@wtfalch/foundry 0.47.0 → 0.49.0

package/dist/plan/platform-diff.d.ts

@@ -151,6 +151,13 @@ export declare const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = "archon
  * values until someone redeploys by hand (#467).
  */
 export declare const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = "archon_envs_deployed_hash";
+/**
+ * The sha256 of the `GITHUB_RELEASE_WEBHOOK_SECRET` Archon last deployed with, recorded by
+ * `platform:archon` after its deploy (never the secret). `driftedSteps` plans `platform:archon` again
+ * while the live secret is missing or hashes differently: the release hook step writes the secret into
+ * Coolify and nothing else redeploys an applied Archon.
+ */
+export declare const PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY = "archon_webhook_secret_deployed_sha256";
 /**
  * The uuid of the deployment Archon's step triggered without waiting
  * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
@@ -412,6 +419,29 @@ export declare const PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF = "platform:mas
  * already holds the same panel's address.
  */
 export declare const PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF = "platform:archon:coolify-read-token";
+/**
+ * The held key (tenant `platform`) of a fine-grained GitHub token for the `wtfalch`
+ * organisation with Webhooks read and write. Foundry only reads it back; a person holds it in
+ * Archon, Shared, Keys. Until it is held, the `platform:github-release-hook` step is reported
+ * blocked and nothing else is.
+ */
+export declare const PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF = "platform:github:org-hooks-token";
+/** Archon's env name for the secret GitHub signs release webhooks with. Minted once by `platform:archon`, never rotated. */
+export declare const GITHUB_RELEASE_WEBHOOK_SECRET_ENV = "GITHUB_RELEASE_WEBHOOK_SECRET";
+/** The GitHub organisation whose release webhook `platform:github-release-hook` makes. */
+export declare const GITHUB_RELEASE_HOOK_ORG = "wtfalch";
+/** Archon's route that takes release webhooks, under its public host. */
+export declare const GITHUB_RELEASE_HOOK_PATH = "/api/github/releases";
+/** The step key. */
+export declare const PLATFORM_GITHUB_RELEASE_HOOK_KEY = "platform:github-release-hook";
+/** Scope key: the id of the organisation hook the step made or adopted. */
+export declare const PLATFORM_GITHUB_RELEASE_HOOK_ID_SCOPE_KEY = "github_release_hook_id";
+/** Scope key: the hash of the hook's url and secret as last written. The secret itself is never recorded. */
+export declare const PLATFORM_GITHUB_RELEASE_HOOK_HASH_SCOPE_KEY = "github_release_hook_hash";
+/** Why the step is blocked while Archon's env cannot be read from Coolify. */
+export declare const GITHUB_RELEASE_HOOK_COOLIFY_READ_FAILED = "the GitHub release webhook is blocked, not planned: could not read Archon's env from Coolify";
+/** Why the step is blocked while the token is not held. */
+export declare const GITHUB_RELEASE_HOOK_TOKEN_MISSING = "the GitHub release webhook is blocked, not planned: hold the GitHub organisation webhooks token in Archon, Shared, Keys";
 /**
  * #169: `platform:<service>` for the platform's own mail server (Stalwart),
  * mirroring {@link PLATFORM_AUTH_KEY} exactly.
@@ -1248,6 +1278,14 @@ export interface PlanPlatformOptions {
             pending: boolean;
             blocked?: string;
         };
+        /** Why the organisation's release webhook step cannot run (the token is not held), or absent. */
+        githubReleaseHook?: string;
+        /**
+         * The token is held: the step may plan, also in the apply that makes Archon.
+         */
+        githubReleaseHookReady?: boolean;
+        /** The hash of the hook's url and Archon's live webhook secret now (`githubReleaseHookHash`). Absent while Archon holds no secret. */
+        githubReleaseHookHash?: string;
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
         /**
@@ -1448,6 +1486,27 @@ export declare const PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY = "in
  * `''`) as soon as the mint is recorded, so one request is one rotation.
