fix(ci): promote versioned Daytona snapshots to Render (#1073)

Co-authored-by: Omar McAdam <omar@OpenWork-Studio.localdomain>

.github/workflows/deploy-den.yml

@@ -0,0 +1,99 @@
+name: Deploy Den
+
+on:
+  workflow_call:
+    inputs:
+      daytona_snapshot:
+        description: "Daytona snapshot name to promote into Render"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      daytona_snapshot:
+        description: "Daytona snapshot name to promote into Render"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-den-${{ inputs.daytona_snapshot }}
+  cancel-in-progress: false
+
+jobs:
+  deploy-den:
+    name: Update Render Daytona Snapshot
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    env:
+      RENDER_API_BASE: https://api.render.com/v1
+      RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
+      RENDER_SERVICE_ID: ${{ secrets.RENDER_DEN_CONTROL_PLANE_SERVICE_ID }}
+      DAYTONA_SNAPSHOT: ${{ inputs.daytona_snapshot }}
+    steps:
+      - name: Validate required configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ -z "${DAYTONA_SNAPSHOT:-}" ]; then
+            echo "daytona_snapshot input is required" >&2
+            exit 1
+          fi
+
+          if [ -z "${RENDER_API_KEY:-}" ]; then
+            echo "Missing required secret: RENDER_API_KEY" >&2
+            exit 1
+          fi
+
+          if [ -z "${RENDER_SERVICE_ID:-}" ]; then
+            echo "Missing required secret: RENDER_DEN_CONTROL_PLANE_SERVICE_ID" >&2
+            exit 1
+          fi
+
+      - name: Update DAYTONA_SNAPSHOT on Render
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          payload="$(python3 -c 'import json, sys; print(json.dumps({"value": sys.argv[1]}))' "$DAYTONA_SNAPSHOT")"
+          response_file="$(mktemp)"
+          status_code="$(curl -sS -o "$response_file" -w "%{http_code}" \
+            -X PUT "${RENDER_API_BASE}/services/${RENDER_SERVICE_ID}/env-vars/DAYTONA_SNAPSHOT" \
+            -H "Accept: application/json" \
+            -H "Authorization: Bearer ${RENDER_API_KEY}" \
+            -H "Content-Type: application/json" \
+            --data "$payload")"
+
+          if [ "$status_code" -lt 200 ] || [ "$status_code" -ge 300 ]; then
+            echo "Failed to update Render DAYTONA_SNAPSHOT (HTTP $status_code)" >&2
+            python3 -c 'from pathlib import Path; import sys; print(Path(sys.argv[1]).read_text(errors="replace"))' "$response_file"
+            exit 1
+          fi
+
+          echo "Render DAYTONA_SNAPSHOT set to ${DAYTONA_SNAPSHOT}"
+
+      - name: Trigger Render deploy
+        id: deploy
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          response_file="$(mktemp)"
+          status_code="$(curl -sS -o "$response_file" -w "%{http_code}" \
+            -X POST "${RENDER_API_BASE}/services/${RENDER_SERVICE_ID}/deploys" \
+            -H "Accept: application/json" \
+            -H "Authorization: Bearer ${RENDER_API_KEY}" \
+            -H "Content-Type: application/json" \
+            --data '{}')"
+
+          if [ "$status_code" -lt 200 ] || [ "$status_code" -ge 300 ]; then
+            echo "Failed to trigger Render deploy (HTTP $status_code)" >&2
+            python3 -c 'from pathlib import Path; import sys; print(Path(sys.argv[1]).read_text(errors="replace"))' "$response_file"
+            exit 1
+          fi
+
+          deploy_id="$(python3 -c 'import json, sys; from pathlib import Path; text = Path(sys.argv[1]).read_text(errors="replace").strip(); data = json.loads(text) if text else {}; print(data.get("id", "") if isinstance(data, dict) else "")' "$response_file")"
+
+          echo "deploy_id=${deploy_id}" >> "$GITHUB_OUTPUT"
+          echo "Triggered Render deploy ${deploy_id:-<unknown>} for snapshot ${DAYTONA_SNAPSHOT}"

.github/workflows/release-daytona-snapshot.yml

@@ -7,6 +7,11 @@ on:
         description: "Tag to build from (e.g., v0.11.200). Defaults to current ref."
         required: false
         type: string
+      deploy_den:
+        description: "Whether to promote the published snapshot into the Den Render service"
+        required: false
+        type: boolean
+        default: true
       snapshot_name:
         description: "Optional explicit Daytona snapshot name"
         required: false
@@ -21,6 +26,11 @@ on:
         description: "Tag to build from (e.g., v0.11.200). Defaults to release tag/current ref."
         required: false
         type: string
+      deploy_den:
+        description: "Whether to promote the published snapshot into the Den Render service"
+        required: false
+        type: boolean
+        default: true
       snapshot_name:
         description: "Optional explicit Daytona snapshot name"
         required: false
@@ -41,6 +51,10 @@ jobs:
   publish-daytona-snapshot:
     name: Build and Push Daytona Snapshot
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    outputs:
+      release_tag: ${{ steps.resolve.outputs.release_tag }}
+      snapshot_name: ${{ steps.resolve.outputs.snapshot_name }}
+      snapshot_region: ${{ steps.resolve.outputs.snapshot_region }}
     steps:
       - name: Resolve release tag and snapshot name
         id: resolve
@@ -49,7 +63,6 @@ jobs:
           INPUT_TAG: ${{ inputs.tag }}
           INPUT_SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
           INPUT_SNAPSHOT_REGION: ${{ inputs.snapshot_region }}
-          DEFAULT_SNAPSHOT_NAME: ${{ vars.DAYTONA_SNAPSHOT }}
           SNAPSHOT_NAME_BASE: ${{ vars.DAYTONA_SNAPSHOT_NAME_BASE }}
           DEFAULT_SNAPSHOT_REGION: ${{ vars.DAYTONA_SNAPSHOT_REGION }}
         run: |
@@ -67,11 +80,9 @@ jobs:
             exit 1
           fi
 
-          base_name="${SNAPSHOT_NAME_BASE:-openwork-runtime}"
+          base_name="${SNAPSHOT_NAME_BASE:-openwork}"
           if [ -n "${INPUT_SNAPSHOT_NAME:-}" ]; then
             snapshot_name="${INPUT_SNAPSHOT_NAME}"
-          elif [ -n "${DEFAULT_SNAPSHOT_NAME:-}" ]; then
-            snapshot_name="${DEFAULT_SNAPSHOT_NAME}"
           else
             snapshot_name="${base_name}-${tag#v}"
           fi
@@ -150,3 +161,12 @@ jobs:
 
           echo "Publishing Daytona snapshot: ${DAYTONA_SNAPSHOT_NAME}"
           ./scripts/create-daytona-openwork-snapshot.sh "${DAYTONA_SNAPSHOT_NAME}"
+
+  deploy-den:
+    name: Promote Daytona Snapshot to Den Render Service
+    needs: [publish-daytona-snapshot]
+    if: ${{ inputs.deploy_den }}
+    uses: ./.github/workflows/deploy-den.yml
+    with:
+      daytona_snapshot: ${{ needs.publish-daytona-snapshot.outputs.snapshot_name }}
+    secrets: inherit