ci: fix cloud-mcp preview auto-deploy (GitHub App auth + released version) - #1092
ci: fix cloud-mcp preview auto-deploy (GitHub App auth + released version)#1092Aaron ("AJ") Steers (aaronsteers) wants to merge 2 commits into
Conversation
…eased version Co-Authored-By: AJ Steers <aj@airbyte.io>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. 💡 Show Tips and TricksTesting This PyAirbyte VersionYou can test this version of PyAirbyte using the following: # Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1784938016-cloud-mcp-preview-app-token' pyairbyte --help
# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1784938016-cloud-mcp-preview-app-token'PR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
📚 Show Repo GuidanceHelpful ResourcesCommunity SupportQuestions? Join the #pyairbyte channel in our Slack workspace. |
There was a problem hiding this comment.
Pull request overview
Fixes the release-triggered Cloud MCP preview auto-deploy by switching cross-repo repository_dispatch authentication to an Octavia GitHub App installation token (scoped to airbyte-ops-mcp) and by including the released airbyte version in the dispatch payload so the preview deploy reflects the newly published library.
Changes:
- Resolve the published version (from
release.tag_nameorworkflow_dispatchversion_override) and expose it as a step output. - Authenticate dispatch to
airbytehq/airbyte-ops-mcpviaactions/create-github-app-tokeninstead of a non-existent PAT. - Include
airbyte-versionin therepository_dispatchpayload and update inline workflow documentation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # A PyPI publish dispatches the just-released version to airbyte-ops-mcp, which | ||
| # opens/refreshes a deterministic `airbyte==<version>` bump PR and deploys the | ||
| # cloud-mcp preview off it (see `deploy-mcp-command.yml`). |
There was a problem hiding this comment.
☑️ Resolved in f645196. Reworded the comment to make the cross-repo location explicit: "dispatches the just-released version to airbyte-ops-mcp, whose deploy-mcp-command.yml opens/refreshes a deterministic airbyte==<version> bump PR and deploys the cloud-mcp preview off it." That consuming workflow lives in airbytehq/airbyte-ops-mcp#1175.
| repository: airbytehq/airbyte-ops-mcp | ||
| event-type: deploy-cloud-mcp | ||
| client-payload: '{"mcp-server": "cloud-mcp", "preview": "true"}' | ||
| client-payload: '{"mcp-server": "cloud-mcp", "preview": "true", "airbyte-version": "${{ steps.version.outputs.value }}"}' |
There was a problem hiding this comment.
☑️ Resolved in f645196. The version is now validated against a PEP 440-ish regex (^[0-9]+\.[0-9]+\.[0-9]+([.a-zA-Z0-9-]*)?$) in the Resolve released version step and the run fails if it doesn't match, so by the time it's interpolated into the client-payload JSON it can only contain [0-9A-Za-z.-] — no quotes/backslashes to break the JSON. I kept the plain interpolation rather than toJson(...) since the validated value is guaranteed safe.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PyPI publish workflow resolves and validates the exact package version, waits for its PyPI endpoint, authenticates with a GitHub App token, and dispatches a versioned cloud-mcp preview deployment. ChangesCloud MCP preview deployment
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant PublishWorkflow
participant PyPI
participant AirbyteOpsMCP
PublishWorkflow->>PublishWorkflow: Resolve and validate release version
PublishWorkflow->>PyPI: Poll version-specific package endpoint
PublishWorkflow->>AirbyteOpsMCP: Dispatch deploy-cloud-mcp with airbyte-version
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pypi_publish.yml:
- Around line 94-102: Update the “Resolve released version” step to receive the
release tag and version override through the step environment rather than
interpolating event metadata into shell source. Select the appropriate
environment value, normalize its leading “v”, and validate the result against
the expected version format before writing the `value` output. Ensure the
validated value is emitted safely so malicious quotes cannot corrupt the output
consumed by the later JSON payload.
- Around line 104-105: Replace the fixed sleep in the “Wait for PyPI
availability” step with a bounded retry loop that polls the version-specific
PyPI endpoint and proceeds only when the published version is available; fail
clearly after the retry limit is exhausted.
- Around line 110-117: Update the “Authenticate as GitHub App” step using the
get-app-token action to explicitly request only the contents: write permission
via its permission-contents input, while preserving the existing repository and
credential configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 94db0807-2d50-49be-95f3-c2b68f90ee09
📒 Files selected for processing (1)
.github/workflows/pypi_publish.yml
…ken to contents:write Co-Authored-By: AJ Steers <aj@airbyte.io>
Code Coverage OverviewLanguages: Python Python / code-coverage/pytest-fastThe overall coverage in commit f645196 in the Show a code coverage summary of the most impacted files.
Python / code-coverage/pytest-no-credsThe overall coverage in commit f645196 in the Show a code coverage summary of the most impacted files.
Python / code-coverage/pytestThe overall coverage in commit f645196 in the Show a code coverage summary of the most impacted files.
Updated |
Summary
The PyAirbyte release-triggered cloud-mcp preview auto-deploy has never worked:
deploy_cloud_mcp_previewauthenticated the cross-reporepository_dispatchwithsecrets.GITHUB_CI_WORKFLOW_TRIGGER_PAT, a secret that doesn't exist in this repo (it lives inairbyte-ops-mcp). At runtime it resolved empty andpeter-evans/repository-dispatchfailed withParameter token or opts.auth is required, so no dispatch ever reachedairbyte-ops-mcp(confirmed on thev0.53.1release run).Two fixes here:
prerelease-command.yml) instead of the phantom PAT — an installation token scoped to the target repo:requirements.txtwas already pinned to:<version>is resolved fromrelease.tag_name(minus a leadingv) for release events, orinputs.version_overrideforworkflow_dispatchprereleases.The consuming side lives in airbytehq/airbyte-ops-mcp#1175: on a
deploy-cloud-mcpdispatch carryingairbyte-version, that workflow opens/refreshes a deterministicairbyte==<version>bump PR and deploys the cloud-mcp preview off it.Prerequisite (ops/admin): the Octavia GitHub App must be installed on
airbyte-ops-mcpwithcontents: write(required for the/dispatchesendpoint and for the bump-branch push on the consuming side). AJ confirmed it's scoped for this.Link to Devin session: https://app.devin.ai/sessions/a5b9501ef92c412aad0408b7c74ef9c8
Requested by: Aaron ("AJ") Steers (@aaronsteers)
Summary by CodeRabbit