@rizom/ops 0.2.0-alpha.170 → 0.2.0-alpha.171

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.170",
+  "version": "0.2.0-alpha.171",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.github/workflows/build.yml

@@ -4,17 +4,22 @@ on:
   workflow_dispatch:
     inputs:
       brain_version:
-        description: Brain version to build; defaults to pilot.yaml brainVersion
+        description: Force one explicit build at this brain version (skips the registry-derived resolve)
+        required: false
+        type: string
+      site_packages:
+        description: 'Space-separated site packages for a per-instance site image (e.g. "@rizom/site-rizom-ai@0.2.0-alpha.148"). Empty builds the default fleet image.'
         required: false
         type: string
   push:
     branches: ["main"]
     paths:
+      # The image set is a pure function of the declared fleet state: a push
+      # that changes it builds exactly what it declares, so the deploy (fired
+      # off the same push via Reconcile) finds its tag ready.
       - pilot.yaml
-      - cohorts/*.yaml
+      - cohorts/**
       - users/*.yaml
-      - package.json
-      - bun.lock
       - deploy/**
       - .github/workflows/build.yml
 
@@ -23,8 +28,10 @@ permissions:
   packages: write
 
 jobs:
-  build:
+  resolve:
     runs-on: ubuntu-latest
+    outputs:
+      images_json: ${{ steps.resolve.outputs.images_json }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -35,12 +42,40 @@ jobs:
       - name: Install operator tooling
         run: bun install
 
-      - name: Resolve image metadata inputs
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve images to build
+        id: resolve
         env:
           BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
-        run: |
-          bun deploy/scripts/resolve-build-config.ts
-          echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
+          SITE_PACKAGES_INPUT: ${{ inputs.site_packages || '' }}
+        run: bun deploy/scripts/resolve-missing-images.ts
+
+  no_builds:
+    needs: resolve
+    if: needs.resolve.outputs.images_json == '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when every declared image exists
+        run: echo "All declared images already exist; nothing to build."
+
+  build:
+    needs: resolve
+    if: needs.resolve.outputs.images_json != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ${{ fromJson(needs.resolve.outputs.images_json) }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -49,9 +84,9 @@ jobs:
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ${{ env.IMAGE_REPOSITORY }}
+          images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=${{ env.IMAGE_TAG }}
+            type=raw,value=${{ matrix.image.tag }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -68,8 +103,8 @@ jobs:
           target: fleet
           push: true
           build-args: |
-            BRAIN_VERSION=${{ env.BRAIN_VERSION }}
-            SITE_PACKAGES=${{ env.SITE_PACKAGES }}
+            BRAIN_VERSION=${{ matrix.image.brain_version }}
+            SITE_PACKAGES=${{ matrix.image.site_packages }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}

package/templates/rover-pilot/.github/workflows/deploy.yml

@@ -10,7 +10,6 @@ on:
   push:
     branches: ["main"]
     paths:
-      - users/*.yaml
       - users/*/.env
       - users/*/brain.yaml
       - users/*/content/**
@@ -83,72 +82,99 @@ jobs:
       - name: Install operator tooling
         run: bun install
 
