
| 333 | const built = Date.now(); |
| 334 | const [size, versions] = await Promise.all([imageSize(ref), baseVersions(ref)]); |
| 335 | const digest = push ? await pushImage(ref, { onLine }) : null; |
| 336 | const lock = { image: ref, digest, pushed: push, inputs, built_at: new Date().toISOString(), size_bytes: size, versions }; |
| 337 | writeBaseLock(unit, lock); |
| 338 | onLine(`base ${tag}: built in ${seconds(built - started)}${push ? `, pushed in ${seconds(Date.now() - built)}` : ""}, ${(size / 1e9).toFixed(2)} GB unpacked`); |
| 339 | return lock; |
| 340 | } |
| 341 | |
| 342 | /** Builds (and unless `dryRun`, deploys) one unit. */ |
| 343 | async function ship(unit, decision, { head, subject, dirty, dryRun, docker, rebuildImage, rebuildBase }) { |
| 344 | const started = Date.now(); |
| 345 | const out = unitLogger(unit.id); |
| 346 | const cwd = join(ROOT, unit.path); |
| 347 | const result = { unit: unit.id, stage: unit.stage, ok: false, version: null, ms: 0, note: "" }; |
| 348 | try { |
| 349 | if (unit.kind === "react-router" || unit.kind === "astro") { |
| 350 | // One command string: Node warns about arguments passed beside shell: true. |
| 351 | const built = await exec("npm run build", [], { cwd, onLine: out.line, shell: true, env: wranglerEnv() }); |
| 352 | if (built.code !== 0) throw new Error(`npm run build failed:\n${lastLines(built.out)}`); |
| 353 | } |
| 354 | const webRelease = unit.id === "web" && !dryRun ? await publishWebAssets(cwd, { onLine: out.line, seedLive: !decision.missing }) : null; |
| 355 | const args = ["deploy"]; |
| 356 | if (dryRun) { |
| 357 | args.push("--dry-run", "--outdir", join(tmpdir(), "g1t-deploy", "dist", unit.id)); |
| 358 | } else { |
| 359 | const { message, tag } = annotation(head, subject); |
| 360 | args.push("--message", dirty ? message.replace(/^g1t-deploy/, "g1t-deploy-dirty") : message, "--tag", tag); |
| 361 | } |
| 362 | if (unit.image) { |
| 363 | // Wrangler is given the image by reference, so it builds nothing. |
| 364 | const image = await runnerImage(unit, { dryRun, docker, rebuildImage, rebuildBase }, out); |
| 365 | args.push("--config", writeDeployConfig(unit, image.ref)); |
| 366 | args.push("--containers-rollout", containersRollout(unit, decision, { rebuildImage, rebuildBase })); |
| 367 | result.note = image.note; |
| 368 | } |
| 369 | // Tried again after a wait when Cloudflare, not what is deployed, is |
| 370 | // why it failed: deploying the same version again is harmless. |
| 371 | let deployed = await wrangler(args, { cwd, onLine: out.line }); |
| 372 | for (const wait of DEPLOY_RETRY_WAITS_MS) { |
| 373 | if (deployed.code === 0 || dryRun || !retryableDeploy(deployed.out)) break; |
| 374 | out.line(`wrangler deploy failed; trying again in ${wait / 1000}s:\n${wranglerError(deployed.out)}`); |
| 375 | await new Promise((resolve) => setTimeout(resolve, wait)); |
| 376 | deployed = await wrangler(args, { cwd, onLine: out.line }); |
| 377 | } |
| 378 | if (deployed.code !== 0) throw new Error(`wrangler deploy failed:\n${wranglerError(deployed.out)}`); |
| 379 | if (webRelease) { |
| 380 | await verifyWebAssets(webRelease); |
| 381 | out.line("Web cutover verified: current and previous build assets respond"); |
| 382 | } |
| 383 | result.version = dryRun ? "(dry run)" : versionFrom(deployed.out); |
| 384 | result.ok = true; |
