What Is Audit Logging in Dewy? Deployment Tracking Explained

Audit logging in Dewy is a built-in mechanism that automatically records deployment metadata—host, command, and timestamp—as immutable text files stored alongside your artifacts in the registry.

Dewy is an open-source deployment automation tool that simplifies shipping binaries and assets to production servers. Understanding audit logging in Dewy is essential for teams that require deployment visibility, compliance trails, or operational debugging without relying on external logging infrastructure.

How Dewy Implements Audit Logging

After every successful deployment, Dewy generates a concise audit entry that captures exactly what happened. The implementation centers on the Report method in registry/ghr.go, which constructs a human-readable string containing the hostname, the executed command, and the current UTC timestamp.

// registry/ghr.go – Report method
info := fmt.Sprintf("shipped to %s %s at %s",
    strings.ToLower(hostname), req.Command, now)

This string is then uploaded as a plain-text release asset to the same registry hosting your artifact.

The ReportRequest Struct

The Report method receives deployment context through the ReportRequest struct defined in registry/registry.go. This struct carries the command type—such as server or assets—and any error states that might need to be recorded alongside the audit entry.

Where Audit Logs Are Stored

Dewy stores audit logs directly within your artifact registry, ensuring the deployment record travels with the binary it describes.

GitHub Releases Storage

When using GitHub releases as your registry (ghr://), Dewy uploads the audit entry as a release asset attached to the specific version. The filename follows a predictable pattern:

shipped_to_{hostname}_{command}_at_{timestamp}.txt

For example: shipped_to_myhost_server_at_20240101T123456Z.txt.

S3, GCS, and OCI Registries

For alternative storage backends—such as Amazon S3, Google Cloud Storage, or OCI-compliant registries—Dewy applies the same pattern. The audit text file is written adjacent to the deployed artifact, maintaining a consistent audit trail regardless of where your artifacts live.

Accessing and Using Audit Logs

Because audit files are standard release assets, you can access them through the registry's native interface or programmatically via API.

Deploy and Auto-Generate Logs

Run a standard Dewy deployment to automatically create the audit record:

dewy server \
    --registry ghr://myorg/myapp \
    --port 8080 \
    -- ./current/myapp

After the binary starts, Dewy uploads a file such as shipped_to_host_server_at_20240306T152300Z.txt to the GitHub release assets.

View Logs on GitHub

Navigate to your release page to download the audit file:

open "https://github.com/myorg/myapp/releases/tag/v1.2.3"

Look for the text file matching the shipped_to_* pattern in the assets list.

Programmatically Fetch Audit Entries

External monitoring systems can retrieve audit logs directly from object storage:

package main

import (
	"io/ioutil"
	"log"
	"net/http"
)

func main() {
	url := "https://my-bucket.s3.amazonaws.com/v1.2.3/shipped_to_host_server_at_20240306T152300Z.txt"
	resp, err := http.Get(url)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()
	body, _ := ioutil.ReadAll(resp.Body)
	log.Printf("Audit entry: %s", string(body))
}

This pattern allows you to integrate Dewy's audit trail into existing compliance dashboards or alerting systems.

Why Audit Logging Matters in Dewy

Audit logging provides critical operational benefits without adding complexity:

• Immutable records – Once uploaded as a release asset, the audit file cannot be altered, providing a trustworthy history of every deployment.
• Zero external dependencies – Unlike centralized logging platforms, Dewy's audit records live in your existing artifact registry, eliminating additional infrastructure costs.
• Compliance support – The automatic timestamp and hostname capture satisfy common requirements for tracking who deployed what and when.
• Notification integration – Dewy's notification system can reference these audit entries when alerting on deployment failures or unexpected behavior.

Summary

• Audit logging in Dewy creates a text record of every deployment containing the host, command, and UTC timestamp.
• The Report method in registry/ghr.go generates these entries, while registry/registry.go defines the request structure.
• Audit files follow the naming convention shipped_to_{host}_{command}_{timestamp}.txt.
• Logs are stored as release assets in GitHub or as adjacent files in S3/GCS/OCI registries.
• This built-in mechanism provides immutable deployment history without requiring external logging services.

Frequently Asked Questions

What information does a Dewy audit log contain?

Each audit log entry contains the target hostname, the Dewy command that was executed (such as server or assets), and a UTC timestamp formatted as shipped to {hostname} {command} at {timestamp}. This plain-text format ensures human readability while remaining machine-parseable.

Where are audit logs stored in Dewy?

According to the registry/ghr.go implementation, audit logs are stored as release assets within the same registry that hosts your deployed artifacts. For GitHub releases, this means the text file appears in the release's asset list; for S3 or GCS, it resides in the same bucket prefix as the binary.

Does Dewy support audit logging for all registry types?

Yes. While the primary implementation resides in registry/ghr.go for GitHub releases, Dewy applies the same audit file pattern across all supported backends—including S3, Google Cloud Storage, and OCI registries—ensuring consistent deployment tracking regardless of storage provider.

How can I retrieve audit logs for a specific deployment?

Navigate to the specific release version in your registry (e.g., https://github.com/owner/repo/releases/tag/v1.0.0) and locate the text file matching the shipped_to_* pattern. Alternatively, use your storage provider's API or SDK to list assets for that version and filter by the audit file prefix.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}