+      - name: Load shared env via varlock
+        env:
+          BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
+        run: |
+          for attempt in 1 2 3; do
+            if bunx varlock@1.1.0 load --path .env.schema --format json --compact > /tmp/varlock-env.json; then
+              break
+            fi
+            if [ "$attempt" = "3" ]; then
+              exit 1
+            fi
+            echo "Varlock load failed (attempt $attempt/3); retrying in 5s..."
+            sleep 5
+          done
+          node <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs";
+          const env = JSON.parse(readFileSync('/tmp/varlock-env.json', 'utf8'));
+          const githubEnvPath = process.env.GITHUB_ENV;
+          if (!githubEnvPath) {
+            throw new Error('Missing GITHUB_ENV');
+          }
+
+          const newline = String.fromCharCode(10);
+          const carriageReturn = String.fromCharCode(13);
+          const chunks = [];
+          for (const [key, value] of Object.entries(env)) {
+            if (key === 'BWS_ACCESS_TOKEN' || value === null || value === undefined) {
+              continue;
+            }
+
+            const text = String(value)
+              .split(carriageReturn + newline)
+              .join(newline);
+            const escapedMask = text
+              .replace(/%/g, '%25')
+              .replace(/\r/g, '%0D')
+              .replace(/\n/g, '%0A');
+            if (escapedMask.length > 0) {
+              process.stdout.write('::add-mask::' + escapedMask + newline);
+            }
+
+            if (text.includes(newline)) {
+              let delimiter = `VARLOCK_${key}_EOF`;
+              while (text.includes(delimiter)) {
+                delimiter += '_X';
+              }
+              chunks.push(`${key}<<${delimiter}${newline}${text}${newline}${delimiter}`);
+            } else {
+              chunks.push(`${key}=${text}`);
+            }
+          }
+
+          appendFileSync(githubEnvPath, chunks.join(newline) + newline);
+          NODE
+
       - name: Decrypt user secrets
         id: user_secrets
-        env:
-          AGE_SECRET_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: bun deploy/scripts/decrypt-user-secrets.ts "$HANDLE"
 
       - name: Reconcile selected user config
-        env:
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-        run: |
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
+        run: bunx brains-ops onboard "$GITHUB_WORKSPACE" "$HANDLE"
 
       - name: Resolve generated user config
         id: user_config
         run: bun deploy/scripts/resolve-user-config.ts
 
       - name: Validate selected secrets
-        env:
-          SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SETUP_EMAIL_API_KEY: ${{ secrets.SETUP_EMAIL_API_KEY }}
-          SETUP_EMAIL_FROM: ${{ secrets.SETUP_EMAIL_FROM }}
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CONFIG_CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
-          SHARED_CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
-          SHARED_CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          SHARED_PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
-        run: |
-          export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export CF_ZONE_ID="${CONFIG_CF_ZONE_ID:-${CF_ZONE_ID:-$SHARED_CF_ZONE_ID}}"
-          export CERTIFICATE_PEM="${CERTIFICATE_PEM:-$SHARED_CERTIFICATE_PEM}"
-          export PRIVATE_KEY_PEM="${PRIVATE_KEY_PEM:-$SHARED_PRIVATE_KEY_PEM}"
-          bun deploy/scripts/validate-secrets.ts
+        run: bun deploy/scripts/validate-secrets.ts
 
       - name: Seed content repo
         env:
           CONTENT_REPO: ${{ steps.user_config.outputs.content_repo }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-        run: |
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          bun deploy/scripts/sync-content-repo.ts
+        run: bun deploy/scripts/sync-content-repo.ts
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Wait for shared image tag
+      - name: Wait for image tag
         run: |
+          # The Build workflow fires off the same config push (it derives the
+          # declared image set from the registry), so this wait must cover a
+          # full image build, not just registry propagation.
           IMAGE_TAG="${{ steps.user_config.outputs.image_repository }}:${{ steps.user_config.outputs.image_tag }}"
-          for attempt in $(seq 1 24); do
+          for attempt in $(seq 1 60); do
             if docker manifest inspect "$IMAGE_TAG" >/dev/null 2>&1; then
               exit 0
             fi
-            echo "Shared image tag not ready yet ($attempt/24): $IMAGE_TAG"
-            sleep 10
+            echo "Image tag not ready yet ($attempt/60): $IMAGE_TAG"
+            sleep 20
           done
           echo "Timed out waiting for $IMAGE_TAG" >&2
           exit 1
@@ -159,8 +185,6 @@ jobs:
           ruby -r rubygems -e 'puts Gem.user_dir + "/bin"' >> "$GITHUB_PATH"
 
       - name: Write Kamal SSH key
-        env:
-          KAMAL_SSH_PRIVATE_KEY: ${{ secrets.KAMAL_SSH_PRIVATE_KEY }}
         run: bun deploy/scripts/write-ssh-key.ts
 
