@deployfoundation/foundation-deploy 0.1.0

package/src/deploy/deploy.ts

@@ -0,0 +1,566 @@
+/**
+ * Deploy one instance: build and push the agent image, `cdk deploy --all`,
+ * refresh the runtime secret, sync config.
+ *
+ *   foundation-deploy deploy --instance .foundation/instance.yaml
+ *   foundation-deploy deploy --instance … --skip-image --tag abc1234
+ *   foundation-deploy deploy --instance … --phase1
+ *
+ * Two-phase bootstrap: the AgentCore Runtime validates its container URI when
+ * it is created, so the ECR repository must exist and hold the image first.
+ * `--phase1` deploys everything except the runtime (`-c deployRuntime=false`);
+ * a plain `deploy` afterwards builds, pushes and creates it.
+ */
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import {
+  parseKnockOAuthClient,
+  registerKnockPublicClient,
+} from "@deployfoundation/foundation-connectors";
+import { type AwsContext, aws, cdkEnv, putSecretJson, readSecretJson, stackOutput } from "./aws.ts";
+import { configSync } from "./config-sync.ts";
+import { adminsCsvFromFile } from "./config.ts";
+import {
+  cliRunner,
+  currentRuntimeVersion,
+  promoteEndpoint,
+  runtimeIdFromArn,
+  smokeInvoke,
+  smokeSessionId,
+} from "./endpoint.ts";
+import { currentImageTag, ecrImageExists, registryOf } from "./image.ts";
+import { secretsManagerLicenseCache } from "./license-cache.ts";
+import {
+  type LicenseResult,
+  type VerifyLicenseOptions,
+  plannedLicenseCheck,
+  verifyLicense,
+} from "./license.ts";
+import { AGENT_DOCKERFILE, FOUNDATION_ROOT, INFRA_ROOT } from "./paths.ts";
+import {
+  type ReleaseRequest,
+  type ResolvedRelease,
+  releaseContext,
+  resolveRelease,
+  toolVersion,
+} from "./release.ts";
+import { type SlackAppSecret, composeRuntimeSecret } from "./runtime-secret.ts";
+import { run } from "./sh.ts";
+import { stageCustomization } from "./stage-customization.ts";
+
+/**
+ * The `--cache-from`/`--cache-to` flags for a cache mode, or `undefined` when
+ * the mode is not a buildx one at all (a laptop, which uses `docker build`).
+ * `local` carries no flags: CodeBuild's own local layer cache is the whole
+ * mechanism, and there is nowhere to export to.
+ */
+export function buildxCacheFlags(mode: string, scope: string): string[] | undefined {
+  if (mode === "gha")
+    return [
+      "--cache-from",
+      `type=gha,scope=${scope}`,
+      "--cache-to",
+      `type=gha,scope=${scope},mode=max`,
+    ];
+  if (mode === "local") return [];
+  return undefined;
+}
+
+/**
+ * Build the arm64 agent image (AgentCore runs arm64 only) and push it.
+ * Returns the full image reference that was pushed.
+ */
+export async function buildAndPushImage(
+  ctx: AwsContext,
+  opts: {
+    tag: string;
+    /** Foundation checkout the image is built from; overridable for tests. */
+    foundationRoot?: string;
+    repositoryUri?: string;
+    /** Test seam for the ECR lookup below. */
+    imageExists?: typeof ecrImageExists;
+  },
+): Promise<string> {
+  const foundationRoot = opts.foundationRoot ?? FOUNDATION_ROOT;
+  const repositoryUri =
+    opts.repositoryUri ?? (await stackOutput(ctx, ctx.names.agent, "RepositoryUri"));
+  const registry = registryOf(repositoryUri);
+  const image = `${repositoryUri}:${opts.tag}`;
+
+  // The tag is the commit sha and ECR tags are immutable, so re-running a
+  // failed deploy job would otherwise die on the push rather than on whatever
+  // actually failed. The existing image is this commit's image; use it.
+  const exists = await (opts.imageExists ?? ecrImageExists)(ctx, {
+    repositoryName: ctx.names.ecrRepo,
+    tag: opts.tag,
+  });
+  if (exists) {
+    console.log(`  image_tag_exists ${image} — skipping the build and push`);
+    return image;
+  }
+
+  // A dry run must not mint a registry token or read the App id.
