From 7859c8e13aa3f55677fa2de794f4f92a41422372 Mon Sep 17 00:00:00 2001
From: Wanjohi <elviswanjohi47@gmail.com>
Date: Thu, 17 Sep 2026 01:44:50 +0300
Subject: [PATCH] ci: restart the issuer before the API

Units come back in the order their artefacts appear in the manifest, and the
API reaches the issuer over AUTH_INTERNAL_URL -- so api-then-auth means the
API spends a moment talking to a service that is restarting.
---
 .github/workflows/release-prod.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index 20ffdf49..2be50e64 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -190,6 +190,10 @@ jobs:
           # the checksum of every artefact, so the agent can verify what it
           # downloaded before it swaps anything into place.
           #
+          # The order matters: units are restarted in the order they appear
+          # here, and the API's AUTH_INTERNAL_URL names the issuer, so the
+          # issuer comes back first.
+          #
           # `unit` is what gets restarted. `nestri-migrate` has none on purpose
           # — it is run, not served — and `migrate: true` is what makes the
           # deploy run it *before* the swap. That ordering is why migrations
@@ -205,16 +209,16 @@ jobs:
             "run": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
             "migrate": true,
             "artefacts": [
-              {
-                "name": "nestri-api",
-                "unit": "nestri-api",
-                "sha256": "$(sha256sum nestri-api | cut -d' ' -f1)"
-              },
               {
                 "name": "nestri-auth",
                 "unit": "nestri-auth",
                 "sha256": "$(sha256sum nestri-auth | cut -d' ' -f1)"
               },
+              {
+                "name": "nestri-api",
+                "unit": "nestri-api",
+                "sha256": "$(sha256sum nestri-api | cut -d' ' -f1)"
+              },
               {
                 "name": "nestri-migrate",
                 "sha256": "$(sha256sum nestri-migrate | cut -d' ' -f1)"