| 385 | if (unit.image && !dryRun) await reportContainers(unit, cwd, out); |
| 386 | } catch (error) { |
| 387 | result.note = String(error.message ?? error); |
| 388 | } finally { |
| 389 | if (unit.image) removeDeployConfig(unit); |
| 390 | } |
| 391 | result.ms = Date.now() - started; |
| 392 | out.save(); |
| 393 | if (!result.ok) result.note += `\n full log: ${out.file}`; |
| 394 | return result; |
| 395 | } |
| 396 | |
| 397 | /** |
| 398 | * What Cloudflare runs for a unit's container applications after a deploy: |
| 399 | * each one's instance type, size, version and rollout, from `wrangler |
| 400 | * containers list`, so a deploy log says whether new settings took. Never |
| 401 | * fails the deploy. |
| 402 | */ |
| 403 | async function reportContainers(unit, cwd, out) { |
| 404 | try { |
| 405 | const listed = await wrangler(["containers", "list"], { cwd }); |
| 406 | const text = listed.out.slice(listed.out.indexOf("[")); |
| 407 | const apps = JSON.parse(text.slice(0, text.lastIndexOf("]") + 1)); |
| 408 | for (const app of apps.filter((a) => String(a.name ?? "").startsWith(`${unit.worker}-`))) { |
| 409 | const c = app.configuration ?? {}; |
| 410 | const disk = c.disk?.size_mb ?? c.disk_mb ?? c.disk?.size; |
| 411 | const size = [c.instance_type, c.vcpu != null && `${c.vcpu} vCPU`, c.memory_mib != null && `${c.memory_mib} MiB`, disk != null && `${disk} MB disk`].filter(Boolean).join(", "); |
| 412 | const rollout = app.active_rollout_id ? `rollout ${app.active_rollout_id} in progress` : "no rollout in progress"; |
| 413 | out.line(`container ${app.name}: ${size || JSON.stringify(c).slice(0, 200)}; version ${app.version ?? "?"}; ${app.instances ?? "?"} instances; ${rollout}`); |
| 414 | } |
| 415 | } catch (error) { |
| 416 | out.line(`could not read the container applications as JSON (${error.message ?? error}); wrangler said:`); |
| 417 | const said = await wrangler(["containers", "list"], { cwd }).catch(() => ({ out: "" })); |
| 418 | for (const line of said.out.split("\n").filter((l) => l.trim()).slice(0, 40)) out.line(` ${line}`); |
| 419 | } |
| 420 | } |
| 421 | |
| 422 | async function migrate(stack, units, migrations, opts) { |
| 423 | const due = units.filter((u) => migrations[u.id]?.pending?.length); |
| 424 | const broken = units.filter((u) => migrations[u.id]?.error); |
| 425 | if (broken.length) { |
| 426 | throw new Error(`Could not read pending migrations for ${broken.map((u) => u.id).join(", ")}; nothing was deployed.`); |
| 427 | } |
| 428 | if (!due.length) return []; |
| 429 | log(`== migrations: ${due.map((u) => `${u.d1.database} (${migrations[u.id].pending.length})`).join(", ")}`); |
| 430 | const results = await pool(due, opts.concurrency, async (unit) => { |
| 431 | const started = Date.now(); |
| 432 | const out = unitLogger(`${unit.id}-migrations`); |
| 433 | const applied = await applyMigrations(unit, out.line); |
| 434 | out.save(); |
| 435 | return { |
| 436 | unit: `${unit.id} (D1 ${unit.d1.database})`, |
| 437 | stage: "migrations", |
| 438 | ok: applied.code === 0, |
| 439 | version: `${migrations[unit.id].pending.length} applied`, |
| 440 | ms: Date.now() - started, |
| 441 | note: applied.code === 0 ? "" : `${lastLines(applied.out)}\n full log: ${out.file}`, |
| 442 | }; |
| 443 | }); |
| 444 | return results; |
| 445 | } |
| 446 | |
| 447 | function summary(results) { |