+  const password =
+    ctx.dryRun === true ? "<ecr-token>" : await aws(ctx, ["ecr", "get-login-password"]);
+  await run(["docker", "login", "--username", "AWS", "--password-stdin", registry], {
+    stdin: password,
+    dryRun: ctx.dryRun,
+  });
+
+  // The App id is compiled into the image's git credential helper; it is not
+  // a secret (the private key stays in Secrets Manager) but it is not public
+  // either, so it comes from the secret rather than a checked-in constant.
+  const { app_id } =
+    ctx.dryRun === true
+      ? { app_id: `<${ctx.names.secretGithubApp}.app_id>` }
+      : await readSecretJson<{ app_id: string }>(ctx, ctx.names.secretGithubApp);
+  // How the layer cache is kept, by deployer:
+  //
+  //   gha    GitHub Actions. buildx exports the cache to the Actions cache, so
+  //          an unchanged gh/Go stage is a hit instead of a multi-minute
+  //          rebuild. (An ECR `buildcache` tag was tried first: the repository
+  //          has immutable tags, so the second export failed.)
+  //   local  CodeBuild. The Actions cache backend does not exist there, so the
+  //          build exports nothing and relies on the project's own
+  //          LOCAL_DOCKER_LAYER_CACHE — best effort and free, warm on a
+  //          re-used build host and cold otherwise. buildx still, because
+  //          `--push` in one step is what keeps this identical to `gha`.
+  //   unset  A laptop. The plain daemon cache is fine, so `docker build` and
+  //          `docker push` stay as they were.
+  const cacheMode = process.env.FOUNDATION_IMAGE_CACHE ?? "";
+  const buildArgs = [
+    "--platform",
+    "linux/arm64",
+    "--build-arg",
+    `FOUNDATION_GITHUB_APP_ID=${app_id}`,
+    "-f",
+    AGENT_DOCKERFILE,
+    "-t",
+    image,
+  ];
+  const cacheFlags = buildxCacheFlags(cacheMode, ctx.names.ecrRepo);
+  if (cacheFlags !== undefined) {
+    await run(["docker", "buildx", "build", ...buildArgs, ...cacheFlags, "--push", "."], {
+      cwd: foundationRoot,
+      dryRun: ctx.dryRun,
+    });
+  } else {
+    await run(["docker", "build", ...buildArgs, "."], {
+      cwd: foundationRoot,
+      dryRun: ctx.dryRun,
+    });
+    await run(["docker", "push", image], { dryRun: ctx.dryRun });
+  }
+  return image;
+}
+
+/**
+ * The DLQ alarm subscriber: an explicit flag, then `FOUNDATION_ALARM_EMAIL`, then the
+ * instance's own address. An instance with none gets no email hop.
+ */
+export function alarmEmailFor(ctx: AwsContext, explicit?: string): string {
+  return explicit ?? process.env.FOUNDATION_ALARM_EMAIL ?? ctx.instance.aws.alarmEmail ?? "";
+}
+
+/**
+ * How the CDK CLI is invoked.
+ *
+ * Resolved through this package's own dependency on `aws-cdk` rather than
+ * through PATH: the tool runs from a Foundation checkout, from a CodeBuild
+ * container and from `npx @deployfoundation/foundation-deploy`, and only the first of
+ * those has `bunx cdk` meaning anything predictable. `process.execPath` is
+ * whichever runtime is already running this — Bun in a checkout, node under
+ * npx — and both execute the CLI's entry file.
+ */
+export function cdkCommand(): string[] {
+  try {
+    return [process.execPath, createRequire(import.meta.url).resolve("aws-cdk/bin/cdk")];
+  } catch {
+    return ["bunx", "cdk"];
+  }
+}
+
+/**
+ * The CDK app itself: `--app` rather than whatever `cdk.json` says.
+ *
+ * The published package carries the app as bundled JavaScript under `dist/`
+ * and cannot assume Bun is installed; a checkout runs the TypeScript directly.
+ * One `cdk.json` cannot say both, and passing `--app` explicitly means the
+ * command in a deploy log names the file that actually ran.
+ *
+ * The TypeScript wins where it exists, so a contributor who ran the build once
+ * does not silently keep deploying that stale bundle. It exists only in a
+ * checkout: `bin/` is not published.
