From f93fa15e2743fccece69f0bff4404281d096432d Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:01:18 +0300 Subject: [PATCH 1/3] ci: carry the S3 checksum setting into production --- .github/workflows/bitween-api-cicd-gateway.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/bitween-api-cicd-gateway.yml b/.github/workflows/bitween-api-cicd-gateway.yml index bc8c4a83..58c42f8b 100644 --- a/.github/workflows/bitween-api-cicd-gateway.yml +++ b/.github/workflows/bitween-api-cicd-gateway.yml @@ -183,6 +183,8 @@ jobs: # the deploy would create a second public-gateway in it instead of failing. gateway-parent-namespace: 's9-prod-edge' # Every line is handed to helm --set as it stands, so no comments inside. + # AWS_*_CHECKSUM_*=when_required: production stores files in DigitalOcean Spaces too, so it + # carries develop's checksum setting (see the note there) until the fix lands in SW-CloudFiles. helm-set-values: | global.environment=Production replicaCount=2 @@ -190,6 +192,8 @@ jobs: resources.requests.memory=704Mi resources.limits.memory=1408Mi environmentVariables.Bitween__BusProvidersEnabled=true + environmentVariables.AWS_REQUEST_CHECKSUM_CALCULATION=when_required + environmentVariables.AWS_RESPONSE_CHECKSUM_VALIDATION=when_required secrets: registry-username: ${{ secrets.DOCKERHUB_USERNAME }} registry-password: ${{ secrets.DOCKERHUB_TOKEN }} From 67042db7ec886aa8476db5637b447668dd158e2d Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:24:23 +0300 Subject: [PATCH 2/3] ci: serve app.bitween.io from the prod gateway's wildcard listener --- .github/workflows/bitween-api-cicd-gateway.yml | 4 ++++ docs/deployment.md | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bitween-api-cicd-gateway.yml b/.github/workflows/bitween-api-cicd-gateway.yml index 58c42f8b..e769bbb8 100644 --- a/.github/workflows/bitween-api-cicd-gateway.yml +++ b/.github/workflows/bitween-api-cicd-gateway.yml @@ -182,6 +182,10 @@ jobs: # The production cluster's gateway. The default, s9-dev-edge, does not exist there, and # the deploy would create a second public-gateway in it instead of failing. gateway-parent-namespace: 's9-prod-edge' + # Attach to the gateway's *.bitween.io wildcard listener (certificate included) rather than + # onboarding a listener and certificate for app.bitween.io. The deploy fails before helm + # runs if the listener is missing. Develop stays per-host: the dev gateway has no wildcard. + gateway-section-name: 'https-wildcard-bitween-io' # Every line is handed to helm --set as it stands, so no comments inside. # AWS_*_CHECKSUM_*=when_required: production stores files in DigitalOcean Spaces too, so it # carries develop's checksum setting (see the note there) until the fix lands in SW-CloudFiles. diff --git a/docs/deployment.md b/docs/deployment.md index b82ea810..06a0bab0 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -123,7 +123,7 @@ Run several replicas behind a load balancer for throughput and availability, and | Pipeline | Trigger | What it does | |---|---|---| | `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`). Publishes no NuGet packages. | -| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. | +| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`, on the gateway's `*.bitween.io` wildcard listener). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. | | `.github/workflows/cli-release.yml` | Called by the CI/CD workflow, never run by hand or by a tag: after the release from `releases/r10.0`, and after each develop build | Publishes the [bitween CLI](cli.md) at the version that run computed, as self-contained single-file binaries for `linux-x64`, `linux-arm64`, `linux-musl-x64`, `linux-musl-arm64`, `osx-x64`, `osx-arm64` and `win-x64`, with a `SHA256SUMS` file. From the release it is `cli-v`, the latest release; from develop, the pre-release `cli-v-dev.