| 448 | const rows = results.map((r) => [r.unit, r.stage, r.ok ? "ok" : r.skipped ? "not started" : "FAILED", r.version ?? "", r.ms ? seconds(r.ms) : "", r.note.split("\n")[0]]); |
| 449 | console.log(`\n${table(rows, ["unit", "stage", "result", "version", "time", "note"])}`); |
| 450 | for (const r of results.filter((r) => !r.ok && !r.skipped)) console.log(`\n${r.unit}: ${r.note}`); |
| 451 | } |
| 452 | |
| 453 | async function deploy(stack, opts, { dryRun = false } = {}) { |
| 454 | const started = Date.now(); |
| 455 | // A build reads nothing from Cloudflare: it builds what it is given. |
| 456 | const p = dryRun ? buildPlan(stack, opts) : await plan(stack, opts); |
| 457 | if (!dryRun) printPlan(stack, p); |
| 458 | const deploying = p.decisions.filter((d) => d.deploy); |
| 459 | const touched = deploying.map((d) => d.unit); |
| 460 | const head = p.head; |
| 461 | |
| 462 | // A deploy names the commit it came from, so a dirty tree would be |
| 463 | // recorded as something it is not. |
| 464 | const dirtyFiles = git.dirty(); |
| 465 | const dirty = deploying.some((d) => dirtyFiles.some((file) => file.startsWith(`${d.unit.path}/`) || d.unit.dependsOn.some((dir) => file.startsWith(`${dir}/`)) || d.unit.inputs.includes(file))); |
| 466 | if (dirty && !dryRun && !opts.allowDirty) { |
| 467 | throw new Error("Uncommitted changes touch what would deploy. Commit them, or pass --allow-dirty (the deploy then records no commit, and the next plan deploys it again)."); |
| 468 | } |
| 469 | |
| 470 | const results = []; |
| 471 | if (!dryRun && !opts.noMigrations) { |
| 472 | const migrated = await migrate(stack, p.units, p.migrations, opts); |
| 473 | results.push(...migrated); |
| 474 | if (migrated.some((r) => !r.ok)) { |
| 475 | summary(results); |
| 476 | return false; |
| 477 | } |
| 478 | } |
| 479 | if (!touched.length) { |
| 480 | if (results.length) summary(results); |
| 481 | return true; |
| 482 | } |
| 483 | |
| 484 | if (touched.some((u) => u.kind === "rust-worker")) ensureWorkerBuild(); |
| 485 | const docker = once(dockerAvailable); |
| 486 | const context = { head, subject: git.subject(), dirty, dryRun, docker, rebuildImage: opts.rebuildImage, rebuildBase: opts.rebuildBase }; |
| 487 | // A deploy run by hand shows on the repository's Deployments page; a |
| 488 | // dirty tree is not a commit anyone can look at, so it is left out. |
| 489 | const settle = dryRun || dirty ? null : await reportDeployment({ head, subject: context.subject, units: touched.map((u) => u.id), log }); |
| 490 | |
| 491 | // status.g1t.sh hears the deploy start and finish (STATUS_DEPLOY_TOKEN; |
| 492 | // nothing without it), so the restarts it causes are not drafted as |
| 493 | // incidents. Never in a dry run, and it never fails a deploy. |
| 494 | let failed = false; |
| 495 | await withDeployWindow( |
| 496 | async () => { |
| 497 | for (const { stage, units } of byStage(stack, touched)) { |
| 498 | if (failed) { |
| 499 | for (const unit of units) results.push({ unit: unit.id, stage, ok: false, skipped: true, ms: 0, note: "an earlier stage failed" }); |
| 500 | continue; |
| 501 | } |
| 502 | // A Worker that does not exist yet goes before those bound to it. |
| 503 | for (const wave of waves(units, (unit) => Boolean(deploying.find((d) => d.unit === unit)?.missing))) { |
| 504 | if (failed) { |
