@rizom/ops 0.2.0-alpha.141 → 0.2.0-alpha.143

package/dist/load-registry.d.ts

@@ -38,6 +38,11 @@ export interface ResolvedAtprotoConfig {
 export interface ResolvedPlaybooksConfig {
     onboarding?: boolean | undefined;
 }
+export interface ResolvedSiteOverride {
+    package: string;
+    version: string;
+    theme?: string | undefined;
+}
 export interface ResolvedUserIdentity {
     handle: string;
     cohort: string;
@@ -45,7 +50,10 @@ export interface ResolvedUserIdentity {
     model: "rover";
     preset: PilotPreset;
     domain: string;
+    cloudflareZoneId?: string | undefined;
     contentRepo: string;
+    addOverride?: string[];
+    siteOverride?: ResolvedSiteOverride;
     discordEnabled: boolean;
     discordAnchorUserId?: string;
     effectiveAiApiKey: string;

package/dist/parse-args.d.ts

@@ -8,6 +8,7 @@ export interface ParsedArgs {
         pushTo?: string | undefined;
         cohort?: string | undefined;
         anchorId?: string | undefined;
+        handle?: string | undefined;
     };
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/schema.d.ts

@@ -1,5 +1,9 @@
 import { z } from "@brains/utils/zod";
-export declare const presetSchema: z.ZodEnum<["core", "default", "pro"]>;
+export declare const presetSchema: z.ZodEnum<{
+    core: "core";
+    default: "default";
+    pro: "pro";
+}>;
 export declare const exactVersionSchema: z.ZodString;
 export declare const handleSchema: z.ZodString;
 export declare const secretNameSchema: z.ZodString;
@@ -11,209 +15,76 @@ export declare const pilotSchema: z.ZodObject<{
     githubOrg: z.ZodString;
     contentRepoPrefix: z.ZodString;
     domainSuffix: z.ZodString;
-    preset: z.ZodEnum<["core", "default", "pro"]>;
+    preset: typeof presetSchema;
     aiApiKey: z.ZodString;
     gitSyncToken: z.ZodString;
     contentRepoAdminToken: z.ZodString;
     agePublicKey: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    agePublicKey: string;
-    schemaVersion: 1;
-    brainVersion: string;
-    model: "rover";
-    githubOrg: string;
-    contentRepoPrefix: string;
-    domainSuffix: string;
-    preset: "default" | "core" | "pro";
-    aiApiKey: string;
-    gitSyncToken: string;
-    contentRepoAdminToken: string;
-}, {
-    agePublicKey: string;
-    schemaVersion: 1;
-    brainVersion: string;
-    model: "rover";
-    githubOrg: string;
-    contentRepoPrefix: string;
-    domainSuffix: string;
-    preset: "default" | "core" | "pro";
-    aiApiKey: string;
-    gitSyncToken: string;
-    contentRepoAdminToken: string;
+}>;
+declare const anchorProfileSocialLinkSchema: z.ZodObject<{
+    platform: z.ZodEnum<{
+        github: "github";
+        instagram: "instagram";
+        linkedin: "linkedin";
+        email: "email";
+        website: "website";
+    }>;
+    url: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+}>;
+declare const anchorProfileSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    website: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    story: z.ZodOptional<z.ZodString>;
+    socialLinks: z.ZodOptional<z.ZodArray<typeof anchorProfileSocialLinkSchema>>;
+}>;
+declare const setupDeliverySchema: z.ZodObject<{
+    delivery: z.ZodLiteral<"email">;
+    email: z.ZodString;
+}>;
+declare const atprotoSchema: z.ZodObject<{
+    identifier: z.ZodString;
+}>;
+declare const siteOverrideSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: typeof exactVersionSchema;
+    theme: z.ZodOptional<z.ZodString>;
+}>;
+declare const playbooksSchema: z.ZodObject<{
+    onboarding: z.ZodOptional<z.ZodBoolean>;
 }>;
 export declare const userSchema: z.ZodObject<{
     handle: z.ZodString;
     discord: z.ZodObject<{
         enabled: z.ZodBoolean;
         anchorUserId: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    }, {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
     }>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-    setup: z.ZodOptional<z.ZodObject<{
-        delivery: z.ZodLiteral<"email">;
-        email: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        email: string;
