fix: report the deployed URL so the Console can show the live preview

[kristof-siket]

The bug

When a repo is connected through Prisma Cloud's workspace-level flow, a GitHub Actions workflow runs this action, which deploys with prisma-composer deploy and reports a Build to the Management API. On prod, a real deploy fully succeeded (build bld_cmsx3cfab27hb19ee15ncv0wm, state=succeeded) but the Build row's deployedUrl was null.

The Console's provisional-project card shows "preview live" with a clickable URL only when Build.deployedUrl is set. With a succeeded build and a null deployedUrl, the card sits on a deploying spinner forever.

Root cause is here in the action: it reports create → phase updates → { state: "succeeded" } and sets externalLogUrl (the Actions run URL) at creation, but it never captures the deployed preview URL and PATCHes deployedUrl.

Where the deployed URL comes from

Composer's deploy prints the deployed compute service's public address — https://<hash>.<region>.prisma.build — on its own line in the deployment report. From the real run:

menu-board
└─ menuboard   compute-service cps_wfzg31o86hblgngtaz2lh4mw
               https://wfzg31o86hblgngtaz2lh4mw.ewr.prisma.build
Done: 12 succeeded

I checked whether the pinned Composer exposes this machine-readably:

• Released @prisma/composer@0.6.0 (what the action pins) does not. Its CLI bin has no --json deploy result and no deploy-result summary protocol — the address exists only in the human-rendered report above.
• The machine-readable deploy summary — whose summary.nodes[].entities[].url carries exactly this .prisma.build address — does exist in Composer main (added 2026-08-07, after the v0.6.0 tag of 2026-08-03), but it is unreleased. It is also currently an internal cross-process protocol: Composer generates its own result-file path, reads it, and deletes it, so the action can't consume that file even on main.

So today there is no machine-readable source the action can read against the released Composer.

The change

On a successful deploy, the action now reads the .prisma.build address from Composer's deploy output and fills deployedUrl on the succeeded report:

• runPhase gained an opt-in capture for the deploy phase — stdout is piped so the report can be read, then written back so the phase still shows in the log (as a block at phase end; stderr stays inherited and live). Other phases are unchanged.
• A small tested extractor (deployment.mjs) pulls the address with a regex anchored tightly to the .prisma.build suffix, so nothing else in the log (the Actions run URL, the API host, a connection string) can match. It strips SGR color escapes first and returns the first address (a single-service app — the setup-PR shape — prints exactly one).
• deployedUrl is folded into the existing { state: "succeeded" } PATCH, guarded like every other report (guardReport): a missing address or a failed report call is a warning and never fails the deploy. deployedUrl is fill-only on the Builds API.

Trade-off to weigh (why this is a draft)

The URL is parsed from Composer's human output, which Composer treats as presentation, not a contract. The parse is tightly anchored and tested, and it fixes the stuck card against the Composer we ship today. It is a bridge, not the end state.

Composer follow-up (recommended, unblocks retiring the parse)

Expose the deploy result in a machine-readable form the action can consume — the clean option is a --json deploy result on stdout carrying each deployed service's public URL (summary.nodes[].entities[].url). The json renderer for this already exists in Composer main (PR #205); the work is releasing it and guaranteeing the --json deploy result is clean, parseable stdout. Once released (and the action's pinned composer-version is bumped), the action should read the URL from that result and drop the text parse. Tracked as a limitation in the README.

Testing

• deployment.mjs extractor: 8 unit tests — real deploy-report shape, multi-service (first wins), ignores the Actions run URL / API host, tolerates surrounding color escapes, keeps a path suffix, rejects a .build lookalike, null/empty-safe.
• CI now runs the whole tests/ suite (it previously ran only the credentials test), so the new tests are gated. All 34 tests pass; node --check passes for every script; the action.yml sanity check passes (no input/output surface change).

Not done here

No Composer changes (out of scope for this PR). No new action inputs/outputs.