@akash-chowdhury-24/deployhub 2.0.14 → 2.0.15

package/README.md

@@ -86,7 +86,7 @@ This interactive wizard will:
 - Set up storage providers (AWS, Google Drive, Azure, GCP, Dropbox, Local)
 - Optionally configure deployment targets (SSH, Docker, EC2, Azure VM, GCP VM, Kubernetes)
 - Generate `deployhub.config.json`
-- Generate `.github/workflows/deployhub.yml`
+- Generate `.github/workflows/deployhub.yml` and `.github/workflows/deployhub-rollback.yml`
 - Generate `.env.example`
 
 ### 2. Configure credentials
@@ -182,7 +182,8 @@ The wizard asks the same core questions for every setup:
 **Generated files:**
 
 - `deployhub.config.json` — project settings (no secrets)
-- `.github/workflows/deployhub.yml` — CI pipeline
+- `.github/workflows/deployhub.yml` — CI deploy pipeline (push to main)
+- `.github/workflows/deployhub-rollback.yml` — manual CI rollback (`workflow_dispatch`)
 - `.env.example` — list of env vars you may need
 - `nginx.conf` — auto-generated if frontend deploys to SSH
 - `Dockerfile` — auto-generated if missing and you chose Docker or Kubernetes deploy (your existing `Dockerfile` is never overwritten)
@@ -231,9 +232,25 @@ deployhub artifact restore <buildId> # download a past build
 deployhub deploy                     # deploy latest artifact without rebuilding
 deployhub rollback                   # previous build from history
 deployhub rollback <buildId>         # exact build (required if semver is ambiguous)
+deployhub sync-workflows             # regenerate deploy + rollback GitHub Actions YAML
+deployhub sync-k8s-ports             # fix containerPort/targetPort in existing k8s manifests
 deployhub logs                       # last deployment logs
 ```
 
+### Rollback behavior
+
+`deployhub rollback` restores a previous artifact from storage `history.json` and redeploys it:
+
+| Argument | Behavior |
+|----------|----------|
+| *(none)* | Rolls back to the **previous** build (second entry in newest-first history) |
+| Exact `buildId` | Rolls back to that specific build |
+| Semver / version string matching **multiple** builds | Does **not** guess — prints the matching `buildId`s and exits; re-run with an exact one |
+
+`buildId` looks like `{semver}-{stamp}` where the stamp is a short git SHA when available, otherwise a CI run id, otherwise a high-resolution timestamp. When `DOCKER_IMAGE_TAG` is left unset, Docker and Kubernetes use that same `buildId` as the image tag — so you can correlate an artifact in storage with the image that was pushed.
+
+For CI-triggered rollback, see [CI rollback](#ci-rollback-deployhub-rollbackyml).
+
 ---
 
 ## Walkthrough: Storage only
@@ -555,17 +572,27 @@ All JS frontends share the same install/build flow: `npm ci` → `npm run build`
 After `init`, commit these files:
 
