Vertex — delivery pipeline
A single manual workflow in thetaxgraph-ai/ttg-infra releases to stage or prod. It builds from an
exact commit of thetaxgraph-ai/vertex; nothing in the vendor repository can trigger it.
Operator commands
# Stage: latest develop
gh workflow run vertex-deploy.yml -R thetaxgraph-ai/ttg-infra -f env=stage
# Prod: a reviewed commit (full 40-character SHA)
SHA=$(git -C ~/projects/vertex rev-parse origin/main)
gh workflow run vertex-deploy.yml -R thetaxgraph-ai/ttg-infra -f env=prod -f sha=$SHA -f target=all
gh run watch -R thetaxgraph-ai/ttg-infra
# Stage on / off
gh workflow run stage-power.yml -R thetaxgraph-ai/ttg-infra -f state=on # or off
The same workflows can be started from GitHub → ttg-infra → Actions → Run workflow.
target is all, backend or console.
Steps
| # | Step | Detail |
|---|---|---|
| 1 | Trigger | Operator runs vertex-deploy.yml with env, sha, target |
| 2 | Validate | prod requires a full SHA; sanity check that it is on vertex main |
| 3 | Checkout | vertex @ SHA with a read-only token, plus ttg-infra config |
| 4 | Build | core, identity — linux/amd64 |
| 5 | Push | ghcr.io/thetaxgraph-ai/vertex-<env>-{core,identity}:<sha> |
| 6 | Assume role | GitHub OIDC → vertex-<env>-deploy |
| 7 | Rolling update | New task definition revision → ecs update-service → Alembic on start → health checks → old task stops; automatic rollback if unhealthy; workflow waits for services-stable |
| 8 | Build console | npm ci && npm run build in vertex/console |
| 9 | Deploy Worker | wrangler deploy --env <env> --message <sha> with the per-Worker token |
| 10 | Verify | Smoke test through the hostname; run summary with links |
Rollback and observability
| Concern | Control |
|---|---|
| Failed backend release | ECS deployment circuit breaker rolls back automatically; or re-run with the previous SHA |
| Bad console release | wrangler rollback, or re-run with the previous SHA |
| Database migrations | Forward-only and backward-compatible — old and new tasks overlap briefly during a rolling deploy |
| Where to watch | Actions run log · ECS → service → Deployments/Events · CloudWatch Logs /vertex/<env>/* · Worker → Deployments (message = SHA) |
GitHub Actions budget
The organisation is on GitHub Free: 2,000 Actions minutes per month shared by all private repositories;
usage is blocked once exhausted (no payment method). Deployments only run when triggered manually, so the
vendor cannot consume minutes through ttg-infra.