Guides → Publish an Application
This content applies to Incorta Cloud deployments only.
Publishing makes one version of your application live at a stable address where your users can open it. A publish is a run: a sequence of steps that Incorta performs in order. A publish takes time to complete, and it can pause to wait for your review.
While a new version is being published, the current live version stays live. The new version replaces it only after the publish succeeds.
Publish steps
| Step | What it does |
|---|---|
| Build | Installs the dependencies, builds the application from its source, and uploads the build |
| Security check | Scans the version for exposed secrets, missing sign-in protection, vulnerable dependencies, and code that weakens authentication. For details, refer to Security check. |
| Production database | Creates the production database on the first publish. On later publishes, uses the existing production database. |
| Plan database changes | Determines the changes that the production database schema requires |
| Expand database schema | Applies the schema changes that are safe to make before the new version goes live |
| Go live | Makes the version live at the application address |
| Apply destructive database changes | Applies the schema changes that remove data, after the new version is live |
Steps that have no work to do are skipped, for example, when a version has no schema changes.
Steps to publish an application via the platform
- Open the application.
- Select More, and then select Production.
- Select Publish vN, where N is the newest version.
- On the first publish, specify the subdomain for the application address.
The publish starts, and the Update button in the top bar shows Publishing. The Production page shows the progress of each step.
The first publish sets the application subdomain, which becomes the permanent address of the application on the app domain of your Incorta environment. Each subdomain is unique. If the subdomain you want is taken, choose another.
Monitor a publish
While a publish runs, the Production page shows a Publishing vN section with the user who started the publish, the elapsed time, and the status of each step. Steps that have not started yet show Pending.
When the publish succeeds, the section shows vN is live with the total duration. To open the live application, select Open app.
To view the details and duration of each step after a publish, in the Last publish section, select Show steps. The details include the following:
- Build: The time spent installing dependencies, building, and uploading
- Security check: The number of scanners that ran
- Production database: Whether the database was created or already existed, and the database name
- Plan database changes: The planned schema changes, or no schema changes
- Go live: The application address
Cancel a publish
To cancel a running publish, select Cancel publish.
You can cancel a publish until the Expand database schema step starts. Nothing in production changes before that step, so canceling leaves the live version and the production database unchanged.
Actions unavailable during a publish
While a publish runs, you cannot start another publish or unpublish the application.
Deleting the application or deleting the production database while a publish is paused for review cancels the paused publish.
When a publish pauses
A publish pauses and waits for your review in the following cases:
- Acknowledgeable security findings: The security check found an issue that is not severe enough to block the publish. Review the finding, and then choose whether to continue.
- Destructive database changes: The production database change would drop data or might fail against existing rows. Review the exact changes before you approve them.
A paused publish waits 24 hours for your response. After 24 hours, the publish expires. Nothing is published, and nothing is changed.
Security check
Every publish runs a security check after the build and before Incorta provisions or changes anything in production. While the check runs, the Security check step lists the scanners that are running.
What the security check scans
The security check runs the following checks in order:
| Check | Looks for |
|---|---|
| Secrets in your files | Credentials, keys, or tokens committed into the application files |
| Secrets in the built output | Your secret values included in the code that is sent to the browser |
| Authentication gate | Whether the published application requires sign-in, Incorta verifies this by requesting the application without signing in. |
| Dependency advisories | Known vulnerabilities and malware in the packages that the application uses |
| Code analysis | Code patterns that weaken authentication |
The security check stops at the first blocking issue. As a result, a blocked publish might not report every issue at once. After you fix the reported issues, publish again to run the remaining checks.
Blocking and acknowledgeable findings
| Finding type | What happens | What to do |
|---|---|---|
| Blocking | The publish stops. | Fix the issue, and then publish again. |
| Acknowledgeable | The publish pauses and waits for your review. | Review the finding, and then choose whether to continue. |
Examples of acknowledgeable findings include a known advisory in a dependency and a code pattern that weakens the authentication gate.
Your own secret values in the application files or the built output are always blocking. To fix this issue, remove the value from the code and read it from an environment variable instead.
After you acknowledge an advisory for a specific package version, later publishes do not pause for the same advisory again.
Review security findings
Each blocking finding includes a code, a message, and a hint that explains how to fix it.
To view the findings, on the Production page, in the Last publish section, select Show steps, and then expand the Security check step.
Republish, roll back, and unpublish
Republish the live version
To publish the live version again, on the Production page, select Republish vN. Republishing runs all publish steps again for the same version. Use this option to retry a failed step from a clean state.
Roll back to an earlier version
Rolling back publishes an earlier version. The application address stays the same, and the version behind it changes.
To roll back with the AppKit CLI, publish the earlier version by its version number. For details, refer to References → AppKit CLI.
Unpublish an application
To take the application offline, on the Production page, select Unpublish. The application address stops serving the application. This does not affect the application, its versions, or its databases.
Publish history
The History section on the Production page lists every publish run, newest first, with the version, start time, user, address, and duration. To view the steps of a run, expand the run.
Publish with the AppKit CLI
Use the appkit publish command to publish the current version, publish an earlier version, view the SQL that a publish will run, and confirm a paused publish. For details, refer to References → AppKit CLI.
The AppKit CLI provides flags that accept data loss, dependency advisories, and code findings in advance, so that a publish does not pause. These flags are intended for automated pipelines only. With these flags, a publish continues without asking anyone to review data loss or security findings. Do not use these flags for routine publishing.