 ```bash
-git add deployhub.config.json .github/workflows/deployhub.yml .env.example
+git add deployhub.config.json .github/workflows/deployhub.yml .github/workflows/deployhub-rollback.yml .env.example
 git commit -m "Add DeployHub CI"
 ```
 
 1. Open **Settings → Secrets and variables → Actions** in your GitHub repo.
 2. Add every secret listed at the end of `deployhub init` (storage + deployment).
-3. Push to `main` or `master` — the workflow triggers on push.
+3. Push to `main` or `master` — the deploy workflow triggers on push.
+
+The deploy workflow (`deployhub.yml`) installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+
+To run a deploy manually: **Actions → DeployHub → Run workflow**.
+
+### CI rollback (`deployhub-rollback.yml`)
 
-The workflow installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+`init` also generates a separate **DeployHub Rollback** workflow (`deployhub-rollback.yml`). It is triggered only via GitHub Actions' **Run workflow** button (not on push):
 
-To run manually: **Actions → DeployHub → Run workflow**.
+1. Open **Actions → DeployHub Rollback → Run workflow**.
+2. Optionally enter an exact `buildId` (leave blank to roll back to the previous build).
+3. Run the workflow.
+
+Already-initialized projects that only have `deployhub.yml` will not get the rollback workflow from a re-run of unrelated commands — run **`deployhub sync-workflows`** once to regenerate both workflow files from your current `deployhub.config.json`, then commit and push.
 
 ---
 
@@ -648,6 +675,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### SSH
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites (before `deployhub init`):**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (deploy path ownership + Nginx/sudo for frontends)
 - [ ] A Linux server with SSH enabled
@@ -687,7 +716,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Docker
 
-**Verification:** Real-world verified (local and CI Docker deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (local and CI).
 
 **Prerequisites:**
 - [ ] Docker installed (`docker --version` works)
@@ -722,6 +751,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### AWS EC2
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`ec2-user` on Amazon Linux)
 - [ ] EC2 instance launched in AWS Console (DeployHub does not create it)
@@ -758,6 +789,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Azure VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`azureuser` or your VM login user)
 - [ ] Azure VM created in Portal (DeployHub does not provision it)
@@ -792,6 +825,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### GCP VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (your GCP SSH username)
 - [ ] Compute Engine VM created (DeployHub does not create it)
@@ -832,7 +867,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Kubernetes
 
-**Verification:** Real-world verified (including k3s and CI deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (including k3s and CI).
 
 **Prerequisites:**
 - [ ] Existing Kubernetes cluster (DeployHub does not provision clusters)
@@ -868,7 +903,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 6. Add GitHub Secrets for CI (see table — **`KUBECONFIG` must be the file contents, not a path**)
 7. Run `deployhub doctor`, then `git push origin main`
 
-> **Warning — Service `targetPort`:** the default `targetPort` in generated `k8s/service.yaml` may not match your app's actual exposed port (e.g. a static nginx image serves on port **80**, not the config's default like 3000). Verify and adjust `k8s/service.yaml`'s `targetPort` (and the Deployment `containerPort` if needed) before your first deploy.
+> **Ports in generated Kubernetes manifests:** `containerPort` and `targetPort` are derived from your project's Dockerfile `EXPOSE` line (frontend / nginx images correctly get **80**; backends get their real exposed port). If no Dockerfile or usable `EXPOSE` exists yet, DeployHub falls back to a per-project-type default that matches its Dockerfile templates. Fresh `init` does **not** require a manual port edit. The Service's external `port:` stays **80** for all project types by design (Ingress-friendly); only the internal `targetPort` / `containerPort` track the container. Already-initialized projects with stale `3000` values can run `deployhub sync-k8s-ports` to patch just those fields.
 
 | Variable | Description | Example | Where to get it |
 |----------|-------------|---------|-----------------|
@@ -961,8 +996,10 @@ Run `deployhub doctor` after any config change.
 | `deployhub storage list` | List storage providers and connection status |
 | `deployhub deploy` | Deploy latest artifact |
 | `deployhub rollback [buildId\|semver]` | Previous build, or exact buildId (ambiguous semver lists matches and exits) |
+| `deployhub sync-workflows` | Regenerate `.github/workflows/deployhub.yml` and `deployhub-rollback.yml` from config |
+| `deployhub sync-k8s-ports` | Update only `containerPort` / `targetPort` in `k8s/deployment.yaml` and `k8s/service.yaml` from Dockerfile `EXPOSE` (or config/fallback). Does **not** change replicas, resources, env, or probes. Heavily customized / multi-container manifests may need a manual review |
 | `deployhub logs` | Show logs from last deployment |
-| `deployhub doctor` | Pre-flight checks |
+| `deployhub doctor` | Pre-flight checks (including an informational warning if the rollback workflow file is missing) |
 | `deployhub verify` | Health check on configured endpoint |
 | `deployhub clean` | Remove old local artifacts |
 | `deployhub update` | Check for CLI updates |
@@ -1009,6 +1046,8 @@ Add these secrets in your repository (Settings → Secrets and variables → Act
 | `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_HOST` | Docker deployment (`DOCKER_IMAGE_TAG` optional) |
 | `KUBECONFIG`, `KUBE_CONTEXT`, `KUBE_NAMESPACE`, `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_IMAGE_TAG`, `KUBE_IMAGE_PULL_SECRET` | Kubernetes — **`KUBECONFIG` in GitHub Secrets must be the kubeconfig file contents (or base64), not a filesystem path**. `DOCKER_IMAGE_TAG`, `KUBE_NAMESPACE`, `DOCKER_REGISTRY_URL`, and `KUBE_IMAGE_PULL_SECRET` are optional |
 
+**Kubernetes rollback vs deploy — registry credentials:** Kubernetes **rollback** specifically **requires** `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`. Rollback rebuilds and must push a fresh image tagged with the restored `buildId`; without registry credentials it fails loudly and early (a rollback that cannot push can never succeed against a real cluster). This is stricter than a normal Kubernetes **deploy**, which may still allow local-only / no-push flows in some setups. If deploy worked without those secrets but rollback fails asking for them, that asymmetry is intentional.
+
 See [Deployment method guides](#deployment-method-guides) for full per-method variable tables with examples.
 
 ## `deployhub doctor` Output
@@ -1025,11 +1064,14 @@ The doctor command runs independent checks and always completes without crashing
   Checking Health endpoint...   ✓ URL reachable (HTTP 200)
   Checking Secrets...           ✓ All required env vars present
   Checking GitHub Actions...    ✓ Workflow file exists at .github/workflows/deployhub.yml
+  Checking Rollback workflow... ✓ Missing .github/workflows/deployhub-rollback.yml — run deployhub sync-workflows to add CI rollback (workflow_dispatch)
   Checking Storage write...     ✓ Test upload succeeded
 
-  ✓ Ready to deploy (10/10 checks passed)
+  ✓ Ready to deploy (11/11 checks passed)
 ```
 