       - name: Configure SSH client
@@ -177,46 +201,21 @@ jobs:
           chmod 600 ~/.ssh/config
 
       - name: Write .kamal/secrets
-        env:
-          SHARED_AI_API_KEY: ${{ secrets[steps.user_secrets.outputs.shared_ai_api_key_secret_name] }}
-          SHARED_GIT_SYNC_TOKEN: ${{ secrets[steps.user_secrets.outputs.shared_git_sync_token_secret_name] }}
-          SETUP_EMAIL_API_KEY: ${{ secrets.SETUP_EMAIL_API_KEY }}
-          SETUP_EMAIL_FROM: ${{ secrets.SETUP_EMAIL_FROM }}
-          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
-          SHARED_CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
-          SHARED_PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
-        run: |
-          export AI_API_KEY="${AI_API_KEY:-$SHARED_AI_API_KEY}"
-          export GIT_SYNC_TOKEN="${GIT_SYNC_TOKEN:-$SHARED_GIT_SYNC_TOKEN}"
-          export CERTIFICATE_PEM="${CERTIFICATE_PEM:-$SHARED_CERTIFICATE_PEM}"
-          export PRIVATE_KEY_PEM="${PRIVATE_KEY_PEM:-$SHARED_PRIVATE_KEY_PEM}"
-          bun deploy/scripts/write-kamal-secrets.ts
+        run: bun deploy/scripts/write-kamal-secrets.ts
 
       - name: Provision server
         id: provision
         env:
-          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
-          HCLOUD_SSH_KEY_NAME: ${{ secrets.HCLOUD_SSH_KEY_NAME }}
-          HCLOUD_SERVER_TYPE: ${{ secrets.HCLOUD_SERVER_TYPE }}
-          HCLOUD_LOCATION: ${{ secrets.HCLOUD_LOCATION }}
           INSTANCE_NAME: ${{ steps.user_config.outputs.instance_name }}
         run: bun deploy/scripts/provision-server.ts
 
       - name: Update Cloudflare DNS
         env:
-          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
-          CONFIG_CF_ZONE_ID: ${{ steps.user_config.outputs.cloudflare_zone_id }}
-          SHARED_CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
-          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
         run: |
-          export CF_ZONE_ID="${CONFIG_CF_ZONE_ID:-${CF_ZONE_ID:-$SHARED_CF_ZONE_ID}}"
           bun deploy/scripts/update-dns.ts
-          if [ -n "$WWW_DOMAIN" ]; then
-            BRAIN_DOMAIN="$WWW_DOMAIN" bun deploy/scripts/update-dns.ts
-          fi
           BRAIN_DOMAIN="$PREVIEW_DOMAIN" bun deploy/scripts/update-dns.ts
 
       - name: Validate SSH key
@@ -244,7 +243,6 @@ jobs:
           IMAGE_REPOSITORY: ${{ steps.user_config.outputs.image_repository }}
           REGISTRY_USERNAME: ${{ steps.user_config.outputs.registry_username }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
-          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
           BRAIN_YAML_PATH: ${{ steps.user_config.outputs.brain_yaml_path }}
         run: kamal setup --skip-push -c deploy/kamal/deploy.yml
@@ -253,13 +251,9 @@ jobs:
         env:
           SERVER_IP: ${{ steps.provision.outputs.server_ip }}
           BRAIN_DOMAIN: ${{ steps.user_config.outputs.brain_domain }}
-          WWW_DOMAIN: ${{ steps.user_config.outputs.www_domain }}
           PREVIEW_DOMAIN: ${{ steps.user_config.outputs.preview_domain }}
         run: |
           curl -I -k --max-time 20 --resolve "$BRAIN_DOMAIN:443:$SERVER_IP" "https://$BRAIN_DOMAIN/health"
-          if [ -n "$WWW_DOMAIN" ]; then
-            curl -I -k --max-time 20 --resolve "$WWW_DOMAIN:443:$SERVER_IP" "https://$WWW_DOMAIN/"
-          fi
           curl -I -k --max-time 20 --resolve "$PREVIEW_DOMAIN:443:$SERVER_IP" "https://$PREVIEW_DOMAIN/"
 