| 505 | for (const unit of wave) results.push({ unit: unit.id, stage, ok: false, skipped: true, ms: 0, note: "a Worker it binds to failed to deploy" }); |
| 506 | continue; |
| 507 | } |
| 508 | log(`== ${stage}: ${wave.map((u) => u.id).join(", ")}`); |
| 509 | const shipped = await pool(wave, opts.concurrency, (unit) => ship(unit, deploying.find((d) => d.unit === unit), context)); |
| 510 | results.push(...shipped); |
| 511 | failed = shipped.some((r) => !r.ok); |
| 512 | } |
| 513 | } |
| 514 | }, |
| 515 | { id: head ?? null, dryRun, log }, |
| 516 | ); |
| 517 | summary(results); |
| 518 | await settle?.(!failed); |
| 519 | console.log(`\n${failed ? "Failed" : dryRun ? "Built" : "Deployed"} in ${seconds(Date.now() - started)}.`); |
| 520 | return !failed; |
| 521 | } |
| 522 | |
| 523 | async function doctor(stack, opts) { |
| 524 | const units = selected(stack, opts); |
| 525 | const rows = await pool(units, 8, async (unit) => { |
| 526 | if (!unit.secrets.length) return [unit.id, "", "", ""]; |
| 527 | const found = await wrangler(["secret", "list", "--name", unit.worker, "--format", "json"], { cwd: join(ROOT, unit.path) }); |
| 528 | if (found.code !== 0) return [unit.id, unit.secrets.join(" "), "?", "could not read"]; |
| 529 | const have = new Set(jsonFrom(found.out).map((s) => s.name)); |
| 530 | const missing = unit.secrets.filter((name) => !have.has(name)); |
| 531 | return [unit.id, unit.secrets.join(" "), missing.join(" "), missing.length ? "missing" : "ok"]; |
| 532 | }); |
| 533 | console.log(table(rows, ["unit", "secrets", "missing", "result"])); |
| 534 | return rows.every((r) => r[3] !== "missing"); |
| 535 | } |
| 536 | |
| 537 | async function install(stack, opts) { |
| 538 | const units = selected(stack, opts); |
| 539 | const args = npmCiArgs(units, npmWorkspace()); |
| 540 | log(`npm ${args.join(" ")}`); |
| 541 | // Through npm-ci.mjs, which runs it again when a connection drops. |
| 542 | const done = await exec(`node scripts/deploy/npm-ci.mjs ${args.slice(1).join(" ")}`, [], { cwd: ROOT, shell: true, onLine: (line) => log(line) }); |
| 543 | return done.code === 0; |
| 544 | } |
| 545 | |
| 546 | function manifest(stack, opts) { |
| 547 | const found = problems(stack, findWranglerConfigs()); |
| 548 | if (opts.check) { |
| 549 | for (const problem of found) console.log(`- ${problem}`); |
| 550 | console.log(found.length ? `\n${found.length} problems in deploy/stack.jsonc.` : "deploy/stack.jsonc is consistent with every wrangler.jsonc."); |
| 551 | return !found.length; |
| 552 | } |
| 553 | const out = stack.units.map(({ config, ...unit }) => ({ |
| 554 | ...unit, |
| 555 | queues: { |
| 556 | produces: (config?.queues?.producers ?? []).map((q) => q.queue), |
| 557 | consumes: (config?.queues?.consumers ?? []).map((q) => q.queue), |
| 558 | dead_letter: [...new Set((config?.queues?.consumers ?? []).map((q) => q.dead_letter_queue).filter(Boolean))], |
| 559 | }, |
| 560 | kv: (config?.kv_namespaces ?? []).map((kv) => stack.resources.kv?.[kv.id] ?? kv.id), |
| 561 | r2: (config?.r2_buckets ?? []).map((b) => b.bucket_name), |
| 562 | vectorize: (config?.vectorize ?? []).map((v) => v.index_name), |
| 563 | dispatch_namespaces: (config?.dispatch_namespaces ?? []).map((d) => d.namespace), |
| 564 | routes: (config?.routes ?? []).map((r) => r.pattern), |
| 565 | })); |
| 566 | if (opts.json) console.log(JSON.stringify({ stages: stack.stages, units: out }, null, 2)); |