+ */
+export function cdkAppCommand(infraRoot: string = INFRA_ROOT): string {
+  const source = join(infraRoot, "bin", "app.ts");
+  if (existsSync(source)) return `bun run ${source}`;
+  return `${process.execPath} ${join(infraRoot, "dist", "bin", "app.js")}`;
+}
+
+export interface CdkDeployOptions {
+  admins: string;
+  alarmEmail: string;
+  tag?: string;
+  phase1?: boolean;
+  /** A verified release; its manifest is what the app reads its artifacts from. */
+  release?: ResolvedRelease;
+}
+
+export async function cdkDeploy(ctx: AwsContext, opts: CdkDeployOptions): Promise<void> {
+  const context = [
+    // The CDK app's only required input: the path to the instance file this
+    // command was given. No instance name, no `instances/` lookup.
+    "-c",
+    `instanceFile=${ctx.paths.path}`,
+    "-c",
+    `admins=${opts.admins}`,
+    // Omitted rather than empty when the instance names no address: the API
+    // stack treats a missing alarmEmail as "no email subscription".
+    ...(opts.alarmEmail === "" ? [] : ["-c", `alarmEmail=${opts.alarmEmail}`]),
+    ...(opts.phase1 === true ? ["-c", "deployRuntime=false"] : []),
+    // A release names the image by digest, so there is no tag to pass.
+    ...(opts.tag === undefined || opts.release !== undefined
+      ? []
+      : ["-c", `agentImageTag=${opts.tag}`]),
+    ...(opts.release === undefined ? [] : releaseContext(opts.release)),
+  ];
+  await run(
+    [
+      ...cdkCommand(),
+      "deploy",
+      "--all",
+      "--app",
+      cdkAppCommand(),
+      "--require-approval",
+      "never",
+      ...context,
+    ],
+    {
+      cwd: INFRA_ROOT,
+      env: cdkEnv(ctx),
+      dryRun: ctx.dryRun,
+    },
+  );
+}
+
+/** A stack output that may not exist yet (a stack deployed before it was added). */
+async function optionalOutput(
+  ctx: AwsContext,
+  stack: string,
+  key: string,
+): Promise<string | undefined> {
+  try {
+    return await stackOutput(ctx, stack, key);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Register the public Knock client only in the deploy path, after the API
+ * stack has emitted its real callback URL. Slack's command path only reads the
+ * finished `{ client_id, redirect_uri }` secret and never performs DCR.
+ */
+export async function syncKnockOAuthClient(
+  ctx: AwsContext,
+  options: {
+    fetchImpl?: typeof fetch;
+    redirectUri?: string;
+  } = {},
+): Promise<"skipped" | "unchanged" | "registered"> {
+  if (!ctx.instance.integrations.knock) return "skipped";
+  const redirectUri =
+    options.redirectUri ??
+    (ctx.dryRun === true
+      ? `<${ctx.names.api}.KnockOAuthRedirectUrl>`
+      : await stackOutput(ctx, ctx.names.api, "KnockOAuthRedirectUrl"));
+  if (ctx.dryRun === true) {
+    await putSecretJson(ctx, ctx.names.secretKnockOauthClient, {
+      client_id: "<knock-dynamic-client-id>",
+      redirect_uri: redirectUri,
+    });
+    return "registered";
+  }
+  try {
+    const existing = parseKnockOAuthClient(
+      JSON.stringify(await readSecretJson(ctx, ctx.names.secretKnockOauthClient)),
+    );
+    if (existing.redirect_uri === redirectUri) return "unchanged";
+  } catch {
+    // A first-deploy placeholder or stale registration is replaced below.
+  }
+  const client = await registerKnockPublicClient({
+    redirectUri,
+    ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+  });
+  await putSecretJson(ctx, ctx.names.secretKnockOauthClient, {
+    client_id: client.client_id,
+    redirect_uri: client.redirect_uri,
+  });
+  return "registered";
+}
+
+/**
+ * Re-compose the instance's `<prefix>/agent/runtime` from the stack outputs as they stand now.
+ *
+ * The container reads that secret at boot and nothing else, so any output it
+ * carries (the tables, buckets and web search gateway url) goes stale the
+ * moment a stack changes. Running this after EVERY `cdk deploy` — not only in
+ * `setup.ts` — is what keeps the env contract honest.
