MicroBank 6: build artifacts and deploy locally

Separate CI checks from local synthetic runs

Add .github/workflows/microbank-study.yml in your application branch. It runs the probe's unit tests, checks Accounts Python syntax, and builds all three real service images. It does not run the live synthetic transaction probe, require cloud credentials, or deploy automatically.

The workflow is manual so adding this learning file does not start repeated image builds on every push. Review your GitHub Actions usage allowance before running it. Official action revisions below were resolved on 30 September 2026; review updates rather than replacing pins silently.

name: MicroBank foundations images
on:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
        with:
          python-version: '3.11'
      - name: Test the probe and compile Accounts source
        run: |
          python -m unittest discover -s tests/study -v
          python -m compileall -q services/accounts/app
      - name: Build application images sequentially
        env:
          REVISION: ${{ github.sha }}
        run: |
          docker build -t microbank-study/accounts:$REVISION services/accounts
          docker build -f infra/study/Dockerfile.ledger -t microbank-study/ledger:$REVISION .
          docker build -f infra/study/Dockerfile.frontend \
            --build-arg VITE_AUTH0_DOMAIN=build-only.invalid \
            --build-arg VITE_AUTH0_CLIENT_ID=build-only \
            -t microbank-study/frontend:$REVISION .
          mkdir -p artifacts
          docker image inspect --format '{{.Id}}' \
            microbank-study/accounts:$REVISION microbank-study/ledger:$REVISION \
            microbank-study/frontend:$REVISION > artifacts/image-ids.txt
          printf '%s\n' "$REVISION" > artifacts/revision.txt
          docker image save microbank-study/accounts:$REVISION microbank-study/ledger:$REVISION \
            microbank-study/frontend:$REVISION | gzip > artifacts/images.tar.gz
          cd artifacts
          sha256sum images.tar.gz > SHA256SUMS
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: microbank-study-images
          path: artifacts/
          retention-days: 1
          if-no-files-found: error

The frontend build-only values prove compilation; they do not enable login. For a usable frontend artifact, replace those build arguments with the application's public Auth0 domain/client ID from repository variables and record the intended callback origin. Never provide a client secret. The source has no frontend test script or Ledger test suite; add real tests separately and report this gap alongside the probe tests.

Follow the artifact handoff

Read the workflow as a chain: select source, run the probe's fake-transport tests, check Python syntax, build images, record their IDs and source revision, save an archive, calculate checksums, and upload the chosen files. The resulting artifact is an input to a later deployment decision, not evidence that a local bank transaction has happened.

The revision file identifies source; image IDs identify built content; checksums detect changes to the transferred archive. Each is useful for a different question. The publishing workflow must still come from a trusted reviewed run, because a checksum supplied with an arbitrary archive cannot establish its author.

Before loading, compare the artifact's platform with the Mac runtime. If you instead build native images locally, record that as a different build. The explicit --no-build deployment step is useful because it prevents silently replacing the selected CI image with a local rebuild.

Make the manual workflow available in your own repository

The initial learning branch alone does not make a workflow_dispatch workflow available. Use a repository you own, review the workflow through its normal pull-request process, and merge the workflow file into that repository's default branch. Inspect the resulting permissions, action pins, and file paths before running it. This is a learner action to perform deliberately; a prepared local file is not a hosted run.

After the workflow is available on the default branch, open its Actions page, choose Run workflow, and select the intended practice branch. That selected ref must contain the compatible workflow and application files. Verify the run's selected ref and the checked-out commit; compare them with revision.txt in its artifact before deployment. A green run for another branch does not establish that your intended changes were built.

See manually running a workflow↗ for the default-branch requirement and ref selection. Do not add the workflow to an upstream repository you do not control just to enable the button.

Use an artifact on a compatible machine

The shown hosted runner builds Linux amd64 images. A Mac using Apple Silicon may run them through emulation, but that is a distinct performance/compatibility check. The simpler local path builds native images with step 4 and records those different image IDs. Do not call a native rebuild promotion of the CI artifact. A later multi-architecture pipeline can publish an OCI manifest.

After reviewing a successful workflow run for your chosen commit, download its microbank-study-images artifact from GitHub. Extract it into a new local artifacts/<run-id>/ directory. In that directory on the Mac, verify shasum -a 256 -c SHA256SUMS before docker image load -i images.tar.gz. Inspect the loaded image IDs and compare with image-ids.txt. The checksum checks integrity, not trust in an arbitrary downloaded artifact; use the reviewed run in your own repository.

From the MicroBank root, replace YOUR_RUN_ID below with the actual artifact directory you just verified. Export the selected revision so the Compose child process receives it; an unexported shell assignment can leave .study.env's older value in use. Keep the source checkout and Ansible configuration compatible with this revision.

export STUDY_TAG="$(cat artifacts/YOUR_RUN_ID/revision.txt)"
printf 'Selected revision: %s\n' "$STUDY_TAG"
./scripts/study/compose.sh config --images
docker image inspect --format '{{.Id}}' \
  "microbank-study/accounts:$STUDY_TAG" "microbank-study/ledger:$STUDY_TAG"

Before continuing, confirm the selected revision matches the reviewed run, the resolved Accounts and Ledger image references end in that exact SHA, and their IDs match the loaded artifact's first two entries in image-ids.txt. Stop if the output still shows :dev, another revision, or a missing image. config --images shows image selection without printing the full secret-bearing runtime configuration.

Only after that comparison:

./scripts/study/compose.sh up -d --no-build --wait accounts ledger
python3 scripts/study/probe.py --create --case-file evidence/candidate-case.json

The explicit --no-build prevents this step from quietly creating different images. Only the backend images are needed for the required transaction milestone. Record deployment time, selected run/source SHA, image IDs, and the local probe result in a release note. Run the optional UI only with its real build configuration.

Rehearse application rollback

Keep a known-good artifact directory, image IDs, and case record before deploying a candidate. A rollback exercise needs two actual artifacts; do not invent a previous release. For a prior CI artifact, replace PREVIOUS_RUN_ID with its verified local directory and export its revision explicitly:

export STUDY_TAG="$(cat artifacts/PREVIOUS_RUN_ID/revision.txt)"
printf 'Recovery revision: %s\n' "$STUDY_TAG"
./scripts/study/compose.sh config --images
docker image inspect --format '{{.Id}}' \
  "microbank-study/accounts:$STUDY_TAG" "microbank-study/ledger:$STUDY_TAG"

Confirm those references and IDs match the known-good record, loading that verified archive first if its images are no longer present. Then run the same up -d --no-build --wait accounts ledger command and use --verify with that release's saved case; do not use --create as a substitute for checking the previous transaction. For native local builds, select the exact previously recorded tag and image IDs with an exported STUDY_TAG instead of inventing a CI artifact directory. The exported value applies to this shell and its children; reselect and inspect it after opening a new shell. Image rollback does not roll back database schema or data. For these first exercises, use a change that does not alter the database schema and keep the named volumes.

This completes source → checks → artifact → deliberate local deployment → verification. AWS account provisioning, public ingress, production credentials, Kubernetes promotion, Argo CD, policy enforcement, and progressive delivery remain later stages.

Checkpoint and sources

Show the real workflow result, artifact identity, local deployment record, and recovery evidence. Sources: GitHub Actions workflow model↗, secure action use↗, artifact upload action↗, Docker image save↗, Docker image load↗.