| 567 | else |
| 568 | console.log( |
| 569 | table( |
| 570 | out.map((u) => [u.id, u.stage, u.kind, u.worker, u.d1?.database ?? "", u.dependsOn.join(" ")]), |
| 571 | ["unit", "stage", "kind", "worker", "d1", "built from (besides its folder)"], |
| 572 | ), |
| 573 | ); |
| 574 | return true; |
| 575 | } |
| 576 | |
| 577 | /** The unit with a Containers image (the runner), or the one named. */ |
| 578 | function imageUnit(stack, opts) { |
| 579 | const units = (opts.only.length ? pick(stack, opts.only) : stack.units).filter((u) => u.image?.base); |
| 580 | if (units.length !== 1) throw new Error("Name the unit with a Containers image: --only runner"); |
| 581 | return units[0]; |
| 582 | } |
| 583 | |
| 584 | async function main() { |
| 585 | const opts = parseArgs(process.argv.slice(2)); |
| 586 | const stack = resolvedStack(); |
| 587 | switch (opts.command) { |
| 588 | case "plan": { |
| 589 | const p = await plan(stack, opts); |
| 590 | const data = planJson(stack, p.decisions, p.migrations, p.head); |
| 591 | if (opts.out) writeFileSync(opts.out, `${JSON.stringify(data)}\n`); |
| 592 | if (opts.githubOutput) writeGithubOutputs(data, p); |
| 593 | if (opts.json) console.log(JSON.stringify(data, null, 2)); |
| 594 | else if (!opts.githubOutput || process.env.GITHUB_OUTPUT) printPlan(stack, p); |
| 595 | return true; |
| 596 | } |
| 597 | case "deploy": |
| 598 | return deploy(stack, opts); |
| 599 | case "build": |
| 600 | return deploy(stack, { ...opts, force: true }, { dryRun: true }); |
| 601 | case "migrate": { |
| 602 | const units = selected(stack, opts); |
| 603 | const { migrations } = await survey(units.filter((u) => u.d1), { ...opts, noMigrations: false, noLive: true }); |
| 604 | const results = await migrate(stack, units, migrations, opts); |
| 605 | if (results.length) summary(results); |
| 606 | else console.log("No migrations to apply."); |
| 607 | return results.every((r) => r.ok); |
| 608 | } |
| 609 | case "manifest": |
| 610 | return manifest(stack, opts); |
| 611 | case "doctor": |
| 612 | return doctor(stack, opts); |
| 613 | case "install": |
| 614 | return install(stack, opts); |
| 615 | case "build-base": { |
| 616 | const unit = imageUnit(stack, opts); |
| 617 | if (!(await dockerAvailable())) throw new Error("build-base needs Docker."); |
| 618 | const lock = await newBase(unit, { push: !opts.noPush, noCache: opts.noCache }); |
| 619 | console.log(JSON.stringify(lock, null, 2)); |
| 620 | if (lock.pushed) console.log(`\nCommit ${unit.image.base.lock}: the next deploy builds the runner's image on this base.`); |
| 621 | return true; |
| 622 | } |
| 623 | case "image": { |
| 624 | const unit = imageUnit(stack, opts); |
| 625 | const out = unitLogger(`${unit.id}-image`); |
| 626 | const docker = once(dockerAvailable); |
| 627 | const image = await runnerImage(unit, { dryRun: Boolean(opts.noPush), docker, rebuildImage: opts.rebuildImage, rebuildBase: opts.rebuildBase }, out); |
| 628 | out.save(); |
| 629 | console.log(`${image.ref}\n${image.note}`); |
| 630 | return true; |
| 631 | } |
| 632 | default: |
| 633 | console.error(USAGE); |
| 634 | return false; |
| 635 | } |
| 636 | } |
| 637 | |
| 638 | main().then( |
| 639 | (ok) => process.exit(ok ? 0 : 1), |
| 640 | (error) => { |
| 641 | console.error(`\n${error.message ?? error}`); |
| 642 | process.exit(1); |
| 643 | }, |
| 644 | ); |