feat(signals): consolidate impact goals into follow-up checks #93983
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # Build and push MCP server container image. | |
| # | |
| # This is the MCP server that runs on k8s (EU + US clusters) | |
| # using Redis for session state instead of Cloudflare Durable Objects. | |
| # | |
| name: MCP Container Image CD | |
| on: | |
| push: | |
| branches: | |
| - master | |
| paths: | |
| - 'services/mcp/**' | |
| - '.github/workflows/cd-mcp-image.yml' | |
| # Bundled into the MCP image at build time (copy-instructions.ts `shared/` copy + | |
| # shared parser sources) — without these paths an edit there never rebuilds the | |
| # image and the bundle goes stale. | |
| - 'products/ai_observability/backend/prompts/parser_recipe_examples.yaml' | |
| - 'packages/llm-normalizer/**' | |
| # paths mirror the push trigger; the build-mcp-image label only forces a | |
| # build on PRs touching these paths, use workflow_dispatch otherwise. | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| paths: | |
| - 'services/mcp/**' | |
| - '.github/workflows/cd-mcp-image.yml' | |
| - 'products/ai_observability/backend/prompts/parser_recipe_examples.yaml' | |
| - 'packages/llm-normalizer/**' | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| name: Build and push container image | |
| if: | | |
| github.repository_owner == 'PostHog' && ( | |
| github.event_name == 'push' || | |
| github.event_name == 'workflow_dispatch' || | |
| contains(github.event.pull_request.labels.*.name, 'build-mcp-image') | |
| ) | |
| runs-on: depot-ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| outputs: | |
| sha: ${{ steps.push.outputs.digest }} | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 2 | |
| - name: Docker meta and registry login | |
| id: docker-meta | |
| uses: ./.github/actions/docker-meta | |
| with: | |
| image-name: posthog-mcp | |
| # Publishes only from the default branch — assume the role and touch ECR only there; | |
| # labeled PRs still build (push=false) without assuming it. | |
| aws-role-to-assume: ${{ vars.AWS_ECR_POSTHOG_MASTER_PUBLISH_IAM_ROLE }} | |
| push-to-ecr: ${{ github.ref == 'refs/heads/master' }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| dockerhub-username: ${{ secrets.DOCKERHUB_USER }} | |
| dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| push-to-dockerhub: 'false' | |
| # Prod deploys from private ECR; pause the public ghcr push during an embargo. | |
| push-to-ghcr: ${{ vars.PUBLIC_IMAGE_PUSH_PAUSED != 'true' }} | |
| - name: Set up Depot CLI | |
| uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1 | |
| - name: Build and push container image | |
| id: push | |
| uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0 | |
| with: | |
| project: c1f2m5s6zd | |
| file: ./services/mcp/Dockerfile | |
| buildx-fallback: false | |
| push: ${{ github.ref == 'refs/heads/master' && vars.CD_DEPLOY_ENABLED == 'true' }} | |
| tags: ${{ steps.docker-meta.outputs.tags }} | |
| labels: ${{ steps.docker-meta.outputs.labels }} | |
| annotations: ${{ steps.docker-meta.outputs.annotations }} | |
| platforms: linux/arm64,linux/amd64 | |
| build-args: COMMIT_HASH=${{ github.sha }} | |
| deploy: | |
| name: Trigger MCP deployment | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| needs: build | |
| if: github.repository_owner == 'PostHog' && vars.CD_DEPLOY_ENABLED == 'true' && github.ref == 'refs/heads/master' | |
| permissions: {} | |
| steps: | |
| - name: Get deployer token | |
| id: deployer | |
| uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 | |
| with: | |
| client-id: ${{ secrets.GH_APP_CHARTS_DEPLOYER_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY }} | |
| owner: PostHog | |
| repositories: charts | |
| - name: Get PR labels | |
| id: labels | |
| uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | |
| with: | |
| script: | | |
| const { data: pulls } = await github.rest.repos.listPullRequestsAssociatedWithCommit({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| commit_sha: context.sha, | |
| }); | |
| const labels = pulls.flatMap(pr => pr.labels.map(l => l.name)); | |
| return JSON.stringify([...new Set(labels)]); | |
| - name: Trigger MCP deployment | |
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 | |
| with: | |
| token: ${{ steps.deployer.outputs.token }} | |
| repository: PostHog/charts | |
| event-type: commit_state_update | |
| client-payload: | | |
| { | |
| "values": { | |
| "image": { | |
| "sha": "${{ needs.build.outputs.sha }}" | |
| } | |
| }, | |
| "release": "mcp", | |
| "commit": ${{ toJson(github.event.head_commit) }}, | |
| "repository": ${{ toJson(github.repository) }}, | |
| "labels": ${{ steps.labels.outputs.result }}, | |
| "timestamp": "${{ github.event.head_commit.timestamp }}" | |
| } |