Repository navigation
Feat/stit 766 ci - #334
Open
AlexAxthelm wants to merge 2 commits into
Open
Feat/stit 766 ci#334AlexAxthelm wants to merge 2 commits into
AlexAxthelm wants to merge 2 commits into
Conversation
Add a Rebuild Read Model job that runs `rebuild --if-stale` from the deployed API image once the API deploy finishes, so each deploy of new code gets its fast path back without a manual step. The API deploy now waits until the previous revision has stopped serving (plus 45 s for in-flight requests), so the old code's writes can't land after the rebuild marks the table ready. Nothing waits on the rebuild: if it fails, lists stay on the slower live path and the PR summary comment shows a warning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CD summary
|
| service | url | fqdn |
|---|---|---|
| api | open | pr-0334-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io |
| frontend | https://witty-mushroom-017a3dc1e-334.westus2.1.azurestaticapps.net | |
| stitch-llm | open | pr-0334-llm.purplegrass-c07d0a94.westus2.azurecontainerapps.io |
Database (1)
| db_name | postgres_host | postgres_port | postgres_db |
|---|---|---|---|
| pr_0334 | stitch-dev.postgres.database.azure.com |
5432 |
pr_0334 |
Jobs (2)
| job | image | postgres_db | api_url | auth_mode |
|---|---|---|---|---|
| db-migrations | ghcr.io/rmi/stitch-api:pr-0334@sha256:7a961dc2995941192c4692cdf8c40c0a646b4e1e8cf330b0f38f82a157faabfa |
pr_0334 |
||
| seed | ghcr.io/rmi/stitch-seed:pr-0334@sha256:d4fd2a110684b179b87d2c3d62cf7ecef24d544886b749aa5a0a07549d5c4aea |
https://pr-0334-api.purplegrass-c07d0a94.westus2.azurecontainerapps.io/api/v1 |
stitch-client-bearer-token |
Images (3)
| build_time | commit_time | git_sha | image | image_digest |
|---|---|---|---|---|
| 2026-10-16T08:46:07Z | 2026-10-16T08:45:48Z | c230a79 | ghcr.io/rmi/stitch-api:pr-0334 |
ghcr.io/rmi/stitch-api:pr-0334@sha256:7a961dc2995941192c4692cdf8c40c0a646b4e1e8cf330b0f38f82a157faabfa |
| 2026-10-16T08:46:09Z | 2026-10-16T08:45:48Z | c230a79 | ghcr.io/rmi/stitch-seed:pr-0334 |
ghcr.io/rmi/stitch-seed:pr-0334@sha256:d4fd2a110684b179b87d2c3d62cf7ecef24d544886b749aa5a0a07549d5c4aea |
| 2026-10-16T08:46:05Z | 2026-10-16T08:45:48Z | c230a79 | ghcr.io/rmi/stitch-stitch-llm:pr-0334 |
ghcr.io/rmi/stitch-stitch-llm:pr-0334@sha256:09c31accaf1a110a4b31372c74e3e097218e78229e05082c6104a246ce940f72 |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Version-safety gaps can expose mixed-version read-model rows during cutover and after disabled-table repairs.
2 open findings
What changed in this PR
Completes the STIT-766 rollout by rebuilding the API’s permission-scoped read model after deployment cutover, with live-query fallback until ready.
Changes:
- Adds cutover waiting, post-deploy rebuilds, and PR warning reporting.
- Includes read-model storage, queries, write maintenance, and rebuild controls.
- Adds regression tests and operational documentation.