-        delivery: "email";
-    }, {
-        email: string;
-        delivery: "email";
-    }>>;
-    atproto: z.ZodOptional<z.ZodObject<{
-        identifier: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        identifier: string;
-    }, {
-        identifier: string;
-    }>>;
-    playbooks: z.ZodOptional<z.ZodObject<{
-        onboarding: z.ZodOptional<z.ZodBoolean>;
-    }, "strict", z.ZodTypeAny, {
-        onboarding?: boolean | undefined;
-    }, {
-        onboarding?: boolean | undefined;
-    }>>;
-    anchorProfile: z.ZodOptional<z.ZodObject<{
-        name: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        website: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        story: z.ZodOptional<z.ZodString>;
-        socialLinks: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            platform: z.ZodEnum<["github", "instagram", "linkedin", "email", "website"]>;
-            url: z.ZodString;
-            label: z.ZodOptional<z.ZodString>;
-        }, "strict", z.ZodTypeAny, {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }, {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }>, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }[] | undefined;
-    }, {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }[] | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    handle: string;
-    discord: {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    };
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    setup?: {
-        email: string;
-        delivery: "email";
-    } | undefined;
-    atproto?: {
-        identifier: string;
-    } | undefined;
-    playbooks?: {
-        onboarding?: boolean | undefined;
-    } | undefined;
-    anchorProfile?: {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }[] | undefined;
-    } | undefined;
-}, {
-    handle: string;
-    discord: {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    };
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    setup?: {
-        email: string;
-        delivery: "email";
-    } | undefined;
-    atproto?: {
-        identifier: string;
-    } | undefined;
-    playbooks?: {
-        onboarding?: boolean | undefined;
-    } | undefined;
-    anchorProfile?: {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            url: string;
-            label?: string | undefined;
-        }[] | undefined;
-    } | undefined;
+    domainOverride: z.ZodOptional<z.ZodString>;
+    cloudflareZoneId: z.ZodOptional<z.ZodString>;
+    contentRepoOverride: z.ZodOptional<z.ZodString>;
+    addOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    siteOverride: z.ZodOptional<typeof siteOverrideSchema>;
+    setup: z.ZodOptional<typeof setupDeliverySchema>;
+    atproto: z.ZodOptional<typeof atprotoSchema>;
+    playbooks: z.ZodOptional<typeof playbooksSchema>;
+    anchorProfile: z.ZodOptional<typeof anchorProfileSchema>;
 }>;
-export declare const cohortSchema: z.ZodEffects<z.ZodObject<{
-    members: z.ZodArray<z.ZodString, "many">;
+export declare const cohortSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodString>;
     brainVersionOverride: z.ZodOptional<z.ZodString>;
-    presetOverride: z.ZodOptional<z.ZodEnum<["core", "default", "pro"]>>;
+    presetOverride: z.ZodOptional<typeof presetSchema>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}>, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
 }>;
-export type PilotConfig = z.infer<typeof pilotSchema>;
-export type UserConfig = z.infer<typeof userSchema>;
-export type CohortConfig = z.infer<typeof cohortSchema>;
-export type PilotPreset = z.infer<typeof presetSchema>;
+export type PilotConfig = z.output<typeof pilotSchema>;
+export type PilotConfigInput = z.input<typeof pilotSchema>;
+export type UserConfig = z.output<typeof userSchema>;
+export type UserConfigInput = z.input<typeof userSchema>;
+export type CohortConfig = z.output<typeof cohortSchema>;
+export type CohortConfigInput = z.input<typeof cohortSchema>;
+export type PilotPreset = z.output<typeof presetSchema>;
+export {};