+The **Rollback workflow** check is informational and non-blocking (`✓` even when the file is missing). It suggests `deployhub sync-workflows` so already-initialized projects can pick up `deployhub-rollback.yml` without a full re-init. When the file exists, the message confirms the path instead.
+
 If checks fail:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/cli/index.js

@@ -14,6 +14,7 @@ import { registerVerifyCommand } from '../commands/verify.js';
 import { registerCleanCommand } from '../commands/clean.js';
 import { registerUpdateCommand } from '../commands/update.js';
 import { registerSyncWorkflowsCommand } from '../commands/sync-workflows.js';
+import { registerSyncK8sPortsCommand } from '../commands/sync-k8s-ports.js';
 import { formatVersionOutput, printBanner, shouldShowBanner } from '../utils/author.js';
 
 loadEnv();
@@ -43,5 +44,6 @@ registerVerifyCommand(program);
 registerCleanCommand(program);
 registerUpdateCommand(program);
 registerSyncWorkflowsCommand(program);
+registerSyncK8sPortsCommand(program);
 
 program.parse();

package/src/commands/sync-k8s-ports.js

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+import { loadConfig, loadEnv } from '../core/config.js';
+import { resolveContainerPort } from '../utils/dockerfile-expose.js';
+import {
+  getDefaultKubernetesManifestPaths,
+  syncKubernetesManifestPorts,
+} from '../utils/kubernetes-manifests.js';
+import fs from 'fs-extra';
+
+/**
+ * Surgically fix containerPort/targetPort in existing k8s manifests from Dockerfile EXPOSE.
+ * @param {import('commander').Command} program
+ */
+export function registerSyncK8sPortsCommand(program) {
+  program
+    .command('sync-k8s-ports')
+    .description(
+      'Update only containerPort/targetPort in k8s/deployment.yaml and k8s/service.yaml ' +
+        'from the Dockerfile EXPOSE port (or config/fallback). Does not change replicas, ' +
+        'resources, env, probes, or Service port. Heavily customized / multi-container ' +
+        'manifests may need a manual review.'
+    )
+    .action(async () => {
+      loadEnv();
+      const cwd = process.cwd();
+      const config = await loadConfig(cwd);
+
+      const { deploymentPath, servicePath } = getDefaultKubernetesManifestPaths(cwd);
+      const hasDeployment = await fs.pathExists(deploymentPath);
+      const hasService = await fs.pathExists(servicePath);
+
+      if (!hasDeployment && !hasService) {
+        console.log(
+          chalk.yellow(
+            'No k8s/deployment.yaml or k8s/service.yaml found — nothing to patch. ' +
+              'Generate starter manifests via deployhub init, or add manifests under ./k8s/.'
+          )
+        );
+        return;
+      }
+
+      const { port, source } = await resolveContainerPort(cwd, config);
+      const result = await syncKubernetesManifestPorts(cwd, port);
+
+      console.log(
+        chalk.green(
+          `✓ Resolved container port ${port} (source: ${source})`
+        )
+      );
+
+      if (result.patched.length === 0) {
+        console.log(chalk.gray('  Port fields already match — no files changed.'));
+      } else {
+        for (const file of result.patched) {
+          console.log(chalk.gray(`  Updated ${file}`));
+        }
+      }
+
+      console.log('');
+      console.log(
+        chalk.yellow(
+          'Note: Only containerPort and targetPort are updated. Replicas, resources, env, ' +
+            'probes, and Service port: are left unchanged. If your manifests are heavily ' +
+            'customized (multiple containers, non-standard field layout), review the diff ' +
+            'manually before deploying.'
