Add a deploy_strategy field to each source's config blob — "" (default),
"recreate", or "blue-green" — validated in each source's Validate and read on
the deploy path. No new DB column, no migration: the field rides inside the
existing SourceConfig JSON and every existing workload decodes "" to its
historical behavior (image -> blue-green, others -> recreate).
The real gap this closes: dockerfile and static stopped the old container
before creating the new one on every redeploy — a downtime window image never
had. Their blue-green branch now:
- names the new "green" container with a unique suffix so it coexists with the
still-serving blue (plumbed into both the container name AND the proxy
forwardHost);
- skips the collision teardown that destroyed blue early;
- gates green — an HTTP readiness probe (deps.Health.Check) when a healthcheck
is configured, else the existing liveness window;
- swaps the route via a pure upsert (no pre-DeleteRoute) so NPM repoints in
place with no gap;
- persists green into the single runtime-state row BEFORE reaping blue, so a
crash mid-swap can never orphan green or leave the row pointing at a removed
container (state.go/teardown.go/reconcile.go stay untouched).
image honors explicit "recreate" (reap existing containers after pull, before
cutover); its default blue-green path is unchanged. compose stays
stack-managed and rejects "blue-green" at Validate so the contract is honest.
static forces recreate for storage-backed deno sites — blue-green would mount
the same RW volume into both containers at once.
Shared helper internal/workload/plugin/strategy.go (ValidateStrategy +
BuildGreenName). Backend-only (phase 1); the field is usable today via the
app's advanced-JSON editor — a friendly toggle + i18n follow in phase 2.
Tests: ValidateStrategy matrix, per-source Validate (incl. the empty-key
backward-compat lock), and effectiveStrategy defaults + the deno gate. Design
+ adversarial review: docs/plans/DEPLOY_STRATEGY_PLAN.md.
Every deploy across all four source kinds now writes a workload-scoped
event via a shared plugin.EmitDeployEvent helper (replacing the inline
emit duplicated in static/dockerfile, standardizing static's metadata
key site_id->workload_id, and adding emission to image+compose which
were silent). New indexed event_log.workload_id column, EventLogFilter
.WorkloadID, and GET /api/workloads/{id}/events (id pinned from path).
Frontend: a forge "Activity" panel on /apps/[id] reusing EventLogEntry,
live SSE prepend filtered by workload_id, load-more pagination, an
All/Errors severity filter, and a shared toEventLogEntry mapper. en/ru
i18n parity.
Security: compose's failure status emits a generic reason instead of raw
`docker compose up` output, which can echo app secrets and egresses to
operator webhooks (NotificationURL + event-trigger actions); full detail
stays only in the returned error. Rune-safe 256-rune status cap.
Reviewed: go + typescript APPROVE; security HIGH fixed.
Closes the workload-first refactor by landing the Priority 3 polish
items and the Priority 4 test gap. Net: ~2,400 lines added,
~350 lines modified across 13 files.
Priority 3 — polish
- apps.* i18n namespace: 276 new keys across apps.list.* (27),
apps.new.* (91, sibling of existing apps.new.triggers.*), and
apps.detail.* (158, sibling of existing apps.detail.bindings.*).
EN+RU at 1314 keys each, perfectly in sync. /apps, /apps/new,
/apps/[id] now render entirely from i18n.
- New codemap docs/CODEMAPS/workload-plugin.md (238 lines):
Source × Trigger contract, dispatch seam, webhook fan-out path,
recipes for adding a new Source or Trigger kind. Plus
docs/CODEMAPS/INDEX.md gateway.
Priority 4 — tests
- internal/api/workloads_test.go (new, ~30 subtests): /api/workloads
CRUD + deploy + delete + env + volumes + chain + promote-from +
triggers list/inline-bind + auth gating + standalone /api/triggers
CRUD (create / dup-409 / kind filter / delete). Uses real
POST handlers via httptest.NewServer + a fake plugin source
registered under "testfakesource".
- internal/deployer/dispatch_test.go (new, 11 tests):
DispatchPlugin / DispatchTeardown / DispatchReconcile happy +
unknown-kind + propagated-error each; PluginDeps wiring; a real
2s-bounded RWMutex deadlock probe on PluginDeps vs SetDNSProvider.
- internal/workload/plugin/source/compose/compose_test.go (new,
~26 subtests): composeProjectName sanitization,
writeYAML / writeYAMLIfChanged hash short-circuit, Validate happy
+ bad inputs, Kind / SchemaSample.
Coverage delta on the workload-plugin path:
- internal/api: 1.1% → 16.0%
- internal/deployer: 0% → 54.1%
- internal/workload/plugin/source/compose: 0% → 38.5%
- Trigger plugins already at 87-95% from the trigger-split work.
Production fix surfaced by the tests
- store.CreateWorkload now self-references RefID = ID when caller
leaves RefID empty (the typical plugin-native path). The api
layer's broken backfill loop (called UpdateWorkload, which
deliberately omits ref_id) is gone. Multiple sibling plugin
workloads can now coexist under the UNIQUE(kind, ref_id) constraint.
Review fixes addressed before commit
- CRITICAL: deadlock-detect test gained a real 2s time.After (was
selecting on context.Background().Done() which never fires).
- HIGH: happy-path test now hard-asserts RefID = ID (was a t.Logf
that would silently pass after a production fix).
- HIGH: standalone /api/triggers CRUD coverage added (was bypassed
by the workload-side bind flow).
- HIGH: seedWorkload bypass deleted; tests now go through the
real POST /api/workloads handler.
- MEDIUM: withTempDir restore is a no-op (t.Setenv auto-restores);
dead `old := os.Getenv(...)` capture removed.
- MEDIUM: list-workloads test now asserts ID membership, not just
count.
Doc
- WORKLOAD_REFACTOR_TODO: all three Priority 1 items, Priority 3
polish, and Priority 4 tests marked DONE. The workload-first arc
is closed.
alexei.dolgolyov