+ *
+ * Returns the key names written (never the values).
+ */
+export async function syncRuntimeSecret(ctx: AwsContext): Promise<string[]> {
+  const dry = ctx.dryRun === true;
+  const { data, agent, api, secretSlackApp, secretRuntime } = ctx.names;
+  const tableName = dry ? `<${data}.TableName>` : await stackOutput(ctx, data, "TableName");
+  const bucketName = dry ? `<${data}.BucketName>` : await stackOutput(ctx, data, "BucketName");
+  const documentsBucketName = dry
+    ? `<${data}.DocumentsBucketName>`
+    : await optionalOutput(ctx, data, "DocumentsBucketName");
+  const itemsTableName = dry
+    ? `<${data}.ItemsTableName>`
+    : await optionalOutput(ctx, data, "ItemsTableName");
+  const webSearchUrl = dry
+    ? `<${agent}.WebSearchGatewayUrl>`
+    : await optionalOutput(ctx, agent, "WebSearchGatewayUrl");
+  const invokeQueueUrl = dry
+    ? `<${api}.InvokeQueueUrl>`
+    : await optionalOutput(ctx, api, "InvokeQueueUrl");
+  const routineSchedulerRoleArn = dry
+    ? `<${api}.RoutineSchedulerRoleArn>`
+    : await optionalOutput(ctx, api, "RoutineSchedulerRoleArn");
+  const agentRuntimeArn = dry
+    ? `<${agent}.AgentRuntimeArn>`
+    : await optionalOutput(ctx, agent, "AgentRuntimeArn");
+  const readOnlyRoleArn = dry
+    ? `<${agent}.ReadOnlyRoleArn>`
+    : await optionalOutput(ctx, agent, "ReadOnlyRoleArn");
+  const emailProxyFunctionArn = dry
+    ? `<${api}.EmailProxyFunctionArn>`
+    : await optionalOutput(ctx, api, "EmailProxyFunctionArn");
+  const browserProxyFunctionArn = dry
+    ? `<${api}.BrowserProxyFunctionArn>`
+    : await optionalOutput(ctx, api, "BrowserProxyFunctionArn");
+  // CRM is an infrastructure opt-in: do not fabricate a binding for an
+  // instance whose API stack deliberately has no CRM proxy output.
+  const crmProxyFunctionArn = ctx.instance.integrations.crm
+    ? dry
+      ? `<${api}.CrmProxyFunctionArn>`
+      : await optionalOutput(ctx, api, "CrmProxyFunctionArn")
+    : undefined;
+  const crmPolicyFingerprint = ctx.instance.integrations.crm
+    ? dry
+      ? `<${api}.CrmPolicyFingerprint>`
+      : await optionalOutput(ctx, api, "CrmPolicyFingerprint")
+    : undefined;
+  const otterProxyFunctionArn = dry
+    ? `<${api}.OtterProxyFunctionArn>`
+    : await optionalOutput(ctx, api, "OtterProxyFunctionArn");
+  const knockProxyFunctionArn = ctx.instance.integrations.knock
+    ? dry
+      ? `<${api}.KnockProxyFunctionArn>`
+      : await optionalOutput(ctx, api, "KnockProxyFunctionArn")
+    : undefined;
+  const upworkProxyFunctionArn = ctx.instance.integrations.upwork
+    ? dry
+      ? `<${api}.UpworkProxyFunctionArn>`
+      : await optionalOutput(ctx, api, "UpworkProxyFunctionArn")
+    : undefined;
+  const routineIngressFunctionArn = dry
+    ? `<${api}.RoutineIngressFunctionArn>`
+    : await optionalOutput(ctx, api, "RoutineIngressFunctionArn");
+  const slackApp: SlackAppSecret = dry
+    ? {
+        bot_token: `<${secretSlackApp}.bot_token>`,
+        bot_user_id: `<${secretSlackApp}.bot_user_id>`,
+      }
+    : await readSecretJson<SlackAppSecret>(ctx, secretSlackApp);
+
+  const value = composeRuntimeSecret({
+    instance: ctx.instance,
+    slackApp,
+    tableName,
+    bucketName,
+    documentsBucketName,
+    ...(itemsTableName === undefined ? {} : { itemsTableName }),
+    ...(webSearchUrl === undefined ? {} : { webSearchUrl }),
+    ...(invokeQueueUrl === undefined ? {} : { invokeQueueUrl }),
+    ...(routineSchedulerRoleArn === undefined ? {} : { routineSchedulerRoleArn }),
+    ...(agentRuntimeArn === undefined ? {} : { agentRuntimeArn }),
+    ...(readOnlyRoleArn === undefined ? {} : { readOnlyRoleArn }),
