ENH: set up workflows to deploy the backend

[YektaY]

Description

Pass deployment secrets (database_url, redis_url, ghcr_token, ghcr_user) via client-payload to build-system-playbooks
Add manual "Deploy to Production" workflow (deploy-prod.yml) that triggers deploy-container-prod in build-system-playbooks

Prod deploy flow
Create a release → build-release.yml builds and pushes image
Go to Actions → "Deploy to Production" → enter release tag → Run
Triggers deploy-container-prod in build-system-playbooks → webhook → Deployment Controller → Ansible

Motivation

Set up CI/CD pipeline for the project

Where Has This Been Documented?

Screenshots

Pre-merge checklist

• Code works interactively
• Code contains descriptive docstrings
• New/changed functions and methods are covered in the test suite where possible
• Test suite passes locally
• Test suite passes on GitHub Actions

[zdomke]

Approved

This set of workflows looks good to me. I talked through the workflows with Yekta and they seemed good.

... But one concern

The deployment workflows seem like they may work for downgrading sometimes depending on any alembic migrations. If alembic does intend to revert to a previous version, then alembic upgrade head will throw an error. If the alembic version stays the same in a downgrade, then nothing happens.

Possible Solutions

All alembic downgrades will need to be run manually before starting the workflows using alembic downgrade <revision>.

[zdomke]

Possible Solutions

All alembic downgrades will need to be run manually before starting the workflows using alembic downgrade <revision>.

I looked briefly into taking the intended downgrade revision ID as a workflow dispatch input and running the downgrade command using the given ID. My issue was that I'm not sure how to confirm the command would be run prior to deployment rather than after.

  workflow_dispatch:
    inputs:
      is_downgrade:
        description: 'Is this a downgrade to a previous release?'
        required: false
        type: boolean
        default: false
      downgrade_revision:
        description: 'Alembic revision ID to downgrade to (only used if downgrading, e.g., 61476c608fc3)'
        required: false
        type: string
        default: 'head'

[YektaY]

I will make a new ticket to support the rollback with alembic downgrade