Uebliche

Appearance

Deployment ​

The Public API production workflow deploys the exact API and Docker stack revisions recorded by the parent repository. A direct push to the API repository does not deploy production until the parent repository records and pushes the updated submodule pointer to master.

Pipeline ​

  1. Serialize production deployments so two pushes cannot roll out concurrently.
  2. Validate required production configuration and resolve the pinned API and Docker stack commits.
  3. Run Rust formatting and unit tests plus the deployment contract tests.
  4. Build the release image once and push an immutable build tag and the master-latest convenience tag to the private registry.
  5. Deploy EU as the canary region.
  6. Wait for the EU Swarm service to use the expected image and reach its desired replica count.
  7. Run a disposable health probe on the EU node through the internal uebliche overlay network. The probe requires the expected build, region=eu, and a healthy database response.
  8. Promote the same image to the remaining configured regions and repeat the rollout and health checks for each region.
  9. Verify the global https://api.uebliche.net/health endpoint reports the new build before completing the workflow.

The regional probes intentionally use the private Swarm network. Production does not require public eu.api, us.api, or ap.api DNS records for rollout verification.

Failure behavior ​

  • A failed source or contract test prevents the image push.
  • A failed EU canary stops promotion to other regions.
  • A paused or rolling-back Swarm update fails immediately.
  • Missing replicas, a stale image, the wrong build or region, or an unhealthy database fails the regional verification.
  • The stack keeps Docker Swarm's failure_action: rollback policy for unhealthy container updates.

Regional checks time out after four minutes by default. The final public check retries for two minutes to allow the global entrypoint to converge.

Manual trigger ​

The same workflow can be started with workflow_dispatch. Manual runs use the same test, canary, promotion, and verification gates as pushes to master.