| File | Description |
|---|---|
| HACKING.md | Documents local rebuilds. |
| deployments/CI_DEPLOYMENTS.md | Explains automated deployment sequencing. |
| deployments/api/tests/observability/test_query_name_actions.py | Verifies read-model query labels. |
| deployments/api/tests/db/read_model/test_state.py | Tests rebuilds, readiness, and repairs. |
| deployments/api/tests/db/read_model/test_resource_state_schema.py | Checks schema constraints and types. |
| deployments/api/tests/db/read_model/test_rebuild_lock_postgres.py | Tests rebuild locking. |
| deployments/api/tests/db/read_model/test_rebuild_and_repair_postgres.py | Tests concurrent rebuilds and repairs. |
| deployments/api/tests/db/read_model/test_read_path.py | Tests parity and live fallback. |
| deployments/api/tests/db/read_model/test_read_path_postgres.py | Tests PostgreSQL read consistency. |
| deployments/api/tests/db/read_model/test_permissions.py | Tests exact permission matching. |
| deployments/api/tests/db/read_model/test_mutations.py | Verifies write-maintained state. |
| deployments/api/tests/db/read_model/test_concurrency_postgres.py | Tests concurrent writes and locking. |
| deployments/api/tests/db/read_model/scenarios.py | Shares rebuild concurrency scenarios. |
| deployments/api/tests/db/read_model/postgres.py | Controls PostgreSQL test availability. |
| deployments/api/tests/db/read_model/dataset.py | Provides deterministic test data. |
| deployments/api/tests/db/read_model/conftest.py | Provides isolated database fixtures. |
| deployments/api/tests/db/read_model/__init__.py | Defines the test package. |
| deployments/api/tests/conftest.py | Resets cached readiness between tests. |
| deployments/api/src/stitch/api/db/read_model/state.py | Implements state maintenance and rebuilds. |
| deployments/api/src/stitch/api/db/read_model/rebuild.py | Adds the rebuild and repair CLI. |
| deployments/api/src/stitch/api/db/read_model/permissions.py | Defines permission profiles. |
| deployments/api/src/stitch/api/db/read_model/__init__.py | Documents the read-model package. |
| deployments/api/src/stitch/api/db/queries.py | Adds stored-state queries. |
| deployments/api/src/stitch/api/db/og_field_source_actions.py | Refreshes state on source attachments. |
| deployments/api/src/stitch/api/db/og_field_resource_actions.py | Adds cached reads and write refreshes. |
| deployments/api/src/stitch/api/db/model/og_field_resource_state.py | Defines state and readiness models. |
| deployments/api/src/stitch/api/db/model/__init__.py | Exports the new models. |
| deployments/api/README.md | Links rebuild guidance. |
| deployments/api/READ_MODEL.md | Provides rollout and recovery guidance. |
| deployments/api/alembic/versions/48a49d197641_add_resource_state_read_model.py | Creates read-model tables and indexes. |
| deployments/api/alembic/versions/2f2fb644b180_resource_state_disabled_flag.py | Adds the operator disable flag. |
| .github/workflows/rebuild-read-model.yml | Runs post-deploy rebuilds. |
| .github/workflows/python-test.yml | Enables PostgreSQL tests in CI. |
| .github/workflows/deploy-container.yml | Adds optional cutover waiting. |
| .github/workflows/build-and-deploy.yml | Connects deployment and rebuild jobs. |
| .github/scripts/build_pr_summary_comment.py | Supports warning-only entries. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
4 tasks done
Closed
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fifth (last) PR of splitting #324 into smaller PRs for ease of review. Builds on #333
Wire up the new read model as part of CI/CD deployments. This adds an optional "wait" for the container deploy action, which checks that the cutover is complete before reporting green, which allows us to ensure that the traffic is all pointed at the new version before initiating a read-state rebuild (which is keyed on code version), so that we don't run into version conflicts on the read table.
In the moments where the new code version is live, but the rebuild hasn't happened yet, the application will have some degraded performance, since it falls back to the live coalescing path.
Summary
Fifth PR in the STIT-766 read-model stack (builds on #333). CI now rebuilds the read model after each API deploy, once the previous API revision has stopped serving.
Why the deploy has to wait first
Changes
deploy-container.yml: newwait-for-cutoverinput (opt-in; only the API sets it).az containerapp revision listevery 10 s until no active revision runs another image and one running this image has finished provisioning, then waits 45 s for in-flight requests to drain.rebuild-read-model.yml: runspython -m stitch.api.db.read_model.rebuild --if-stalefrom the deployed API image (so it records the same commit as the API), asstitch_app.--if-stalemakes it a no-op when the read model is already current, and resumes where a failed run stopped.build-and-deploy.yml:wait-for-cutover: true;rebuild-read-modeljob runs after it;build_pr_summary_comment.pynow lets an entry contribute only warnings, with no table row.READ_MODEL.md's "Rolling it out" now describes the automated flow, including what to do if the job fails, replacing feat(api): serve field lists from the resource-state read model #333's manual steps.CI_DEPLOYMENTS.mdand the API README mention the job.The stack
With this, the stack covers everything in #324, apart from the design docs, which are going in a separate PR.
Related issues
Part of: STIT-766
Replaces: #324 (split for review)
Testing
resources.list_pagequery label instead ofresources.list_ids+resources.list_hydrate.yamllintreports nothing new compared with main (ignoring line length);make checkpasses.Checklist
AI use: Claude Code split this out of #324 and wrote most of the workflow changes and docs. I reviewed it before committing. Verified by the local checks above and this PR's CI run (and, for the cutover wait, a real deploy on #324).
🤖 Generated with Claude Code