Skip to content
Visory LLC

CI/CD & Deploy Pipelines

There are two independent deploy pipelines. The dashboard deploys from main, and orchestration deploys from orchestration-production. There is no shared “deploy everything” pipeline — the dashboard and orchestration ship separately.

Dashboard deploy

Section titled “Dashboard deploy”

Workflow: .github/workflows/visory-dev-scus-ca-portal-AutoDeployTrigger-*.yml Trigger: push to main, scoped to paths apps/mx_fuels_reporting_app/*, packages/*, or the workflow file itself. Also supports workflow_dispatch for manual runs.

Steps:

  1. Checkout
  2. azure/login@v3 using OIDC (id-token: write permission) with VISORYDEVSCUSCAPORTAL_AZURE_* secrets
  3. Builds the production Docker target and pushes it to visorydevscusappsacr-*.azurecr.io
  4. Updates the visory-dev-scus-ca-portal Container App in resource group visory-dev-scus-web-apps-rg, tagged with ${{ github.sha }}
  5. Sets the attached UAMI client ID, AZURE_USERNAME, WEB_KEY_VAULT_URL, and CNE_CREDENTIALS_KEY_VAULT_URL as runtime environment variables

Orchestration deploy

Section titled “Orchestration deploy”

Workflow: .github/workflows/orchestration-deploy.yaml Trigger: push to orchestration-production

Steps:

  1. Checkout, install uv (astral-sh/setup-uv@v7, Python 3.12.12)
  2. make bin in orchestration/ — rebuilds the wheels used by the Airflow image
  3. Docker Buildx build of orchestration/Dockerfile, tagged visory/orchestration:${{ github.sha }}
  4. astronomer/deploy-action@v0.11.0 deploys the image + DAGs to the Astro deployment identified by ORCHESTRATION_ASTRO_DEPLOYMENT_ID, authenticated via ORCHESTRATION_ASTRO_API_TOKEN

Branch → environment mapping

Section titled “Branch → environment mapping”

Each deployable unit normally follows a development/<name> → production/<name> pairing. The current dashboard workflow is an exception: it deploys from main.

Deploy target Dev branch Prod branch (triggers deploy)
Dashboard (mx_fuels_reporting_app) development/mx-fuels-reporting-app main
Orchestration orchestration-development orchestration-production

There is also clear-notebook-outputs.yaml, a repo hygiene workflow (strips notebook outputs before commit), unrelated to deployment.