  */
 export declare const PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY = "integrations_management_key_rotation_requested";
+/**
+ * foundry#542: the uptime Worker, one `cloudflare:worker` step. Blocked, not
+ * planned (rule 2), while no artifact is pinned, Archon is not applied, the
+ * executor lacks its dependencies, a Worker or Access token of the name exists
+ * that foundry did not make. A lost Worker token or Access pair is not a
+ * block: the step is planned and repairs it (rule 4). Planned again when the
+ * pinned tag or sha256, the Archon hostname (`ARCHON_BASE_URL`), the plain
+ * text variables or the set of secrets that can be set changed (rule 3), or
+ * when a half-made deploy never recorded its applied values; it mints nothing
+ * that is already held. When the platform no longer enables the Worker, a
+ * destructive step removes whatever of it is recorded (edge removes its KV
+ * namespace with the script).
+ *
+ * The returned `blocked` lines are reported in `unmanaged`. A secret whose
+ * source does not exist yet blocks nothing: the step still delivers
+ * everything that exists, so it comes back in `notes`.
+ */
+/** The hash of a hook's url and secret. The planner and the step both compute it, and it is the only trace of the secret that is recorded. */
+export declare function githubReleaseHookHash(url: string, secret: string): string;
+/** The url GitHub delivers release webhooks to. */
+export declare function githubReleaseHookUrl(hostname: string): string;
 /**
  * #175: Archon (https://github.com/wtfalch/archon), the one shared console,
  * built fresh at `platform.archon.hostname` (`archon.<apex>`) rather than the

package/dist/plan/platform-diff.js

@@ -190,6 +190,13 @@ export const PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY = 'archon_integra
  * values until someone redeploys by hand (#467).
  */
 export const PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY = 'archon_envs_deployed_hash';
+/**
+ * The sha256 of the `GITHUB_RELEASE_WEBHOOK_SECRET` Archon last deployed with, recorded by
+ * `platform:archon` after its deploy (never the secret). `driftedSteps` plans `platform:archon` again
+ * while the live secret is missing or hashes differently: the release hook step writes the secret into
+ * Coolify and nothing else redeploys an applied Archon.
+ */
+export const PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY = 'archon_webhook_secret_deployed_sha256';
 /**
  * The uuid of the deployment Archon's step triggered without waiting
  * (`PlatformArchonDeps.runsInsideApp`), `pending` between the trigger and the
@@ -464,6 +471,29 @@ export const PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF = 'platform:master:clou
  * already holds the same panel's address.
  */
 export const PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF = 'platform:archon:coolify-read-token';
+/**
+ * The held key (tenant `platform`) of a fine-grained GitHub token for the `wtfalch`
+ * organisation with Webhooks read and write. Foundry only reads it back; a person holds it in
+ * Archon, Shared, Keys. Until it is held, the `platform:github-release-hook` step is reported
+ * blocked and nothing else is.
+ */
+export const PLATFORM_GITHUB_ORG_HOOKS_TOKEN_REF = 'platform:github:org-hooks-token';
+/** Archon's env name for the secret GitHub signs release webhooks with. Minted once by `platform:archon`, never rotated. */
+export const GITHUB_RELEASE_WEBHOOK_SECRET_ENV = 'GITHUB_RELEASE_WEBHOOK_SECRET';
+/** The GitHub organisation whose release webhook `platform:github-release-hook` makes. */
+export const GITHUB_RELEASE_HOOK_ORG = 'wtfalch';
+/** Archon's route that takes release webhooks, under its public host. */
+export const GITHUB_RELEASE_HOOK_PATH = '/api/github/releases';
+/** The step key. */
+export const PLATFORM_GITHUB_RELEASE_HOOK_KEY = 'platform:github-release-hook';
+/** Scope key: the id of the organisation hook the step made or adopted. */
+export const PLATFORM_GITHUB_RELEASE_HOOK_ID_SCOPE_KEY = 'github_release_hook_id';
+/** Scope key: the hash of the hook's url and secret as last written. The secret itself is never recorded. */
+export const PLATFORM_GITHUB_RELEASE_HOOK_HASH_SCOPE_KEY = 'github_release_hook_hash';
+/** Why the step is blocked while Archon's env cannot be read from Coolify. */
+export const GITHUB_RELEASE_HOOK_COOLIFY_READ_FAILED = "the GitHub release webhook is blocked, not planned: could not read Archon's env from Coolify";
+/** Why the step is blocked while the token is not held. */
+export const GITHUB_RELEASE_HOOK_TOKEN_MISSING = 'the GitHub release webhook is blocked, not planned: hold the GitHub organisation webhooks token in Archon, Shared, Keys';
 /**
  * #169: `platform:<service>` for the platform's own mail server (Stalwart),
  * mirroring {@link PLATFORM_AUTH_KEY} exactly.