`. `scripts/install-cli.sh` installs the latest release, a pre-release only when named. | | `.github/workflows/sdk-release.yml` | Called by the CI/CD workflow after the release from `releases/r10.0` | Publishes the adapter contract packages at Bitween's version: `simplyworks-bitween` to PyPI and `@simplyworks/bitween` to npm, each tested first against SW-Serverless's SDK. Uses the `PYPI_API_TOKEN` and `NPM_TOKEN` secrets; a version already published is left alone. | | `.github/workflows/dotnet-pr-checks.yml` | Pull requests to `releases/**` | Builds the solution and runs the .NET unit tests | From 09bb100e3250e06e8353d5ec52615214d57dc1b5 Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:31:39 +0300 Subject: [PATCH 3/3] ci: serve app-dev.bitween.io from the dev gateway's wildcard listener --- .github/workflows/bitween-api-cicd-gateway.yml | 13 +++++++------ docs/deployment.md | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/bitween-api-cicd-gateway.yml b/.github/workflows/bitween-api-cicd-gateway.yml index e769bbb8..605a872d 100644 --- a/.github/workflows/bitween-api-cicd-gateway.yml +++ b/.github/workflows/bitween-api-cicd-gateway.yml @@ -85,9 +85,12 @@ jobs: # here too - previously only /api and /swagger did, leaving the root on the retired # legacy Bitween-UI deployment and making every deploy look like the UI never changed. gateway-paths: '/,/api,/swagger' - # app-dev.bitween.io is not *.sf9.io, so the deploy auto-onboards a - # dedicated listener + cert-manager Certificate on the parent gateway - # (public-gateway · s9-dev-edge · cilium · letsencrypt-production-gateway). + # Attach to the dev gateway's *.bitween.io wildcard listener (public-gateway · s9-dev-edge), + # certificate included, instead of onboarding a listener and certificate for the host. The + # deploy fails before helm runs if the listener is missing. An app-dev.bitween.io listener on + # that gateway would take the host from the wildcard and answer 404, since this route no + # longer attaches to it. + gateway-section-name: 'https-wildcard-bitween-io' # Non-routing chart values (routing itself is generated by gateway-api mode). Every line is # handed to helm --set as it stands, so no comments inside. replicaCount=2: the lab's phase 6 @@ -182,9 +185,7 @@ jobs: # The production cluster's gateway. The default, s9-dev-edge, does not exist there, and # the deploy would create a second public-gateway in it instead of failing. gateway-parent-namespace: 's9-prod-edge' - # Attach to the gateway's *.bitween.io wildcard listener (certificate included) rather than - # onboarding a listener and certificate for app.bitween.io. The deploy fails before helm - # runs if the listener is missing. Develop stays per-host: the dev gateway has no wildcard. + # The production gateway's *.bitween.io wildcard listener, as on develop. gateway-section-name: 'https-wildcard-bitween-io' # Every line is handed to helm --set as it stands, so no comments inside. # AWS_*_CHECKSUM_*=when_required: production stores files in DigitalOcean Spaces too, so it diff --git a/docs/deployment.md b/docs/deployment.md index 06a0bab0..adaeef95 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -122,7 +122,7 @@ Run several replicas behind a load balancer for throughput and availability, and | Pipeline | Trigger | What it does | |---|---|---| -| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`). Publishes no NuGet packages. | +| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`, on the gateway's `*.bitween.io` wildcard listener). Publishes no NuGet packages. | | `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`, on the gateway's `*.bitween.io` wildcard listener). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. | | `.github/workflows/cli-release.yml` | Called by the CI/CD workflow, never run by hand or by a tag: after the release from `releases/r10.0`, and after each develop build | Publishes the [bitween CLI](cli.md) at the version that run computed, as self-contained single-file binaries for `linux-x64`, `linux-arm64`, `linux-musl-x64`, `linux-musl-arm64`, `osx-x64`, `osx-arm64` and `win-x64`, with a `SHA256SUMS` file. From the release it is `cli-v`, the latest release; from develop, the pre-release `cli-v-dev.`. `scripts/install-cli.sh` installs the latest release, a pre-release only when named. | | `.github/workflows/sdk-release.yml` | Called by the CI/CD workflow after the release from `releases/r10.0` | Publishes the adapter contract packages at Bitween's version: `simplyworks-bitween` to PyPI and `@simplyworks/bitween` to npm, each tested first against SW-Serverless's SDK. Uses the `PYPI_API_TOKEN` and `NPM_TOKEN` secrets; a version already published is left alone. |