ci: stop GitLab deploying previews and production before the switch #571

2026-10-22T09:54:29Z

root commented

2026-10-22 09:54:29 +00:00

(Migrated from gitlab.core-project.space)

Summary

GitLab's job list, .gitlab-ci.yml and its includes:

 .pre
   changes
   reuse-gate
   cancel-merged
-  reuse-image
 test
   checks
   front-test
   e2e
   audit                  # lockfile MRs + nightly AUDIT=1
   renovate               # weekly RENOVATE=1
 build
-  build-workspace        # only fed build-image
-  build-image
 deploy
-  review
-  stop-review
-  review-screenshots
-  review-notes
-  production
-  reap                   # nightly schedule
+  reap                   # by hand only: Run pipeline with REAP=1
   backup-production      # nightly BACKUP=1, unchanged

Helpers gone with them: .review-rules, .image-rules, .registry-login, .skip-no-preview, DEPLOY_DOMAIN. Kept: .docker and .vps (the reap and the backup use them). deploy/, deploy-reap.sh and the local PoC file infra/gitlab/ci/deploy.gitlab-ci.yml (not included) are untouched; #499 deletes infra/gitlab/. infra/gitlab/vps/README.md notes the removal where it described those jobs.

The reap keeps a manual trigger so the teardown in infra/forgejo/SWITCH-DAY.md step 1 can run once with every merge request closed.

Evidence

Before: a push to main ran reuse-image → build-workspace → build-image → production; each MR ran review and its screenshots.
After: the inlined config (includes merged into one file) lints clean on the server, and every needs, extends and !reference resolves:

$ glab ci lint merged-ci.yml
✓ CI/CD YAML is valid!
jobs: audit backup-production cancel-merged changes checks e2e front-test reap renovate reuse-gate
errors: 0   # dangling needs / extends / !reference

Gate: pnpm lint, typecheck, test, build, format:check all green.

Merge Danger

Door: one-way-ish

Production stops auto-deploying on merge and keeps serving its current image until Forgejo's first green main deploys over it. In code it is a two-way door: reverting restores every job.

Blast Radius: deploys

No MR gets a preview after this; previews already running stay until the reap is run by hand. The nightly reap schedule now creates no pipeline (no job matches); deactivate it or leave it until #499.

Refs #498

## Summary GitLab's job list, `.gitlab-ci.yml` and its includes: ```diff .pre changes reuse-gate cancel-merged - reuse-image test checks front-test e2e audit # lockfile MRs + nightly AUDIT=1 renovate # weekly RENOVATE=1 build - build-workspace # only fed build-image - build-image deploy - review - stop-review - review-screenshots - review-notes - production - reap # nightly schedule + reap # by hand only: Run pipeline with REAP=1 backup-production # nightly BACKUP=1, unchanged ``` Helpers gone with them: `.review-rules`, `.image-rules`, `.registry-login`, `.skip-no-preview`, `DEPLOY_DOMAIN`. Kept: `.docker` and `.vps` (the reap and the backup use them). `deploy/`, `deploy-reap.sh` and the local PoC file `infra/gitlab/ci/deploy.gitlab-ci.yml` (not included) are untouched; #499 deletes `infra/gitlab/`. `infra/gitlab/vps/README.md` notes the removal where it described those jobs. The reap keeps a manual trigger so the teardown in `infra/forgejo/SWITCH-DAY.md` step 1 can run once with every merge request closed. ## Evidence - **Before:** a push to `main` ran `reuse-image → build-workspace → build-image → production`; each MR ran `review` and its screenshots. **After:** the inlined config (includes merged into one file) lints clean on the server, and every `needs`, `extends` and `!reference` resolves: ```text $ glab ci lint merged-ci.yml ✓ CI/CD YAML is valid! jobs: audit backup-production cancel-merged changes checks e2e front-test reap renovate reuse-gate errors: 0 # dangling needs / extends / !reference ``` - Gate: `pnpm lint`, `typecheck`, `test`, `build`, `format:check` all green. ## Merge Danger **Door:** one-way-ish Production stops auto-deploying on merge and keeps serving its current image until Forgejo's first green `main` deploys over it. In code it is a two-way door: reverting restores every job. **Blast Radius:** deploys No MR gets a preview after this; previews already running stay until the reap is run by hand. The nightly reap schedule now creates no pipeline (no job matches); deactivate it or leave it until #499. Refs #498

root commented

2026-10-22 09:54:33 +00:00

(Migrated from gitlab.core-project.space)

changed the description