+    ...(emailProxyFunctionArn === undefined ? {} : { emailProxyFunctionArn }),
+    ...(browserProxyFunctionArn === undefined ? {} : { browserProxyFunctionArn }),
+    ...(crmProxyFunctionArn === undefined ? {} : { crmProxyFunctionArn }),
+    ...(crmPolicyFingerprint === undefined ? {} : { crmPolicyFingerprint }),
+    ...(otterProxyFunctionArn === undefined ? {} : { otterProxyFunctionArn }),
+    ...(knockProxyFunctionArn === undefined ? {} : { knockProxyFunctionArn }),
+    ...(upworkProxyFunctionArn === undefined ? {} : { upworkProxyFunctionArn }),
+    ...(routineIngressFunctionArn === undefined ? {} : { routineIngressFunctionArn }),
+  });
+  await putSecretJson(ctx, secretRuntime, value);
+  return Object.keys(value);
+}
+
+/**
+ * What the workflow does after a deploy, for a deploy run from a laptop: smoke
+ * the version just created on DEFAULT, move the pinned `live` endpoint onto
+ * it, and smoke `live` once more. Where a deployer runs `scripts/post-deploy.ts`
+ * as its own step — GitHub Actions, and the per-instance CodePipelines — that
+ * step owns the promotion instead (it also runs the filesystem probe), and
+ * this is skipped; see {@link promotesInline}.
+ */
+export async function promoteLive(ctx: AwsContext): Promise<void> {
+  const dry = ctx.dryRun === true;
+  const runner = cliRunner(ctx);
+  const arn = dry
+    ? `<${ctx.names.agent}.AgentRuntimeArn>`
+    : await stackOutput(ctx, ctx.names.agent, "AgentRuntimeArn");
+  const id = dry ? `<${ctx.names.agent}.runtimeId>` : runtimeIdFromArn(arn);
+  const version = dry ? "<version>" : await currentRuntimeVersion(runner, id);
+  await smokeInvoke(runner, {
+    arn,
+    qualifier: "DEFAULT",
+    sessionId: smokeSessionId("deploy-smoke"),
+    dryRun: ctx.dryRun,
+  });
+  await promoteEndpoint(runner, { id, name: "live", version, dryRun: ctx.dryRun });
+  await smokeInvoke(runner, {
+    arn,
+    qualifier: "live",
+    sessionId: smokeSessionId("deploy-live"),
+    dryRun: ctx.dryRun,
+  });
+}
+
+/**
+ * Turn a release request into verified bytes, or into a plan.
+ *
+ * A dry run fetches nothing and verifies nothing — it has no credentials to
+ * do either with — so it reports the release it would have checked and lets
+ * the printed commands show the rest.
+ */
+async function resolveReleaseFor(
+  ctx: AwsContext,
+  opts: DeployOptions,
+): Promise<ResolvedRelease | undefined> {
+  if (opts.release === undefined) return undefined;
+  return (opts.resolveRelease ?? resolveRelease)(ctx, opts.release);
+}
+
+/**
+ * Ask the Foundry 41 endpoint about this instance's license, and say what
+ * came back. Throws when the deploy must not proceed.
+ *
+ * The version sent is the release being deployed, or this tool's own version
+ * for a local build — the two are the same thing from the endpoint's side:
+ * which Foundation is going in.
+ */
+async function checkLicense(
+  ctx: AwsContext,
+  opts: DeployOptions,
+  release: ResolvedRelease | undefined,
+): Promise<void> {
+  const verify = opts.verifyLicense ?? (ctx.dryRun === true ? plannedLicenseCheck : verifyLicense);
+  const result = await verify(ctx.instance.license?.key, {
+    instanceId: ctx.instance.name,
+    version: release?.version ?? `v${toolVersion()}`,
+    cache: secretsManagerLicenseCache(ctx),
+  });
+  console.log(`▶ license: ${result.message}`);
+}
+
+/**
+ * Does this deploy promote `live` itself? Only when nothing else will: GitHub
+ * Actions and the CodePipeline buildspec both run `scripts/post-deploy.ts` as a
+ * separate step, and promoting twice would move the endpoint under a smoke test
+ * that is still running.
