Add external scheduler examples for cloud platforms by ezzatron · Pull Request #89 · ghalactic/provision-github-tokens

ezzatron · 2026-05-18T22:55:23Z

Adds ready-to-deploy external scheduler examples for Cloudflare Workers, AWS Lambda, GCP Cloud Run, and Azure Functions. Each triggers the token-provider workflow via workflow_dispatch on a 30-minute schedule using GitHub App auth through the octokit package.

What's included

Core dispatch module (src/external-scheduler/dispatch.ts) — shared logic using octokit's App class for auth, retry, and throttling; validates repo format and resolves the default branch via the API
Platform entrypoints — thin adapters for each cloud platform's handler signature
Platform secret stores — each platform stores the GitHub App private key in its native secret manager (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Cloudflare Workers Secrets)
Build pipeline — esbuild bundles committed as generated files, verified by make precommit
Platform configs — wrangler.toml, SAM template with SAR metadata, ARM template with Key Vault, Dockerfile for Cloud Run, host.json, Azure Functions v4 registration
Documentation — per-platform READMEs with deploy instructions and click-to-deploy buttons
ADR 0031 — captures the decision to use octokit App rather than manual JWT/retry

Motivation

GitHub Actions cron schedules are unreliable — runs can be delayed or skipped. Users need an external scheduler to guarantee at least one successful workflow dispatch per hour.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use octokit's App client to discover the installation for a repository and dispatch the configured workflow. Add unit tests that mock the octokit module and cover the expected request flow, 404 handling, and error propagation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add thin Cloudflare, AWS, GCP, and Azure wrappers around\nexternal dispatch(). Each entrypoint reads platform config\nfrom bindings or environment variables and forwards it to\nthe shared dispatcher.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add a build script and Makefile integration for the external\nscheduler example bundles. Also ignore those generated dist\ndirectories in ESLint so precommit can verify generated files\nwithout linting bundle output.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

codecov · 2026-05-18T23:03:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (ca32864) to head (30e2b17).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #89   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           44        49    +5     
  Lines         1210      1265   +55     
  Branches       283       293   +10     
=========================================
+ Hits          1210      1265   +55

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds external scheduler examples that dispatch the token-provider workflow from serverless schedulers across major cloud platforms, with shared Octokit-based GitHub App authentication and generated deployment bundles.

Changes:

Introduces shared workflow dispatch logic plus AWS, Azure, GCP, and Cloudflare scheduler entrypoints with unit tests.
Adds build and generated-file verification wiring for external scheduler bundles.
Adds platform deployment docs/configuration and an ADR for using Octokit App authentication.

Reviewed changes

Copilot reviewed 26 out of 35 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`tsconfig.json`	Excludes generated/example deployment artifacts from project typechecking.
`src/external-scheduler/dispatch.ts`	Adds shared GitHub App workflow dispatch implementation.
`src/external-scheduler/dispatch.spec.ts`	Tests dispatch authentication, installation lookup, and workflow dispatch behavior.
`src/external-scheduler/aws/index.ts`	Adds AWS Lambda scheduler handler.
`src/external-scheduler/aws/index.spec.ts`	Tests AWS handler environment parsing and dispatch calls.
`src/external-scheduler/azure/index.ts`	Adds Azure timer trigger handler.
`src/external-scheduler/azure/index.spec.ts`	Tests Azure handler environment parsing and dispatch calls.
`src/external-scheduler/gcp/index.ts`	Adds GCP Cloud Function handler.
`src/external-scheduler/gcp/index.spec.ts`	Tests GCP handler environment parsing and dispatch calls.
`src/external-scheduler/cloudflare/index.ts`	Adds Cloudflare scheduled Worker handler.
`src/external-scheduler/cloudflare/index.spec.ts`	Tests Cloudflare env binding dispatch behavior.
`script/build-external-schedulers.ts`	Adds esbuild bundling for all scheduler examples.
`Makefile`	Registers scheduler bundles as generated files.
`eslint.config.js`	Ignores generated scheduler bundle directories.
`.prettierignore`	Ignores generated example bundle directories.
`examples/external-scheduler/README.md`	Adds top-level external scheduler guide.
`examples/external-scheduler/aws-lambda/README.md`	Adds AWS Lambda deployment guide.
`examples/external-scheduler/aws-lambda/template.yaml`	Adds SAM/EventBridge scheduler configuration.
`examples/external-scheduler/azure-function/README.md`	Adds Azure Functions deployment guide.
`examples/external-scheduler/azure-function/function.json`	Adds Azure timer trigger binding.
`examples/external-scheduler/azure-function/host.json`	Adds Azure Functions host configuration.
`examples/external-scheduler/gcp-cloud-function/README.md`	Adds GCP Cloud Function and Cloud Scheduler guide.
`examples/external-scheduler/gcp-cloud-function/package.json`	Adds package metadata for GCP deployment.
`examples/external-scheduler/cloudflare-worker/README.md`	Adds Cloudflare Worker deployment guide.
`examples/external-scheduler/cloudflare-worker/package.json`	Adds package metadata for Cloudflare example.
`examples/external-scheduler/cloudflare-worker/wrangler.toml`	Adds Worker cron trigger and environment config.
`docs/adrs/0031-use-octokit-app-for-external-scheduler-dispatch.md`	Documents the Octokit App authentication decision.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The dispatch function now validates that the repo string is exactly owner/repo format before making API calls, and resolves the target repository's default branch instead of hard-coding 'main'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Refactor HTTP handler to avoid async callback in createServer. Update GCP Cloud Function reference to Cloud Run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AWS: fetch from Secrets Manager at runtime. Template creates the secret resource with IAM policy; user populates post-deploy. Azure: ARM template creates Key Vault with RBAC, assigns the Function App's managed identity the Secrets User role, and uses a Key Vault reference in app settings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 31 out of 41 changed files in this pull request and generated 5 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