       - name: Upload generated config

package/templates/rover-pilot/deploy/scripts/helpers.ts

@@ -6,5 +6,8 @@ export {
   requireEnv,
   writeGitHubOutput,
   writeGitHubEnv,
+  siteImageTag,
+  sitePackagesFor,
+  runResolveMissingImages,
 } from "@rizom/ops/deploy";
 export type { EnvSchemaEntry } from "@rizom/ops/deploy";

package/templates/rover-pilot/deploy/scripts/resolve-missing-images.ts

@@ -0,0 +1,13 @@
+import {
+  requireEnv,
+  runResolveMissingImages,
+  writeGitHubOutput,
+} from "./helpers";
+
+// The Build workflow's resolve step — the logic lives in @rizom/ops; this
+// pilot repo only supplies its own paths and repository.
+await runResolveMissingImages({
+  rootDir: process.cwd(),
+  imageRepository: `ghcr.io/${requireEnv("GITHUB_REPOSITORY")}`,
+  writeOutput: writeGitHubOutput,
+});

package/templates/rover-pilot/deploy/scripts/resolve-user-config.ts

@@ -1,22 +1,20 @@
-import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+
 import { loadPilotRegistry } from "@rizom/ops";
 
-import { parseEnvFile, requireEnv, writeGitHubOutput } from "./helpers";
+import {
+  parseEnvFile,
+  requireEnv,
+  sitePackagesFor,
+  siteImageTag,
+  writeGitHubOutput,
+} from "./helpers";
 
 const handle = requireEnv("HANDLE");
 const envPath = `users/${handle}/.env`;
 const brainYamlPath = `users/${handle}/brain.yaml`;
 
 const envEntries = parseEnvFile(envPath);
-const registry = await loadPilotRegistry(process.cwd());
-const user = registry.users.find((candidate) => candidate.handle === handle);
-if (!user) {
-  throw new Error(`Unknown user handle: ${handle}`);
-}
-
-const brainVersion = envEntries["BRAIN_VERSION"] ?? "";
-const imageTag = resolveImageTag(registry, brainVersion);
 const repository = process.env["GITHUB_REPOSITORY"] ?? "";
 const repositoryOwner = repository.split("/")[0] ?? "";
 
@@ -27,24 +25,31 @@ if (!brainDomain) {
   throw new Error(`Missing domain in ${brainYamlPath}`);
 }
 
-const pilotSubdomainPrefix = `${handle}.`;
-const pilotZone =
-  brainDomain.startsWith(pilotSubdomainPrefix) &&
-  brainDomain.length > pilotSubdomainPrefix.length
-    ? brainDomain.slice(pilotSubdomainPrefix.length)
+const zone =
+  brainDomain.startsWith(`${handle}.`) && brainDomain.length > handle.length + 1
+    ? brainDomain.slice(handle.length + 1)
     : "";
-const previewDomain = pilotZone
-  ? `${handle}-preview.${pilotZone}`
-  : `preview.${brainDomain}`;
-const wwwDomain = pilotZone ? "" : `www.${brainDomain}`;
+if (!zone) {
+  throw new Error(`Could not derive preview domain from ${brainDomain}`);
+}
+const previewDomain = `${handle}-preview.${zone}`;
+
+const brainVersion = envEntries["BRAIN_VERSION"] ?? "";
+
+// The image tag is a pure function of this instance's own config: plain
+// `brain-{version}` for a default instance, or its own `brain-{version}-sites-
+// {hash}` when it declares a siteOverride. Resolved through the same helper the
+// build uses so the tag we wait for and run matches exactly what was pushed.
+const registry = await loadPilotRegistry(process.cwd());
+const user = registry.users.find((entry) => entry.handle === handle);
+const sitePackages = sitePackagesFor(user?.siteOverride);
+const imageTag = siteImageTag(brainVersion, sitePackages);
 
