Simplify PR preview deployments

Amp-Thread-ID: https://ampcode.com/threads/T-01a003f3-7142-74cd-b819-95472f4a6376
Co-authored-by: Arjun Komath <arjunkomath@gmail.com>

Author: ampagent

agent/internal/build/build.go

@@ -174,19 +174,39 @@ func (b *Builder) clone(ctx context.Context, config *Config, buildDir string) er
 	if err != nil {
 		return fmt.Errorf("git remote setup failed: %s: %w", output, err)
 	}
-	cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "fetch", "--depth", "1", "--no-tags", "origin", config.GitRef)
+	depth := "50"
+	if pullRequestMergeRefPattern.MatchString(config.GitRef) {
+		depth = "1"
+	}
+	cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "fetch", "--depth", depth, "--no-tags", "origin", config.GitRef)
 	output, err = b.runCommand(cmd, config)
 	if err != nil {
 		return fmt.Errorf("git fetch exact ref failed: %s: %w", output, err)
 	}
 
-	cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "rev-parse", "FETCH_HEAD")
-	fetchedCommit, err := b.runCommand(cmd, config)
-	if err != nil {
-		return fmt.Errorf("git resolve fetched ref failed: %s: %w", fetchedCommit, err)
-	}
-	if !strings.EqualFold(strings.TrimSpace(fetchedCommit), config.CommitSha) {
-		return fmt.Errorf("fetched ref resolved to %s, expected %s", strings.TrimSpace(fetchedCommit), config.CommitSha)
+	if pullRequestMergeRefPattern.MatchString(config.GitRef) {
+		cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "rev-parse", "FETCH_HEAD")
+		fetchedCommit, err := b.runCommand(cmd, config)
+		if err != nil {
+			return fmt.Errorf("git resolve fetched ref failed: %s: %w", fetchedCommit, err)
+		}
+		if !strings.EqualFold(strings.TrimSpace(fetchedCommit), config.CommitSha) {
+			return fmt.Errorf("fetched ref resolved to %s, expected %s", strings.TrimSpace(fetchedCommit), config.CommitSha)
+		}
+	} else {
+		cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "cat-file", "-e", config.CommitSha+"^{commit}")
+		if _, err = b.runCommand(cmd, config); err != nil {
+			b.sendLog(config, "Selected commit is outside the shallow clone; fetching full branch history")
+			cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "fetch", "--unshallow", "--no-tags", "origin", config.GitRef)
+			output, err = b.runCommand(cmd, config)
+			if err != nil {
+				return fmt.Errorf("git fetch full branch history failed: %s: %w", output, err)
+			}
+			cmd = exec.CommandContext(ctx, "git", "-C", buildDir, "cat-file", "-e", config.CommitSha+"^{commit}")
+			if output, err = b.runCommand(cmd, config); err != nil {
+				return fmt.Errorf("selected commit is not available from configured branch: %s: %w", output, err)
+			}
+		}
 	}
 
 	b.sendLog(config, fmt.Sprintf("Checking out commit %s", truncateStr(config.CommitSha, 8)))

agent/internal/build/build_test.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -113,6 +114,43 @@ func TestCloneFetchesExactPullRequestMergeRef(t *testing.T) {
 	}
 }
 
+func TestCloneDeepensConfiguredBranchForSelectedCommit(t *testing.T) {
+	workDir := filepath.Join(t.TempDir(), "work")
+	remoteDir := filepath.Join(t.TempDir(), "remote.git")
+	runGit(t, "init", "--initial-branch", "main", workDir)
+	runGit(t, "-C", workDir, "config", "user.name", "Test User")
+	runGit(t, "-C", workDir, "config", "user.email", "test@example.com")
+
+	var selectedSHA string
+	for i := range 60 {
+		filePath := filepath.Join(workDir, "history.txt")
+		if err := os.WriteFile(filePath, []byte(strconv.Itoa(i)), 0600); err != nil {
+			t.Fatal(err)
+		}
+		runGit(t, "-C", workDir, "add", "history.txt")
+		runGit(t, "-C", workDir, "commit", "-m", "commit "+strconv.Itoa(i))
+		if i == 5 {
+			selectedSHA = runGit(t, "-C", workDir, "rev-parse", "HEAD")
+		}
+	}
+	runGit(t, "clone", "--bare", workDir, remoteDir)
+
+	buildDir := filepath.Join(t.TempDir(), "build")
+	config := &Config{
+		BuildID:   "build-1",
+		CloneURL:  "file://" + remoteDir,
+		CommitSha: selectedSHA,
+		Branch:    "main",
+		GitRef:    "refs/heads/main",
+	}
+	if err := NewBuilder(t.TempDir(), nil).clone(context.Background(), config, buildDir); err != nil {
+		t.Fatal(err)
+	}
+	if config.ResolvedCommitSha != selectedSHA {
+		t.Fatalf("resolved commit = %s, want %s", config.ResolvedCommitSha, selectedSHA)
+	}
+}
+
 func TestCloneRejectsMovedRef(t *testing.T) {
 	workDir := filepath.Join(t.TempDir(), "work")
 	remoteDir := filepath.Join(t.TempDir(), "remote.git")

docs/architecture.mdx

@@ -137,20 +137,23 @@ With no configured health check, `healthy` means only that the container is runn
 
