From 9e9993180ba4444d879840edb4063afca015a2ef Mon Sep 17 00:00:00 2001
From: bulbashenko <admin@bulbashenko.com>
Date: Mon, 12 Oct 2026 19:32:46 +0200
Subject: [PATCH] Build the UI image after tests pass, then ask infra for the
 deploy PR

image.yml now runs on workflow_run of test, only for pushes to main where test (UI checks + e2e) succeeded, and builds the tested head_sha. Previously it ran in parallel with the tests, so an image could be promoted for a commit whose e2e failed. A promote job then opens or refreshes the PR deploy/auth in bulbashenko-com/infra (the owner merges it). Cost: the image appears after e2e (~10-30 min) instead of right after the push. workflow_dispatch still builds the selected ref by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/image.yml | 31 +++++++++++++++++++++++++++----
 README.md                   |  2 +-
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 79fe09d..56646f3 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -1,9 +1,12 @@
-# Builds the UI image (also used for the hydra-clients Job) for the Kubernetes deployment.
+# Builds the UI image (also used for the hydra-clients Job) for the Kubernetes deployment, once `test`
+# passed on a push to main, then asks bulbashenko-com/infra for the production deploy PR (the owner merges it).
 # Tag = full commit SHA: bulbashenko-com/infra pins the same SHA for the configs and the image.
 name: image
 
 on:
-  push:
+  workflow_run:
+    workflows: [test]
+    types: [completed]
     branches: [main]
   workflow_dispatch:
 
@@ -13,9 +16,19 @@ permissions:
 
 jobs:
   ui:
+    # Only commits that landed on main (not PRs from a branch named main) and passed UI checks + e2e.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: ubuntu-24.04
+    outputs:
+      sha: ${{ steps.sha.outputs.sha }}
     steps:
+      - id: sha
+        run: echo "sha=${{ github.event.workflow_run.head_sha || github.sha }}" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.sha.outputs.sha }}
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
@@ -27,10 +40,20 @@ jobs:
           context: ui
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/auth-ui:${{ github.sha }}
+            ghcr.io/${{ github.repository_owner }}/auth-ui:${{ steps.sha.outputs.sha }}
             ghcr.io/${{ github.repository_owner }}/auth-ui:main
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ steps.sha.outputs.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  # Opens or refreshes the production deploy PR deploy/auth in bulbashenko-com/infra.
+  promote:
+    needs: ui
+    if: github.ref == 'refs/heads/main'
+    uses: bulbashenko-com/infra/.github/workflows/request-promote.yml@main
+    with:
+      app: auth
+      sha: ${{ needs.ui.outputs.sha }}
+    secrets: inherit
diff --git a/README.md b/README.md
index bde4197..d7d7bb3 100644
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@ Groups decide access. Each OIDC client names one group in `metadata.required_gro
 
 `kustomization.yaml` at the root is a Kustomize base built from the same `ory/` files that `compose.yml` mounts: Deployments for Kratos, Hydra and Keto (each runs its migration as an init container), Oathkeeper and the UI, the `hydra-clients` Job, and Traefik routes (`auth-public` on the `web` entrypoint, `auth-admin` for `users.int` behind the mesh and Oathkeeper). Service names match the compose stack, so the configs' internal URLs work unchanged.
 
-The deploying side provides the namespace, the image tag and a Secret `auth` with `KRATOS_DSN`, `HYDRA_DSN`, `KETO_DSN`, `KRATOS_SECRETS_{COOKIE,DEFAULT,CIPHER,PAGINATION}`, `HYDRA_SECRETS_{SYSTEM,COOKIE,PAGINATION}`, `SMTP_CONNECTION_URI`, `SMTP_SENDER` and `OIDC_{SITE,COOLIFY,HEADSCALE}_CLIENT_SECRET`. bulbashenko.com deploys it from [bulbashenko-com/infra](https://github.com/bulbashenko-com/infra), pinned to one commit of this repo; `.github/workflows/image.yml` builds `ghcr.io/bulbashenko-com/auth-ui:<commit>` for that commit.
+The deploying side provides the namespace, the image tag and a Secret `auth` with `KRATOS_DSN`, `HYDRA_DSN`, `KETO_DSN`, `KRATOS_SECRETS_{COOKIE,DEFAULT,CIPHER,PAGINATION}`, `HYDRA_SECRETS_{SYSTEM,COOKIE,PAGINATION}`, `SMTP_CONNECTION_URI`, `SMTP_SENDER` and `OIDC_{SITE,COOLIFY,HEADSCALE}_CLIENT_SECRET`. bulbashenko.com deploys it from [bulbashenko-com/infra](https://github.com/bulbashenko-com/infra), pinned to one commit of this repo; `.github/workflows/image.yml` builds `ghcr.io/bulbashenko-com/auth-ui:<commit>` once `test` passes on main and then opens the deploy PR `deploy/auth` in infra.
 
 ## Deploy on Coolify