BrunelDocs

Operate

Deployment

Ship a Brunel design through your own CI. A pull request with Terraform and a plan-and-apply workflow, or a one-click run of that workflow. Cloud credentials never reach Brunel.

Brunel never deploys with its own access. Deployment runs in your GitHub Actions, after your review, with credentials that stay in your repository.

ModePlanWhat Brunel does
DownloadAll plans (ZIP on Pro and above)Nothing: you apply the files yourself
Pull requestBusiness and aboveOpens a pull request with the tier's files and a plan/apply workflow
One clickEnterpriseAsks GitHub to start that workflow, then follows the run live

Deploy through a pull request

  1. Choose a version and a tier, then Open a pull request.
  2. Brunel creates a branch brunel/infra-v<version>-<tier> and a pull request containing:
    • infra/terraform/…: the Terraform for that tier;
    • .github/workflows/brunel-infrastructure.yml: runs terraform plan on the pull request and posts it, and terraform apply after merge, behind a production environment you can protect with required reviewers;
    • infra/BOOTSTRAP.md: the one-time setup (state bucket, identity provider, secrets).
  3. Review and merge. Your CI applies.

One-time setup

  • AWS: the workflow authenticates with GitHub OIDC. infra/BOOTSTRAP.md creates the OIDC identity provider and a deploy role limited to your repository. No access key is stored anywhere.
  • Scaleway: Scaleway has no OIDC federation. Terraform outputs a dedicated IAM application key, which you store as a GitHub secret.

Until the setup is done, the workflow stops with a notice listing what is missing.

One click

On Enterprise, Deploy asks GitHub to run the brunel-infrastructure.yml workflow on your repository (workflow_dispatch). Brunel shows the run, its jobs and their status live, and links to GitHub. Brunel never receives cloud credentials; application secrets you entered for the architecture are sealed and written as GitHub secrets of your repository, never shown again.

Notifications

Deployments send deploy.pr and deployment status events to Slack or your webhook. See Webhooks.

Deployment · Brunel Docs