- Fix Makefile rule target (gcp-cloud-function → gcp-cloud-run) - Restrict GCP endpoint to POST requests (405 otherwise) - Use vi.hoisted() for mockListen in GCP spec - Add test for non-Error rejection and method check - Delete ephemeral docs/superpowers/ plan and spec files Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 29 out of 39 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

Replace function.json timer binding with app.timer() registration from @azure/functions v4. Delete function.json (no longer needed), add package.json with main entry, mark @azure/functions as external in the esbuild config since the runtime provides it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 29 out of 39 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

Add @azure/functions dependency to Azure package.json so the external import resolves at runtime. Update README to reference code-based timer registration instead of deleted function.json. Add CodeUri to AWS SAM template so sam deploy packages the bundle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 29 out of 39 changed files in this pull request and generated no new comments.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

ezzatron and others added 10 commits May 18, 2026 23:10

Add external scheduler design spec

335738b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add external scheduler implementation plan

d29f047

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add platform config files for schedulers

bf83308

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Exclude examples from type-checking

c1e8625

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add external scheduler documentation

152c45c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add ADR 0031, remove plan and spec files

3adaf33

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Exclude generated bundles from Prettier

4b59499

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add tests for platform entrypoints

eed82b0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ezzatron requested a review from Copilot May 18, 2026 23:30

Copilot started reviewing on behalf of ezzatron May 18, 2026 23:30 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

ezzatron and others added 9 commits May 19, 2026 17:05

Remove describe blocks from scheduler tests

7344fcb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add ARM template and fix Azure deploy button

58e9789

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rewrite GCP entrypoint as HTTP server for Cloud Run

e7b3837

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add SAR metadata and fix AWS deploy button

ba6b520

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rename GCP example to gcp-cloud-run with Dockerfile

f4ebe5d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add Cloud Run README with working deploy button

2463017

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix GCP lint errors and update top-level README link

3787f07

Refactor HTTP handler to avoid async callback in createServer. Update GCP Cloud Function reference to Cloud Run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

ezzatron requested a review from Copilot May 19, 2026 08:43

Copilot started reviewing on behalf of ezzatron May 19, 2026 08:44 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

ezzatron requested a review from Copilot May 19, 2026 09:02

Copilot started reviewing on behalf of ezzatron May 19, 2026 09:03 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread examples/external-scheduler/azure-function/function.json Outdated

ezzatron requested a review from Copilot May 19, 2026 09:32

Copilot started reviewing on behalf of ezzatron May 19, 2026 09:33 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread examples/external-scheduler/azure-function/README.md Outdated

Comment thread examples/external-scheduler/azure-function/package.json Outdated

Comment thread examples/external-scheduler/aws-lambda/template.yaml

ezzatron requested a review from Copilot May 19, 2026 09:51

Copilot started reviewing on behalf of ezzatron May 19, 2026 09:51 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Conversation

ezzatron commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's included

Motivation

Uh oh!

codecov Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ezzatron commented May 18, 2026 •

edited

Loading

codecov Bot commented May 18, 2026 •

edited

Loading