chore: update gcp/fly deployment yamls (#1005)

* chore: update gcp/fly deployment yamls

* fix: coderabbit comments

.github/workflows/fly-deploy-prod.yml

@@ -1,61 +0,0 @@
-# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
-
-name: Fly Deploy (Production Environment)
-permissions:
-  contents: read
-on:
-  push:
-    tags:
-      - v*
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to deploy (without v prefix)"
-        required: true
-        type: string
-        default: 'manual'
-
-jobs:
-  deploy-honcho-prod-image:
-    name: Deploy Honcho Image (Production Environment)
-    runs-on: ubuntu-latest
-    concurrency:
-      group: deploy-prod-group
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v4
-      - uses: superfly/flyctl-actions/setup-flyctl@1.5
-      - run: |
-          # Determine the image label based on trigger type
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            IMAGE_LABEL="deployment-${{ github.event.inputs.version }}"
-          else
-            IMAGE_LABEL="deployment-${{ github.ref_name }}"
-          fi
-          flyctl deploy -a honcho-prod-image --remote-only --build-only --push --no-cache --image-label "$IMAGE_LABEL"
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_PROD_API_TOKEN }}
-
-  prompt-service:
-    name: Push to Service (Production Environment)
-    needs: deploy-honcho-prod-image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send POST request
-        env:
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-        run: |
-          # Determine version and image label based on trigger type
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            TAG="${{ github.event.inputs.version }}"
-            IMAGE_LABEL="honcho-prod-image:deployment-${{ github.event.inputs.version }}"
-          else
-            TAG=${GITHUB_REF_NAME#v}
-            IMAGE_LABEL="honcho-prod-image:deployment-${GITHUB_REF_NAME}"
-          fi
-
-          curl --fail -X POST \
-            -H "Content-Type: application/json" \
-            -H "Authorization: Bearer ${{ secrets.PROD_ENV_WEBHOOK_SECRET }}" \
-            -d "{\"version\":\"$TAG\",\"image_label\":\"$IMAGE_LABEL\"}" \
-            "${{ secrets.PROD_ENV_URL }}/webhooks/v1/add_honcho_version"

.github/workflows/fly-deploy.yml

@@ -1,61 +0,0 @@
-# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/
-
-name: Fly Deploy (Test Environment)
-permissions:
-  contents: read
-on:
-  push:
-    tags:
-      - v*
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to deploy (without v prefix)"
-        required: true
-        type: string
-        default: 'manual'
-
-jobs:
-  deploy-honcho-image:
-    name: Deploy Honcho Image (Test Environment)
-    runs-on: ubuntu-latest
-    concurrency:
-      group: deploy-test-group
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@v4
-      - uses: superfly/flyctl-actions/setup-flyctl@1.5
-      - run: |
-          # Determine the image label based on trigger type
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            IMAGE_LABEL="deployment-${{ github.event.inputs.version }}"
-          else
-            IMAGE_LABEL="deployment-${{ github.ref_name }}"
-          fi
-          flyctl deploy -a honcho-image --remote-only --build-only --push --no-cache --image-label "$IMAGE_LABEL"
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-
-  prompt-service:
-    name: Push to Service (Test Environment)
-    runs-on: ubuntu-latest
-    needs: deploy-honcho-image
-    steps:
-      - name: Send POST request
-        env:
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-        run: |
-          # Determine version and image label based on trigger type
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            TAG="${{ github.event.inputs.version }}"
-            IMAGE_LABEL="honcho-image:deployment-${{ github.event.inputs.version }}"
-          else
-            TAG=${GITHUB_REF_NAME#v}
-            IMAGE_LABEL="honcho-image:deployment-${GITHUB_REF_NAME}"
-          fi
-
-          curl --fail -X POST \
-            -H "Content-Type: application/json" \
-            -H "Authorization: Bearer ${{ secrets.TEST_ENV_WEBHOOK_SECRET }}" \
-            -d "{\"version\":\"$TAG\",\"image_label\":\"$IMAGE_LABEL\"}" \
-            "${{ secrets.TEST_ENV_URL }}/webhooks/v1/add_honcho_version"