 const outputs: Record<string, string> = {
   brain_version: brainVersion,
   content_repo: envEntries["CONTENT_REPO"] ?? "",
   brain_domain: brainDomain,
   preview_domain: previewDomain,
-  www_domain: wwwDomain,
-  cloudflare_zone_id: user.cloudflareZoneId ?? "",
   brain_yaml_path: brainYamlPath,
   instance_name: `rover-${handle}`,
   image_repository: `ghcr.io/${repository}`,
@@ -62,35 +67,3 @@ for (const key of required) {
 for (const [key, value] of Object.entries(outputs)) {
   writeGitHubOutput(key, value);
 }
-
-function resolveImageTag(
-  registry: Awaited<ReturnType<typeof loadPilotRegistry>>,
-  brainVersion: string,
-): string {
-  if (!brainVersion) {
-    return "";
-  }
-
-  const sitePackages = [
-    ...new Set(
-      registry.users
-        .filter((user) => user.brainVersion === brainVersion)
-        .flatMap((user) =>
-          user.siteOverride
-            ? [`${user.siteOverride.package}@${user.siteOverride.version}`]
-            : [],
-        ),
-    ),
-  ].sort();
-
-  if (sitePackages.length === 0) {
-    return `brain-${brainVersion}`;
-  }
-
-  const siteHash = createHash("sha256")
-    .update(sitePackages.join("\n"))
-    .digest("hex")
-    .slice(0, 12);
-
-  return `brain-${brainVersion}-sites-${siteHash}`;
-}

package/templates/rover-pilot/deploy/scripts/resolve-build-config.ts

@@ -1,53 +0,0 @@
-#!/usr/bin/env bun
-import { createHash } from "node:crypto";
-import { loadPilotRegistry } from "@rizom/ops";
-import { writeGitHubEnv, writeGitHubOutput } from "./helpers";
-
-const requestedBrainVersion = process.env["BRAIN_VERSION_INPUT"]?.trim();
-const registry = await loadPilotRegistry(process.cwd());
-const brainVersion =
-  requestedBrainVersion && requestedBrainVersion.length > 0
-    ? requestedBrainVersion
-    : registry.pilot.brainVersion;
-
-const sitePackages = [
-  ...new Set(
-    registry.users
-      .filter((user) => user.brainVersion === brainVersion)
-      .flatMap((user) =>
-        user.siteOverride
-          ? [`${user.siteOverride.package}@${user.siteOverride.version}`]
-          : [],
-      ),
-  ),
-].sort();
-const sitePackagesValue = sitePackages.join(" ");
-const imageTag = buildImageTag(brainVersion, sitePackages);
-
-writeGitHubEnv("BRAIN_VERSION", brainVersion);
-writeGitHubEnv("SITE_PACKAGES", sitePackagesValue);
-writeGitHubEnv("IMAGE_TAG", imageTag);
-writeGitHubOutput("brain_version", brainVersion);
-writeGitHubOutput("site_packages", sitePackagesValue);
-writeGitHubOutput("image_tag", imageTag);
-
-console.log(`BRAIN_VERSION=${brainVersion}`);
-console.log(`IMAGE_TAG=${imageTag}`);
-console.log(
-  sitePackages.length > 0
-    ? `SITE_PACKAGES=${sitePackagesValue}`
-    : "SITE_PACKAGES=(none)",
-);
-
-function buildImageTag(brainVersion: string, sitePackages: string[]): string {
-  if (sitePackages.length === 0) {
-    return `brain-${brainVersion}`;
-  }
-
-  const siteHash = createHash("sha256")
-    .update(sitePackages.join("\n"))
-    .digest("hex")
-    .slice(0, 12);
-
-  return `brain-${brainVersion}-sites-${siteHash}`;
-}