Preview environments: from a PR label to teardown

A preview environment gives reviewers a temporary URL for one pull request. The pattern is easy to state and hard to picture: a label on the PR starts a webhook, a CI job builds an image for that commit, a GitOps controller turns Git metadata into a namespace with workloads, data, DNS and a certificate, a reviewer approves or asks for changes, and closing the PR removes all of it.

The Preview Environment Simulator shows that sequence for one pull request, in five scenes, in the browser. Turn on Practice a failure before you open a PR and the run blocks at a realistic point with three repair options, only one of which works. Disclosure: I help build DevOps Daily. The simulator was developed in partnership with Atomsized and is inspired by their published preview-environment workflow; the data layer uses a Neon database branch to show preview data following the PR lifecycle.

The five scenes

A strip at the top tracks where you are. You make the decisions in the first and last scenes; the automation in between pauses between systems and waits for you to continue, so you can read what each one did.

1. Developer intent. A GitHub-style pull request list with three PRs. Open one and add the preview label. That label is the whole trigger.
2. Webhook event. GitHub delivers the pull_request labeled event. The receiver checks the signature, matches label=preview on acme/store, and refreshes the Argo CD ApplicationSet so its pull-request generator picks up the PR now rather than on its next poll.
3. GitHub Actions. The runner builds the image tagged with the PR's commit and pushes it to the registry. The tag is what later lets the review page name the exact revision that is running.
4. Argo CD console. The resource tree fills in on its own: the Argo CD application, the namespace, the deployment, the service, the ingress and certificate, the Neon database branch for the PR, and a readiness and revision hook at the end.
5. PR preview URL. The review page: URL, deployed revision, namespace, TTL, the workload list and one image tag, the database branch, an access check, the hourly cost and an isolation score. Choose Approve preview or Request changes, then Close PR & clean up.

Three pull requests, three shapes of preview

The scenarios are fixed, and each one shows a different kind of environment:

• PR 184, feat: redesign the checkout flow on checkout-v2. A coordinated web plus API preview with a masked snapshot of stage data, the balanced resource profile, team SSO access and an eight-hour TTL. The review page prices it at $0.53/hr with 88% isolation.
• PR 183, feat: add the order status endpoint on order-status-api. A single-service API preview with synthetic fixtures, the lean profile, team SSO and a six-hour TTL: $0.15/hr, 96% isolation.
• PR 182, feat: process checkout events asynchronously on checkout-worker. Web, API and worker together, masked snapshot, balanced profile, team SSO, twelve-hour TTL: $0.69/hr, 88% isolation.

Read the three side by side and the model behind the numbers is visible. Under team SSO it gives synthetic fixtures 96% isolation and a masked snapshot 88%. Hourly cost rises with the number of services and the resource profile; the TTL only feeds an estimated run cost that the page does not show. The same model gives shared-stage data a 48% base isolation score and takes 22 points off for public-link access. Neither option is selectable in this walkthrough, but the numbers are the ones to bring up when someone asks for "just a link I can send to the client".

The failure drills

With Practice a failure on, the PR you pick decides which repair you get:

• PR 184, branch override missing. The generated desired state shows api@main where the web change expects api@feature/checkout-v2. Restarting the workflow reproduces the same wrong state. Disabling the health gate cannot change which code is running. The fix is to declare the API branch override so the coordinated stack names every non-default revision explicitly.
• PR 183, preview secret unavailable. CreateContainerConfigError: secret "payment-sandbox" not found. The tempting option is to copy the production secret; the simulator refuses, because production credentials do not cross the preview boundary. Making the route public is unrelated to the workload. Map an approved sandbox secret through the normal secret controller.
• PR 182, deployed revision drift. Health checks pass, but the worker runs an older image, not the commit recorded on the PR. Approving because it is healthy is the trap: healthy evidence for the wrong revision proves nothing about the change. Removing the worker from the evidence makes the review incomplete. Reconcile the recorded revision and wait until the observed image matches.

A wrong choice shows why it does not work and lets you pick again. The drift drill separates "the environment is up" from "the environment is running what we meant to review".

What the review page shows, and what closing the PR does

The last scene puts evidence next to the URL rather than the URL alone, and records the reviewer's decision on the PR; production stays a separate path.

Close PR & clean up shows Argo CD pruning the environment, then marks the resources removed and the cost back to $0.00/hr. Underneath, the state machine records cleanup in a fixed order: the review URL (ingress, DNS, certificate), the workloads, the dependencies (preview data, cache, temporary storage), the namespace, and finally the desired state in Git, closed against the same intent that created the environment. The UI shows that as one transition; the order is the useful part if your own teardown deletes the namespace and forgets the DNS record or the database branch.

How to use it

1. Run PR 184 with failure practice off, reading each scene's output.
2. Run PR 184 again with failure practice on and repair the branch override.
3. Run PR 183 with failure practice on and map the sandbox secret.
4. Run PR 182 with failure practice on and reconcile the drifted worker.

The simulator is one of 50+ DevOps games and simulators on DevOps Daily, no signup needed. References: Atomsized on preview environments and Neon's branching documentation.