Two additions to the app detail page, each backed by a per-workload
endpoint.
Deploy history + rollback:
- New deploy_history table — a structured, version-pinned ledger of every
dispatch (success AND failure), distinct from the free-text event_log.
Recorded at the single DispatchPlugin choke point so every source kind
is covered. The raw deploy error is never persisted (it can carry
registry-auth / compose-stdout secrets) — only a generic marker, with
detail going to slog. Pruned to the newest N per workload; cascade-
deleted with the workload.
- GET /api/workloads/{id}/deploys lists the ledger; POST .../rollback
(admin) replays a prior successful deploy's pinned reference as a
rollback-reason dispatch. Phase 1 is image-source only (RollbackCapable);
git-built sources need checkout-by-commit, a later phase.
- DeployHistoryPanel.svelte renders the ledger with confirm-gated rollback.
Per-workload metrics:
- ListContainerStatsSamplesByWorkload joins the existing container stats
samples through the containers index; GET /api/workloads/{id}/stats/history
aggregates CPU/memory per timestamp across the workload's containers.
- WorkloadMetricsPanel.svelte reuses ResourceChart (CPU% + memory MiB,
windowed, 15s poll).
en/ru i18n added with parity. Tests: store CRUD + cascade + workload-scoped
join, deployer recording (incl. secret-non-leak on failure), API rollback
guards, and per-timestamp aggregation. Plans under docs/plans/.
auto_backup_before_deploy silently did nothing — MaybeBackupBeforeDeploy's
only caller was the legacy executeDeploy pipeline, removed in the
workload-first cutover. Reconnect it as maybeBackupBeforeDeploy(), invoked
from DispatchPlugin after the source resolves and before it runs, so the
setting fires for every source kind. Fail-open: a nil backuper, a
settings-load error, or a backup failure skips the snapshot without
blocking the deploy. Adds predeploy_backup_test.go asserting the wiring.
Closes the workload-first refactor by landing the Priority 3 polish
items and the Priority 4 test gap. Net: ~2,400 lines added,
~350 lines modified across 13 files.
Priority 3 — polish
- apps.* i18n namespace: 276 new keys across apps.list.* (27),
apps.new.* (91, sibling of existing apps.new.triggers.*), and
apps.detail.* (158, sibling of existing apps.detail.bindings.*).
EN+RU at 1314 keys each, perfectly in sync. /apps, /apps/new,
/apps/[id] now render entirely from i18n.
- New codemap docs/CODEMAPS/workload-plugin.md (238 lines):
Source × Trigger contract, dispatch seam, webhook fan-out path,
recipes for adding a new Source or Trigger kind. Plus
docs/CODEMAPS/INDEX.md gateway.
Priority 4 — tests
- internal/api/workloads_test.go (new, ~30 subtests): /api/workloads
CRUD + deploy + delete + env + volumes + chain + promote-from +
triggers list/inline-bind + auth gating + standalone /api/triggers
CRUD (create / dup-409 / kind filter / delete). Uses real
POST handlers via httptest.NewServer + a fake plugin source
registered under "testfakesource".
- internal/deployer/dispatch_test.go (new, 11 tests):
DispatchPlugin / DispatchTeardown / DispatchReconcile happy +
unknown-kind + propagated-error each; PluginDeps wiring; a real
2s-bounded RWMutex deadlock probe on PluginDeps vs SetDNSProvider.
- internal/workload/plugin/source/compose/compose_test.go (new,
~26 subtests): composeProjectName sanitization,
writeYAML / writeYAMLIfChanged hash short-circuit, Validate happy
+ bad inputs, Kind / SchemaSample.
Coverage delta on the workload-plugin path:
- internal/api: 1.1% → 16.0%
- internal/deployer: 0% → 54.1%
- internal/workload/plugin/source/compose: 0% → 38.5%
- Trigger plugins already at 87-95% from the trigger-split work.
Production fix surfaced by the tests
- store.CreateWorkload now self-references RefID = ID when caller
leaves RefID empty (the typical plugin-native path). The api
layer's broken backfill loop (called UpdateWorkload, which
deliberately omits ref_id) is gone. Multiple sibling plugin
workloads can now coexist under the UNIQUE(kind, ref_id) constraint.
Review fixes addressed before commit
- CRITICAL: deadlock-detect test gained a real 2s time.After (was
selecting on context.Background().Done() which never fires).
- HIGH: happy-path test now hard-asserts RefID = ID (was a t.Logf
that would silently pass after a production fix).
- HIGH: standalone /api/triggers CRUD coverage added (was bypassed
by the workload-side bind flow).
- HIGH: seedWorkload bypass deleted; tests now go through the
real POST /api/workloads handler.
- MEDIUM: withTempDir restore is a no-op (t.Setenv auto-restores);
dead `old := os.Getenv(...)` capture removed.
- MEDIUM: list-workloads test now asserts ID membership, not just
count.
Doc
- WORKLOAD_REFACTOR_TODO: all three Priority 1 items, Priority 3
polish, and Priority 4 tests marked DONE. The workload-first arc
is closed.
alexei.dolgolyov