+        )
+      );
+    });
+}
+
+export default { registerSyncK8sPortsCommand };

package/src/utils/dockerfile-expose.js

@@ -0,0 +1,117 @@
+import fs from 'fs-extra';
+import path from 'path';
+
+/** Static SPA frameworks that use nginx:alpine + EXPOSE 80 in generated Dockerfiles. */
+const STATIC_FRONTEND_FRAMEWORKS = new Set([
+  'react',
+  'vue',
+  'angular',
+  'svelte',
+  'astro',
+  'vanilla',
+]);
+
+/**
+ * Parse the listening port from Dockerfile EXPOSE instructions.
+ * Uses the last EXPOSE line (final stage in multi-stage builds).
+ * Supports `EXPOSE 80`, `EXPOSE 80/tcp`, and multi-port lines (first numeric wins on that line).
+ *
+ * @param {string} content
+ * @returns {number|null}
+ */
+export function parseDockerfileExposePort(content) {
+  if (!content || typeof content !== 'string') return null;
+
+  /** @type {number|null} */
+  let lastPort = null;
+
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) continue;
+
+    const match = line.match(/^EXPOSE\s+(.+)$/i);
+    if (!match) continue;
+
+    const tokens = match[1].trim().split(/\s+/);
+    for (const token of tokens) {
+      const portToken = token.split('/')[0];
+      if (!/^\d+$/.test(portToken)) continue;
+      const port = Number(portToken);
+      if (port >= 1 && port <= 65535) {
+        lastPort = port;
+        break;
+      }
+    }
+  }
+
+  return lastPort;
+}
+
+/**
+ * Per-type fallback matching generated Dockerfile templates when EXPOSE is unavailable.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @returns {number}
+ */
+export function resolveFallbackContainerPort(config) {
+  const projectType = config.projectType || 'frontend';
+  const framework =
+    (projectType === 'both'
+      ? config.backend?.framework || config.framework
+      : config.framework) ||
+    (projectType === 'frontend' ? 'react' : 'express');
+
+  if (projectType === 'frontend' && STATIC_FRONTEND_FRAMEWORKS.has(framework)) {
+    return 80;
+  }
+
+  if (['laravel', 'symfony', 'php'].includes(framework)) return 80;
+  if (['fastapi', 'django', 'flask', 'python'].includes(framework)) return 8000;
+  if (['spring', 'java'].includes(framework)) return 8080;
+  if (framework === 'go') return 8080;
+  if (framework === 'dotnet') return 5000;
+  if (framework === 'rails') return 3000;
+
+  // nextjs, nestjs, express, and other Node backends
+  return 3000;
+}
+
+/**
+ * Precedence: Dockerfile EXPOSE → config.port / backend.port → per-type fallback.
+ *
+ * @param {string} cwd
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @returns {Promise<{ port: number, source: 'expose'|'config'|'fallback' }>}
+ */
+export async function resolveContainerPort(cwd, config) {
+  const dockerfilePath = path.join(cwd, 'Dockerfile');
+  if (await fs.pathExists(dockerfilePath)) {
+    try {
+      const content = await fs.readFile(dockerfilePath, 'utf8');
+      const exposed = parseDockerfileExposePort(content);
+      if (exposed != null) {
+        return { port: exposed, source: 'expose' };
+      }
+    } catch {
+      // treat as unparseable / unreadable → continue
+    }
+  }
+
+  if (config.projectType === 'both' && config.backend?.port) {
+    return { port: Number(config.backend.port), source: 'config' };
+  }
+  if (config.port) {
+    return { port: Number(config.port), source: 'config' };
+  }
+  if (config.backend?.port) {
+    return { port: Number(config.backend.port), source: 'config' };
+  }
+
+  return { port: resolveFallbackContainerPort(config), source: 'fallback' };
+}
+
+export default {
+  parseDockerfileExposePort,
+  resolveFallbackContainerPort,
+  resolveContainerPort,
+};