package/dist/secrets-encrypt.d.ts

@@ -4,18 +4,8 @@ declare const encryptedUserSecretsSchema: z.ZodObject<{
     discordBotToken: z.ZodOptional<z.ZodString>;
     aiApiKey: z.ZodOptional<z.ZodString>;
     atprotoAppPassword: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    aiApiKey?: string | undefined;
-    gitSyncToken?: string | undefined;
-    discordBotToken?: string | undefined;
-    atprotoAppPassword?: string | undefined;
-}, {
-    aiApiKey?: string | undefined;
-    gitSyncToken?: string | undefined;
-    discordBotToken?: string | undefined;
-    atprotoAppPassword?: string | undefined;
 }>;
-export type EncryptedUserSecrets = z.infer<typeof encryptedUserSecretsSchema>;
+export type EncryptedUserSecrets = z.output<typeof encryptedUserSecretsSchema>;
 export interface SecretsEncryptOptions {
     env?: NodeJS.ProcessEnv | undefined;
     logger?: ((message: string) => void) | undefined;

package/package.json

@@ -1,69 +1,69 @@
 {
   "name": "@rizom/ops",
+  "version": "0.2.0-alpha.143",
   "description": "Operator CLI for managing private brain fleet registry repos",
-  "publishConfig": {
-    "access": "public"
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ],
+  "license": "Apache-2.0",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "dependencies": {
+    "age-encryption": "^0.3.0"
+  },
+  "devDependencies": {
+    "@brains/deploy-support": "workspace:*",
+    "@brains/eslint-config": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "bun": ">=1.3.3"
   },
-  "version": "0.2.0-alpha.141",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./deploy": {
-      "bun": "./dist/deploy.js",
       "types": "./dist/deploy.d.ts",
-      "import": "./dist/deploy.js"
+      "import": "./dist/deploy.js",
+      "bun": "./dist/deploy.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "brains-ops": "./dist/brains-ops.js"
-  },
   "files": [
     "dist",
     "templates"
   ],
-  "scripts": {
-    "build": "bun scripts/build.ts",
-    "prepublishOnly": "bun scripts/build.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts,.tsx --max-warnings 0",
-    "lint:fix": "eslint . --ext .ts,.tsx --max-warnings 0 --fix",
-    "test": "bun run build && bun test --timeout 20000",
-    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000"
-  },
-  "dependencies": {
-    "age-encryption": "^0.3.0"
-  },
-  "devDependencies": {
-    "@brains/deploy-support": "workspace:*",
-    "@brains/eslint-config": "workspace:*",
-    "@brains/typescript-config": "workspace:*",
-    "@brains/utils": "workspace:*",
-    "@types/bun": "latest",
-    "typescript": "^5.3.3"
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "main": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/rizom-ai/brains.git",
     "directory": "packages/brains-ops"
   },
-  "license": "Apache-2.0",
-  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
-  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
-  "bugs": "https://github.com/rizom-ai/brains/issues",
-  "engines": {
-    "bun": ">=1.3.3"
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --max-warnings 0 --fix",
+    "prepublishOnly": "bun scripts/build.ts",
+    "test": "bun run build && bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",
+    "typecheck": "tsc --noEmit"
   },
-  "keywords": [
-    "brains",
-    "ops",
-    "cli",
-    "deploy",
-    "fleet",
-    "operator"
-  ]
+  "type": "module",
+  "types": "./dist/index.d.ts"
 }

package/templates/rover-pilot/.github/workflows/build.yml

@@ -11,6 +11,10 @@ on:
     branches: ["main"]
     paths:
       - pilot.yaml
+      - cohorts/*.yaml
+      - users/*.yaml
+      - package.json
+      - bun.lock
       - deploy/**
       - .github/workflows/build.yml
 