+ */
+export function promotesInline(env: Record<string, string | undefined> = process.env): boolean {
+  return env.GITHUB_ACTIONS !== "true" && env.FOUNDATION_SKIP_POST_DEPLOY !== "1";
+}
+
+export interface DeployOptions {
+  tag?: string;
+  skipImage?: boolean;
+  phase1?: boolean;
+  alarmEmail?: string;
+  /** Deploy a published release instead of this checkout. */
+  release?: ReleaseRequest;
+  /** How a release is turned into verified bytes. Overridable for tests. */
+  resolveRelease?: (ctx: AwsContext, request: ReleaseRequest) => Promise<ResolvedRelease>;
+  /** The license check. Overridable for tests; never skipped in a real deploy. */
+  verifyLicense?: (
+    key: string | undefined,
+    options: VerifyLicenseOptions,
+  ) => Promise<LicenseResult>;
+}
+
+export async function deploy(ctx: AwsContext, opts: DeployOptions): Promise<void> {
+  // FIRST, before anything is staged, built, or deployed: prove the release is
+  // Foundation's. Every artifact reference after this point comes out of the
+  // manifest this line verified.
+  const release = await resolveReleaseFor(ctx, opts);
+  if (release !== undefined)
+    console.log(
+      `▶ release ${release.version}${release.manifest === undefined ? " (dry run: not verified)" : " verified"} — ${release.manifestPath}`,
+    );
+
+  // SECOND: is this deployment licensed? A definite "no" stops here; an
+  // unreachable endpoint falls back to this instance's own cached
+  // verification for 30 days, and no key at all is a warning (see license.ts).
+  await checkLicense(ctx, opts, release);
+
+  const customization = stageCustomization({ paths: ctx.paths, dryRun: ctx.dryRun });
+  if (customization.status === "staged") console.log("▶ staged reviewed runtime customization");
+  const admins = adminsCsvFromFile(ctx.paths.configPath);
+  const alarmEmail = alarmEmailFor(ctx, opts.alarmEmail);
+  const phase1 = opts.phase1 === true;
+  // A release carries the image; only a local deploy has a tag to compute.
+  const tag =
+    phase1 || release !== undefined
+      ? undefined
+      : (opts.tag ?? (await currentImageTag(FOUNDATION_ROOT)));
+
+  if (!phase1 && release === undefined && opts.skipImage !== true && tag !== undefined) {
+    console.log(`▶ build + push agent image (${tag})`);
+    console.log(`  ${await buildAndPushImage(ctx, { tag })}`);
+  }
+  console.log(
+    `▶ cdk deploy --all${
+      phase1
+        ? " (phase 1: no runtime)"
+        : release !== undefined
+          ? ` (release ${release.version})`
+          : ` (image ${tag})`
+    }`,
+  );
+  await cdkDeploy(ctx, {
+    admins,
+    alarmEmail,
+    tag,
+    phase1,
+    ...(release === undefined ? {} : { release }),
+  });
+  if (ctx.instance.integrations.knock) {
+    console.log(`▶ Knock OAuth public-client registration (${ctx.names.secretKnockOauthClient})`);
+    console.log(`  ${await syncKnockOAuthClient(ctx)}`);
+  }
+
+  console.log(`▶ runtime secret refresh (${ctx.names.secretRuntime})`);
+  console.log(`  keys: ${(await syncRuntimeSecret(ctx)).join(", ")}`);
+
+  console.log("▶ config sync");
+  const bucket = await configSync(ctx, {
+    runtimeConfigPath: customization.runtimeConfigPath,
+    ...(release === undefined ? {} : { release }),
+  });
+  console.log(`config + skills synced to s3://${bucket}/`);
+
+  if (!phase1 && promotesInline()) {
+    console.log("▶ smoke test, then promote the `live` endpoint");
+    await promoteLive(ctx);
+  }
+}