package/src/utils/kubernetes-manifests.js

@@ -1,5 +1,6 @@
 import fs from 'fs-extra';
 import path from 'path';
+import { resolveContainerPort } from './dockerfile-expose.js';
 
 /**
  * @param {string} name
@@ -65,6 +66,11 @@ export function generateKubernetesManifests({
     ? `      imagePullSecrets:\n      - name: ${imagePullSecret}\n`
     : '';
 
+  // Service port stays 80 (Ingress-friendly cluster-facing port).
+  // containerPort / targetPort must match the container's listening port (EXPOSE).
+  const servicePort = 80;
+  const targetPort = port;
+
   const deploymentYaml = `apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -96,9 +102,6 @@ ${pullSecretBlock}      containers:
             cpu: "500m"
 `;
 
-  const servicePort = port === 80 ? 80 : 80;
-  const targetPort = port;
-
   const serviceYaml = `apiVersion: v1
 kind: Service
 metadata:
@@ -116,12 +119,29 @@ spec:
   return { deploymentYaml, serviceYaml };
 }
 
+/**
+ * Surgically update only containerPort / targetPort in manifest YAML.
+ * Does not change Service `port:`, replicas, resources, env, probes, etc.
+ *
+ * @param {string} yaml
+ * @param {number} port
+ * @returns {{ content: string, changed: boolean }}
+ */
+export function patchKubernetesManifestPorts(yaml, port) {
+  const next = String(yaml)
+    .replace(/^([ \t]*-?[ \t]*containerPort:[ \t]*)\d+[ \t]*$/gm, `$1${port}`)
+    .replace(/^([ \t]*targetPort:[ \t]*)\d+[ \t]*$/gm, `$1${port}`);
+
+  return { content: next, changed: next !== yaml };
+}
+
 /**
  * @param {import('../core/config.js').DeployHubConfig} config
  * @param {Record<string, Record<string, unknown>>} [environments]
+ * @param {{ port?: number }} [options]
  * @returns {{ appName: string, imageName: string, imageTag: string, port: number, namespace: string, imagePullSecret: string }}
  */
-export function resolveKubernetesManifestOptions(config, environments = {}) {
+export function resolveKubernetesManifestOptions(config, environments = {}, options = {}) {
   const envList = Object.values(environments);
   const k8sEnv = envList.find((env) => env.type === 'kubernetes') || {};
 
@@ -142,13 +162,18 @@ export function resolveKubernetesManifestOptions(config, environments = {}) {
     process.env.KUBE_IMAGE_PULL_SECRET ||
     '';
 