@@ -26,17 +30,16 @@ jobs:
         with:
           ref: ${{ github.sha }}
 
-      - name: Extract image metadata inputs
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install operator tooling
+        run: bun install
+
+      - name: Resolve image metadata inputs
+        env:
+          BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
         run: |
-          BRAIN_VERSION="${{ inputs.brain_version || '' }}"
-          if [ -z "$BRAIN_VERSION" ]; then
-            BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
-          fi
-          if [ -z "$BRAIN_VERSION" ]; then
-            echo "Missing brainVersion in pilot.yaml" >&2
-            exit 1
-          fi
-          echo "BRAIN_VERSION=$BRAIN_VERSION" >> "$GITHUB_ENV"
+          bun deploy/scripts/resolve-build-config.ts
           echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
@@ -48,7 +51,7 @@ jobs:
         with:
           images: ${{ env.IMAGE_REPOSITORY }}
           tags: |
-            type=raw,value=brain-${{ env.BRAIN_VERSION }}
+            type=raw,value=${{ env.IMAGE_TAG }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -66,6 +69,7 @@ jobs:
           push: true
           build-args: |
             BRAIN_VERSION=${{ env.BRAIN_VERSION }}
+            SITE_PACKAGES=${{ env.SITE_PACKAGES }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -10,6 +10,7 @@ on:
   push:
     branches: ["main"]
     paths:
+      - users/*.yaml
       - users/*/.env
       - users/*/brain.yaml
       - users/*/content/**
@@ -112,12 +113,16 @@ jobs:
           KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
           KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
           CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
+          CONFIG_CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
+          SHARED_CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          SHARED_CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
+          SHARED_PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
         run: |
           export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
           export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
+          export CF_ZONE_ID="${CONFIG_CF_ZONE_ID:-${CF_ZONE_ID:-$SHARED_CF_ZONE_ID}}"
+          export CERTIFICATE_PEM="${CERTIFICATE_PEM:-$SHARED_CERTIFICATE_PEM}"
+          export PRIVATE_KEY_PEM="${PRIVATE_KEY_PEM:-$SHARED_PRIVATE_KEY_PEM}"
           bun deploy/scripts/validate-secrets.ts
 
       - name: Seed content repo
@@ -137,7 +142,7 @@ jobs:
 
       - name: Wait for shared image tag
         run: |
-          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:brain-${{ steps.user_config.outputs.brain_version }}"
+          IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:${{ steps.user_config.outputs.image_tag }}"
           for attempt in $(seq 1 24); do
             if docker manifest inspect "$IMAGE_TAG" >/dev/null 2>&1; then
               exit 0
@@ -178,11 +183,13 @@ jobs:
           SETUP_EMAIL_API_KEY: ${{ secrets.SETUP_EMAIL_API_KEY }}
           SETUP_EMAIL_FROM: ${{ secrets.SETUP_EMAIL_FROM }}
           KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
+          SHARED_CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
+          SHARED_PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
         run: |
           export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
           export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
+          export CERTIFICATE_PEM="${CERTIFICATE_PEM:-$SHARED_CERTIFICATE_PEM}"
+          export PRIVATE_KEY_PEM="${PRIVATE_KEY_PEM:-$SHARED_PRIVATE_KEY_PEM}"
           bun deploy/scripts/write-kamal-secrets.ts
 
       - name: Provision server
@@ -198,12 +205,18 @@ jobs:
       - name: Update Cloudflare DNS
         env:
           CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          CONFIG_CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
+          SHARED_CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
         run: |
+          export CF_ZONE_ID="${CONFIG_CF_ZONE_ID:-${CF_ZONE_ID:-$SHARED_CF_ZONE_ID}}"
           bun deploy/scripts/update-dns.ts
+          if [ -n "$WWW_DOMAIN" ]; then
+            BRAIN_DOMAIN="$WWW_DOMAIN" bun deploy/scripts/update-dns.ts
+          fi
           BRAIN_DOMAIN="$PREVIEW_DOMAIN" bun deploy/scripts/update-dns.ts
 