.github/workflows/push-gcp-registry-prod.yml

@@ -7,13 +7,6 @@ on:
   push:
     tags:
       - v*
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to deploy (without v prefix)"
-        required: true
-        type: string
-        default: "manual"
 
 env:
   GCP_PROJECT_ID: ${{ secrets.PROD_GCP_PROJECT_ID }}
@@ -25,9 +18,26 @@ env:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Resolve and verify version
+        id: version
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          # A running instance serves this version at /openapi.json, so it must
+          # match the version being deployed.
+          PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)"
+          if [[ "$VERSION" != "$PYPROJECT_VERSION" ]]; then
+            echo "::error::pyproject.toml version '$PYPROJECT_VERSION' does not match tag '$GITHUB_REF_NAME'. Bump pyproject.toml before tagging."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Authenticate to GCP
         uses: google-github-actions/auth@v2
@@ -42,15 +52,27 @@ jobs:
 
       - name: Build and push image
         env:
-          VERSION: ${{ github.event.inputs.version }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          # Determine the image label based on trigger type
-          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
-            IMAGE_LABEL="deployment-${VERSION}"
-          else
-            IMAGE_LABEL="deployment-${GITHUB_REF_NAME}"
-          fi
           BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}"
-          TAG="$BASE:$IMAGE_LABEL"
+          TAG="$BASE:deployment-v${VERSION}"
           docker build -t "$TAG" .
           docker push "$TAG"
+
+  prompt-service:
+    name: Push to Service (Production Environment)
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    steps:
+      - name: Send POST request
+        env:
+          VERSION: ${{ needs.build-and-push.outputs.version }}
+        run: |
+          # Name and tag only; the registry path is supplied downstream.
+          IMAGE_LABEL="${{ env.IMAGE_NAME }}:deployment-v${VERSION}"
+
+          curl --fail --connect-timeout 10 --max-time 60 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${{ secrets.PROD_ENV_WEBHOOK_SECRET }}" \
+            -d "{\"version\":\"$VERSION\",\"image_label\":\"$IMAGE_LABEL\"}" \
+            "${{ secrets.PROD_ENV_URL }}/webhooks/v1/add_honcho_version"

.github/workflows/push-gcp-registry-staging.yml

@@ -7,13 +7,6 @@ on:
   push:
     tags:
       - v*
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to deploy (without v prefix)"
-        required: true
-        type: string
-        default: "manual"
 
 env:
   GCP_PROJECT_ID: ${{ secrets.STAGING_GCP_PROJECT_ID }}
@@ -25,9 +18,26 @@ env:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Resolve and verify version
+        id: version
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          # A running instance serves this version at /openapi.json, so it must
+          # match the version being deployed.
+          PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)"
+          if [[ "$VERSION" != "$PYPROJECT_VERSION" ]]; then
+            echo "::error::pyproject.toml version '$PYPROJECT_VERSION' does not match tag '$GITHUB_REF_NAME'. Bump pyproject.toml before tagging."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Authenticate to GCP
         uses: google-github-actions/auth@v2
@@ -42,15 +52,27 @@ jobs:
 
       - name: Build and push image
         env:
-          VERSION: ${{ github.event.inputs.version }}
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          # Determine the image label based on trigger type
-          if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
-            IMAGE_LABEL="deployment-${VERSION}"
-          else
-            IMAGE_LABEL="deployment-${GITHUB_REF_NAME}"
-          fi
           BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}"
-          TAG="$BASE:$IMAGE_LABEL"
+          TAG="$BASE:deployment-v${VERSION}"
           docker build -t "$TAG" .
           docker push "$TAG"
+
+  prompt-service:
+    name: Push to Service (Staging Environment)
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    steps:
+      - name: Send POST request
+        env:
+          VERSION: ${{ needs.build-and-push.outputs.version }}
+        run: |
+          # Name and tag only; the registry path is supplied downstream.
+          IMAGE_LABEL="${{ env.IMAGE_NAME }}:deployment-v${VERSION}"
+
+          curl --fail --connect-timeout 10 --max-time 60 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${{ secrets.TEST_ENV_WEBHOOK_SECRET }}" \
+            -d "{\"version\":\"$VERSION\",\"image_label\":\"$IMAGE_LABEL\"}" \
+            "${{ secrets.TEST_ENV_URL }}/webhooks/v1/add_honcho_version"