 ## Pull Request Preview Isolation
 
-An enabled GitHub service represents each eligible pull request as a hidden
-stateless service copy. The copy gives the preview an independent service ID,
-revision, build, rollout, deployment set, registry path, and generated route,
-while reusing the normal runtime pipeline. This avoids allowing concurrent pull
-request revisions to compete for the base service's single rollout and routing
-state.
-
-The control plane resolves the exact synthetic merge ref, refreshes the service
-copy from current base configuration, and queues an ordinary build. A current
-revision pointer on the copy prevents superseded build and rollout callbacks
-from deploying or reporting success. GitHub reports the transient environment
-as ready only after health and routing convergence complete. Closing, merging,
-or drafting the pull request clears that pointer before runtime and registry
-cleanup.
+An enabled GitHub service represents each eligible pull request as an ordinary,
+visible stateless service in the project's `previews` environment. An existing
+environment with that name is reused; otherwise the control plane creates it.
+The environment remains after its last preview closes and may also contain
+unrelated user-created services.
+
+Each copy has an independent service ID, revision, build, rollout, deployment
+set, registry path, and generated route while reusing the normal runtime
+pipeline. It is copied from the base service only when first created, so later
+user edits to the visible preview service survive pull request updates.
+
+The control plane resolves the exact synthetic merge ref and queues an ordinary
+build. A current revision pointer on the copy prevents superseded build and
+rollout callbacks from deploying or reporting success. GitHub reports the
+transient environment as ready only after health and routing convergence
+complete. Closing, merging, or drafting the pull request clears that pointer
+before runtime and registry cleanup.
 
 ## Networking
 

docs/deployments/github.mdx

@@ -50,10 +50,12 @@ GitHub deployment statuses are updated on the commit so you can track progress f
 
 ## Pull Request Preview Deployments
 
-Preview deployments are opt in from a GitHub-backed service's **Previews** tab.
-They require a configured **Automatic Subdomain Domain** and its wildcard DNS
-record. Each eligible pull request gets one hidden, single-replica copy of the
-service and a stable generated HTTPS URL beneath that domain.
+Preview deployments are opt in from a GitHub-backed service's **Configuration**
+page. They require a configured **Automatic Subdomain Domain** and its wildcard
+DNS record. Each eligible pull request gets one visible, single-replica service
+in the project's ordinary `previews` environment and a stable generated HTTPS
+URL beneath that domain. An existing environment named `previews` is reused and
+is left in place when previews close.
 
 A pull request is eligible only when it:
 
@@ -67,12 +69,14 @@ The preview builds GitHub's synthetic merge result at
 configured branch. If GitHub cannot produce that ref because of merge
 conflicts, the preview fails rather than building the raw pull request head.
 
-Preview copies inherit the service's current source configuration, private
-ports, resource limits, placement, health check, start command, and complete
-secret set. They do not copy volumes, backups, schedules, cron jobs,
-autoscaling, serverless sleep, production custom domains, or public TCP/UDP
-routes. Additional preview-specific secret configuration is neither needed nor
-available.
+When first created, preview services inherit the base service's current source
+configuration, private ports, resource limits, placement, health check, start
+command, and complete secret set. They do not copy volumes, backups, schedules,
+cron jobs, autoscaling, serverless sleep, production custom domains, or public
+TCP/UDP routes. Additional preview-specific secret configuration is neither
+needed nor available. Preview services use the normal service pages and may be
+edited like other services, except that volumes remain unavailable. Later pull
+request updates preserve those edits.
 