-  let port = 3000;
-  if (config.projectType === 'both' && config.backend?.port) {
-    port = config.backend.port;
+  /** @type {number} */
+  let port;
+  if (typeof options.port === 'number' && Number.isFinite(options.port)) {
+    port = options.port;
+  } else if (config.projectType === 'both' && config.backend?.port) {
+    port = Number(config.backend.port);
   } else if (config.port) {
-    port = config.port;
+    port = Number(config.port);
   } else if (config.backend?.port) {
-    port = config.backend.port;
+    port = Number(config.backend.port);
+  } else {
+    port = 3000;
   }
 
   return {
@@ -161,9 +186,77 @@ export function resolveKubernetesManifestOptions(config, environments = {}) {
   };
 }
 
+/**
+ * Resolve manifest options with Dockerfile EXPOSE → config → fallback port.
+ *
+ * @param {string} cwd
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {Record<string, Record<string, unknown>>} [environments]
+ */
+export async function resolveKubernetesManifestOptionsFromCwd(
+  cwd,
+  config,
+  environments = {}
+) {
+  const { port, source } = await resolveContainerPort(cwd, config);
+  return {
+    ...resolveKubernetesManifestOptions(config, environments, { port }),
+    portSource: source,
+  };
+}
+
+/**
+ * Paths DeployHub normally writes for Kubernetes starter manifests.
+ * @param {string} cwd
+ * @returns {{ deploymentPath: string, servicePath: string }}
+ */
+export function getDefaultKubernetesManifestPaths(cwd) {
+  const k8sDir = path.join(cwd, 'k8s');
+  return {
+    deploymentPath: path.join(k8sDir, 'deployment.yaml'),
+    servicePath: path.join(k8sDir, 'service.yaml'),
+  };
+}
+
+/**
+ * Patch containerPort/targetPort in existing k8s/deployment.yaml + service.yaml only.
+ *
+ * @param {string} cwd
+ * @param {number} port
+ * @returns {Promise<{ patched: string[], skipped: string[], port: number }>}
+ */
+export async function syncKubernetesManifestPorts(cwd, port) {
+  const { deploymentPath, servicePath } = getDefaultKubernetesManifestPaths(cwd);
+  /** @type {string[]} */
+  const patched = [];
+  /** @type {string[]} */
+  const skipped = [];
+
+  for (const filePath of [deploymentPath, servicePath]) {
+    if (!(await fs.pathExists(filePath))) {
+      skipped.push(path.relative(cwd, filePath));
+      continue;
+    }
+    const original = await fs.readFile(filePath, 'utf8');
+    const { content, changed } = patchKubernetesManifestPorts(original, port);
+    if (changed) {
+      await fs.writeFile(filePath, content);
+      patched.push(path.relative(cwd, filePath));
+    } else {
+      skipped.push(path.relative(cwd, filePath));
+    }
+  }
+
+  return { patched, skipped, port };
+}
+
 export default {
   sanitizeK8sName,
   hasKubernetesManifests,
   generateKubernetesManifests,
+  patchKubernetesManifestPorts,
   resolveKubernetesManifestOptions,
+  resolveKubernetesManifestOptionsFromCwd,
+  getDefaultKubernetesManifestPaths,
+  syncKubernetesManifestPorts,
 };

package/src/utils/scaffold.js

@@ -10,7 +10,7 @@ import {
 import {
   generateKubernetesManifests,
   hasKubernetesManifests,
-  resolveKubernetesManifestOptions,
+  resolveKubernetesManifestOptionsFromCwd,
 } from './kubernetes-manifests.js';
 
 /**
@@ -134,7 +134,11 @@ export async function ensureKubernetesManifests(
     return { generated: false };
   }
 
-  const manifestOptions = resolveKubernetesManifestOptions(config, environments);
+  const manifestOptions = await resolveKubernetesManifestOptionsFromCwd(
+    cwd,
+    config,
+    environments
+  );
   const { deploymentYaml, serviceYaml } = generateKubernetesManifests(manifestOptions);
 
   const k8sDir = path.join(cwd, 'k8s');