chore(ci): retire the merge-time dev deploy — both hosts are Ansible-managed now #160

Merged

claude-bot merged 1 commit from chore/retire-cd-dev-deploy into main

2026-08-01 01:14:07 +00:00

claude-bot commented

2026-08-01 01:10:17 +00:00

Contributor

Closes the last loose end from the production migration (iac-repo#219).

Since 2026-08-01 both instances are deployed by weatherbot-ansible from /opt/weatherbot-svc, under the same compose project name (weatherbot) this job's checkout-rebuild used — so the next merge to main would have had CD silently revert dev to the pre-Ansible layout, and the two management planes would flip-flop on every merge vs. every play run.

Running the Ansible play from CI instead was considered and rejected for the same reason release.yml holds no deploy credentials (#154): limiting the play to -l docker-test doesn't limit the secret — decrypting the weatherbot vault requires the fleet-wide vault password, which unlocks every vault in the shared inventory.

So cd.yml becomes tests-only (renamed CI (main)), and rollouts are operator-run at release cadence, dev first — the same model as every other service in the fleet:

tag vX.Y.Z → release.yml publishes the image
bump weatherbot_image in iac-repo
ansible-playbook site.yml -l docker-test, soak, then -l docker-host

README pipeline table + release runbook updated to match. DEV_SSH_KEY / DEV_HOST are no longer read by anything and can be removed from Settings → Actions.

🤖 Generated with Claude Code

Closes the last loose end from the production migration (iac-repo#219). Since 2026-08-01 both instances are deployed by `weatherbot-ansible` from `/opt/weatherbot-svc`, under the same compose project name (`weatherbot`) this job's checkout-rebuild used — so the next merge to main would have had CD silently revert dev to the pre-Ansible layout, and the two management planes would flip-flop on every merge vs. every play run. Running the Ansible play from CI instead was considered and rejected for the same reason `release.yml` holds no deploy credentials (#154): limiting the play to `-l docker-test` doesn't limit the secret — decrypting the weatherbot vault requires the fleet-wide vault password, which unlocks every vault in the shared inventory. So `cd.yml` becomes **tests-only** (renamed *CI (main)*), and rollouts are operator-run at release cadence, dev first — the same model as every other service in the fleet: 1. tag `vX.Y.Z` → `release.yml` publishes the image 2. bump `weatherbot_image` in iac-repo 3. `ansible-playbook site.yml -l docker-test`, soak, then `-l docker-host` README pipeline table + release runbook updated to match. `DEV_SSH_KEY` / `DEV_HOST` are no longer read by anything and can be removed from Settings → Actions. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-08-01 01:10:18 +00:00

chore(ci): retire the merge-time dev deploy — both hosts are Ansible-managed now

CI / test (pull_request) Successful in 3m10s

Details

b64fc61c6b

Since the production migration (iac-repo#219, 2026-08-01), dev is
deployed by weatherbot-ansible from /opt/weatherbot-svc under the same
compose project name this job's checkout rebuild used, so every merge
would have silently reverted dev to the pre-Ansible layout. Running the
play from CI instead was rejected for the same reason release.yml holds
no deploy credentials: it would need the fleet-wide vault password in
Actions secrets (#154).

cd.yml becomes tests-only ("CI (main)"); rollouts are operator-run at
release cadence, dev first, like every other service in the fleet.
DEV_SSH_KEY / DEV_HOST are no longer read and can be removed from repo
settings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

claude-bot merged commit 1553dd048c into main

2026-08-01 01:14:07 +00:00

claude-bot deleted branch chore/retire-cd-dev-deploy

2026-08-01 01:14:07 +00:00

claude-bot referenced this pull request from a commit

2026-08-01 01:14:08 +00:00

Merge pull request 'chore(ci): retire the merge-time dev deploy — both hosts are Ansible-managed now' (#160) from chore/retire-cd-dev-deploy into main