render-deploy

Files (1)

• SKILL.md

SKILL.md (first lines)

# Render Deploy

Ship Render workloads with Blueprint-driven infra-as-code, gated migrations, zero-downtime rollouts, and verified health.

## Stack Baseline (2026)

| Concern | Choice | Notes |
|---|---|---|
| IaC | `render.yaml` Blueprint v1 | Source of truth for services, env groups, databases, jobs |
| API | `https://api.render.com/v1` | Bearer token = `RENDER_API_KEY` |
| CLI | `render` CLI ≥1.x | `render deploys create`, `render psql`, `render logs --tail` |
| Service types | Web, Private, Worker, Cron, Static Site | Plus PostgreSQL & Key-Value managed datastores |
| Deploy strategy | Rolling (default for paid plans), health-checked | Failed health check aborts deploy |
| Preview environments | Auto from PRs when `previews: generation: automatic` in Blueprint | Ephemeral databases included |
| Env groups | Linked to multiple services; updated atomically | Use for shared secrets |
| Secrets | `sync: false` env vars set via dashboard/API only | Never commit values |
| Health check | `healthCheckPath` required for zero-downtime | E.g. `/healthz` returning 200 within 5 min |
| Migrations | Run as part of `buildCommand` or a one-off Job | Gate behind feature flags |
| Regions | Oregon, Ohio, Virginia, Frankfurt, Singapore (varies by plan) | Co-locate service + DB |

## When to Use

- Deploying new or updated Render services.
- Applying `render.yaml` changes (Blueprint sync).
- Spinning preview environments for PRs.
- Rolling forward / back a single service via API or CLI.
- Coordinating app deploy with database migration.

## Prerequisites

- `RENDER_API_KEY` exported in CI (workspace-scoped least-privilege token).
- `render.yaml` checked in at repo root and validated.
- Service IDs (`srv-...`), database IDs (`dpg-...`), and env-group IDs (`evg-...`) recorded.
- Health endpoint implemented and returning 200 within startup window.
- Migration tool (Alembic, Prisma, Flyway, etc.) usable in build or job context.

## Instructions

1. **Validate Blueprint locally** (schema lint via the API dry-run):
   ```bash
   curl -fsS -X POST https://api.render.com/v1/blueprints/validate \
     -H "Authorization: Bearer $RENDER_API_KEY" \
     -H "Content-Type: application/yaml" \
     --data-binary @render.yaml
   ```
2. **Author a minimal Blueprint** with health check and env group:
   ```yaml
   # render.yaml
   previews:
     generation: automatic
     expireAfterDays: 7

   envVarGroups:
     - name: api-shared
       envVars:
         - key: LOG_LEVEL
           value: info
         - key: STRIPE_SECRET
           sync: false   # set via dashboard

   services:
     - type: web
       name: api
       runtime: node
       plan: standard
       region: oregon
       branch: main
       buildCommand: npm ci && npm run build && npm run migrate:deploy
       startCommand: node dist/server.js
       healthCheckPath: /healthz
       autoDeploy: true
       envVars:
         - fromGroup: api-shared
         - key: DATABASE_URL
           fromDatabase:
             name: api-db
             property: connectionString

     - type: worker
       name: api-worker
       runtime: node
       plan: starter
       buildCommand: npm ci && npm run build
       startCommand: node dist/worker.js
       envVars:
         - fromGroup: api-shared

   databases:
     - name: api-db
       plan: standard
       region: oregon
       postgresMajorVersion: "16"
   ```
3. **Set non-synced secrets via API** (idempotent):
   ```bash
   curl -fsS -X PUT https://api.render.com/v1/env-groups/$EVG_ID/env-vars \
     -H "Authorization: Bearer $RENDER_API_KEY" \
     -H "Content-Type: application/json" \
     -d '[{"key":"STRIPE_SECRET","value":"'"$STRIPE_SECRET"'"}]'
   ```
4. **Pre-deploy checks** in CI: lint, test, build, dry-run migration:
   ```bash
   npm ci && npm run lint && npm test && npm run build
   npm run migrate:status   # confirm pending migrations are expected
   ```
5. **Trigger deploy via API** (do not rely on auto-deploy in CI; explicit is auditable):
   ```bash
   DEPLOY=$(curl -fsS -X POST \
     https://api.render.com/v1/services/$SRV_ID/deploys \
     -H "Authorization: Bearer $RENDER_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"clearCache":"do_not_clear","commitId":"'"$GIT_SHA"'"}')
   DEPLOY_ID=$(echo "$DEPLOY" | jq -r .id)
   ```
6. **Poll deploy status** until `live` (or fail fast on `build_failed` / `update_failed` / `deactivated`):
   ```bash
   while :; do
     STATUS=$(curl -fsS -H "Authorization: Bearer $RENDER_API_KEY" \
       https://api.render.com/v1/services/$SRV_ID/deploys/$DEPLOY_ID | jq -r .status)

From SwapnilPopat/ai-assistant-skills, MIT.

More from SwapnilPopat/ai-assistant-skills