 New commits replace the preview revision without changing its URL. Converting
 the pull request to a draft, closing it, or merging it removes the runtime and

web/actions/builds.ts

@@ -15,12 +15,7 @@ import {
 
 export async function cancelBuild(buildId: string) {
 	await requireDeveloperRole();
-	const [result] = await db
-		.select({ build: builds })
-		.from(builds)
-		.innerJoin(services, eq(services.id, builds.serviceId))
-		.where(and(eq(builds.id, buildId), isNull(services.previewOfServiceId)));
-	const build = result?.build;
+	const [build] = await db.select().from(builds).where(eq(builds.id, buildId));
 
 	if (!build) {
 		throw new Error("Build not found");
@@ -89,15 +84,12 @@ export async function retryBuild(buildId: string) {
 	}
 
 	const [service] = await db
-		.select({ id: services.id })
+		.select({
+			id: services.id,
+			previewOfService: services.previewOfService,
+		})
 		.from(services)
-		.where(
-			and(
-				eq(services.id, build.serviceId),
-				isNull(services.deletedAt),
-				isNull(services.previewOfServiceId),
-			),
-		);
+		.where(and(eq(services.id, build.serviceId), isNull(services.deletedAt)));
 
 	if (!service) {
 		throw new Error("Service not found");
@@ -107,16 +99,22 @@ export async function retryBuild(buildId: string) {
 		throw new Error(`Cannot retry build in ${build.status} status`);
 	}
 
+	const actor = {
+		type: "user" as const,
+		userId: session.user.id,
+		name: session.user.name,
+	};
+	if (service.previewOfService) {
+		await triggerBuildInternal(build.serviceId, "manual", actor);
+		return { success: true };
+	}
+
 	await requeueBuildRevisionInternal({
 		serviceId: build.serviceId,
 		serviceRevisionId: build.serviceRevisionId,
 		commitMessage: build.commitMessage ?? "Retry build",
 		author: build.author ?? undefined,
-		actor: {
-			type: "user",
-			userId: session.user.id,
-			name: session.user.name,
-		},
+		actor,
 	});
 
 	return { success: true };
@@ -127,18 +125,6 @@ export async function triggerBuild(
 	trigger: "manual" | "scheduled" = "manual",
 ) {
 	const session = await requireDeveloperRole();
-	const service = await db
-		.select({ id: services.id })
-		.from(services)
-		.where(
-			and(
-				eq(services.id, serviceId),
-				isNull(services.deletedAt),
-				isNull(services.previewOfServiceId),
-			),
-		)
-		.then((rows) => rows[0]);
-	if (!service) throw new Error("Service not found");
 	const actor = session
 		? {
 				type: "user" as const,
@@ -162,17 +148,16 @@ export async function triggerManualBuild(serviceId: string, commitSha: string) {
 		.select({ service: services, githubRepo: githubRepos })
 		.from(services)
 		.innerJoin(githubRepos, eq(githubRepos.serviceId, services.id))
-		.where(
-			and(
-				eq(services.id, serviceId),
-				isNull(services.deletedAt),
-				isNull(services.previewOfServiceId),
-			),
-		);
+		.where(and(eq(services.id, serviceId), isNull(services.deletedAt)));
 	if (!result) throw new Error("Active GitHub App-connected service not found");
 	if (result.service.sourceType !== "github") {
 		throw new Error("Service is not connected to GitHub");
 	}
+	if (result.service.previewOfService) {
+		throw new Error(
+			"Preview services build their pull request merge ref; use Build to rebuild it",
+		);
+	}
 
 	const branch =
 		result.githubRepo.deployBranch || result.githubRepo.defaultBranch || "main";

web/actions/compose.ts

@@ -1,6 +1,6 @@
 "use server";
 
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { db } from "@/db";
 import { services } from "@/db/schema";
 import { requireDeveloperRole } from "@/lib/auth";
@@ -69,7 +69,6 @@ export async function importCompose(
 			and(
 				eq(services.projectId, projectId),
 				eq(services.environmentId, environmentId),
-				isNull(services.previewOfServiceId),
 			),
 		);
 

web/actions/crons.ts

@@ -14,11 +14,7 @@ export async function runServiceCron(cronId: string) {
 		.from(serviceCrons)
 		.innerJoin(
 			services,
-			and(
-				eq(serviceCrons.serviceId, services.id),
-				isNull(services.deletedAt),
-				isNull(services.previewOfServiceId),
-			),
+			and(eq(serviceCrons.serviceId, services.id), isNull(services.deletedAt)),
 		)
 		.where(eq(serviceCrons.id, cronId))
 		.limit(1)

web/actions/migrations.ts

@@ -3,15 +3,13 @@
 import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { db } from "@/db";
-import { getService } from "@/db/queries";
 import { services } from "@/db/schema";
 import { requireDeveloperRole } from "@/lib/auth";
 import { inngest } from "@/lib/inngest/client";
 import { inngestEvents } from "@/lib/inngest/events";
 
 export async function cancelMigration(serviceId: string) {
 	await requireDeveloperRole();
-	if (!(await getService(serviceId))) throw new Error("Service not found");
 	await inngest.send(inngestEvents.migrationCancelled.create({ serviceId }));
 
 	await db