       - name: Validate SSH key
@@ -227,10 +240,11 @@ jobs:
       - name: Deploy
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
-          VERSION: brain-${{ steps.user_config.outputs.brain_version }}
+          VERSION: ${{ steps.user_config.outputs.image_tag }}
           IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
           REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
         run: kamal setup --skip-push -c deploy/kamal/deploy.yml
@@ -239,9 +253,13 @@ jobs:
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
+          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
         run: |
           curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
+          if [ -n "$WWW_DOMAIN" ]; then
+            curl -I -k --max-time 20 --resolve "$WWW_DOMAIN:443:$SERVER_IP" "https://$WWW_DOMAIN/"
+          fi
           curl -I -k --max-time 20 --resolve "$PREVIEW_DOMAIN:443:$SERVER_IP" "https://$PREVIEW_DOMAIN/"
 
       - name: Upload generated config

package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts

@@ -22,6 +22,14 @@ writeGitHubEnv("AI_API_KEY", secrets["aiApiKey"] ?? "");
 writeGitHubEnv("GIT_SYNC_TOKEN", secrets["gitSyncToken"] ?? "");
 writeGitHubEnv("DISCORD_BOT_TOKEN", secrets["discordBotToken"] ?? "");
 writeGitHubEnv("ATPROTO_APP_PASSWORD", secrets["atprotoAppPassword"] ?? "");
+writeGitHubEnv(
+  "CERTIFICATE_PEM",
+  decodeEscapedSecret(secrets["certificatePem"]),
+);
+writeGitHubEnv(
+  "PRIVATE_KEY_PEM",
+  decodeEscapedSecret(secrets["privateKeyPem"]),
+);
 
 writeGitHubOutput(
   "shared_ai_api_key_secret_name",
@@ -66,6 +74,10 @@ function parseFlatYaml(contents: string): Record<string, string> {
   return result;
 }
 
+function decodeEscapedSecret(value: string | undefined): string {
+  return value?.replace(/\\n/g, "\n") ?? "";
+}
+
 function requireFlatValue(
   values: Record<string, string>,
   key: string,

package/templates/rover-pilot/deploy/scripts/resolve-build-config.ts

@@ -0,0 +1,53 @@
+#!/usr/bin/env bun
+import { createHash } from "node:crypto";
+import { loadPilotRegistry } from "@rizom/ops";
+import { writeGitHubEnv, writeGitHubOutput } from "./helpers";
+
+const requestedBrainVersion = process.env["BRAIN_VERSION_INPUT"]?.trim();
+const registry = await loadPilotRegistry(process.cwd());
+const brainVersion =
+  requestedBrainVersion && requestedBrainVersion.length > 0
+    ? requestedBrainVersion
+    : registry.pilot.brainVersion;
+
+const sitePackages = [
+  ...new Set(
+    registry.users
+      .filter((user) => user.brainVersion === brainVersion)
+      .flatMap((user) =>
+        user.siteOverride
+          ? [`${user.siteOverride.package}@${user.siteOverride.version}`]
+          : [],
+      ),
+  ),
+].sort();
+const sitePackagesValue = sitePackages.join(" ");
+const imageTag = buildImageTag(brainVersion, sitePackages);
+
+writeGitHubEnv("BRAIN_VERSION", brainVersion);
+writeGitHubEnv("SITE_PACKAGES", sitePackagesValue);
+writeGitHubEnv("IMAGE_TAG", imageTag);
+writeGitHubOutput("brain_version", brainVersion);
+writeGitHubOutput("site_packages", sitePackagesValue);
+writeGitHubOutput("image_tag", imageTag);
+
+console.log(`BRAIN_VERSION=${brainVersion}`);
+console.log(`IMAGE_TAG=${imageTag}`);
+console.log(
+  sitePackages.length > 0
+    ? `SITE_PACKAGES=${sitePackagesValue}`
+    : "SITE_PACKAGES=(none)",
+);
+
+function buildImageTag(brainVersion: string, sitePackages: string[]): string {
+  if (sitePackages.length === 0) {
+    return `brain-${brainVersion}`;
+  }
+
+  const siteHash = createHash("sha256")
+    .update(sitePackages.join("\n"))
+    .digest("hex")
+    .slice(0, 12);
+
+  return `brain-${brainVersion}-sites-${siteHash}`;
+}