@@ -730,7 +760,8 @@ export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
         port: entry.port,
-        autoDeploy: entry.autoDeploy,
+        // A blue/green entry deploys only through the release runner.
+        autoDeploy: entry.blueGreen ? false : entry.autoDeploy,
         ...(entry.buildPack === 'static' ? { staticFolderIn: 'base_directory' } : {}),
     };
 }
@@ -1440,8 +1471,25 @@ export function planPlatform(platform, live, options = {}) {
             step: { description: archonBg.step.description, destroys: false, migrates: false },
         });
     }
-    if (archon.step && blocked.archonRunsInsideApp)
+    let releaseHook;
+    // The hook step makes the secret itself, so with the app recorded it goes before a last-placed
+    // platform:archon (the host redeploys itself there and would stop before a later step). Without the
+    // app it goes after platform:archon, which makes the app.
+    if (archon.step && blocked.archonRunsInsideApp) {
+        const hookFirst = Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]);
+        const hookStep = () => planGithubReleaseHook(platform, recordedIds, blocked.githubReleaseHook, blocked.githubReleaseHookReady ?? false, blocked.githubReleaseHookHash, true);
+        releaseHook = hookStep();
+        if (hookFirst && releaseHook.step)
+            plannedSteps.push(releaseHook.step);
         plannedSteps.push(archon.step);
+        if (!hookFirst && releaseHook.step)
+            plannedSteps.push(releaseHook.step);
+    }
+    else {
+        releaseHook = planGithubReleaseHook(platform, recordedIds, blocked.githubReleaseHook, blocked.githubReleaseHookReady ?? false, blocked.githubReleaseHookHash, Boolean(archon.step));
+        if (releaseHook.step)
+            plannedSteps.push(releaseHook.step);
+    }
     // After Archon's own step: a repair that fails must not hold up the work before it.
     const idTokenUserinfo = planArchonIdTokenUserinfo(platform, recordedIds, blocked.archonIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
@@ -1574,6 +1622,9 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: heartbeats.blocked, key: 'heartbeats' });
     for (const description of uptime.blocked)
         unmanaged.push({ description, key: 'uptime' });
+    if (releaseHook.blocked) {
+        unmanaged.push({ description: releaseHook.blocked, key: 'github-release-hook' });
+    }
     return {
         plannedSteps: plannedSteps.map(withStepSystem),
         unmanaged,
@@ -2931,6 +2982,53 @@ function planHeartbeats(platform, recordedIds, hcReady, executorMissing, apiKeyM
  * source does not exist yet blocks nothing: the step still delivers
  * everything that exists, so it comes back in `notes`.
  */
+/** The hash of a hook's url and secret. The planner and the step both compute it, and it is the only trace of the secret that is recorded. */
+export function githubReleaseHookHash(url, secret) {
+    return createHash('sha256').update(`${url}\n${secret}`).digest('hex');
+}
+/** The url GitHub delivers release webhooks to. */
+export function githubReleaseHookUrl(hostname) {
+    return `https://${hostname}${GITHUB_RELEASE_HOOK_PATH}`;
+}
+/**
+ * The organisation's release webhook, once the token is held and Archon is applied or planned in this
+ * same plan (`platform:archon` runs first and mints the secret). Planned when no hook is recorded, or the
+ * recorded hash of (url, secret) differs from the one now.
+ * Blocked, not planned, while the token is not held; nothing else is held back by that.
+ */
+function planGithubReleaseHook(platform, recordedIds, executorBlocked, tokenHeld, currentHash, archonPlanned) {
+    if (!platform.archon.enabled)
+        return { step: null, blocked: null };
+    if (!recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)] && !archonPlanned) {
+        return { step: null, blocked: null };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: executorBlocked };
+    if (!tokenHeld)
+        return { step: null, blocked: null };
+    if (currentHash &&
+        recordedIds[PLATFORM_GITHUB_RELEASE_HOOK_ID_SCOPE_KEY] &&
+        recordedIds[PLATFORM_GITHUB_RELEASE_HOOK_HASH_SCOPE_KEY] === currentHash) {
+        return { step: null, blocked: null };
+    }
+    const url = githubReleaseHookUrl(platform.archon.hostname);
+    return {
+        step: {
+            action: {
+                system: 'github',
+                kind: 'release-hook',
+                key: PLATFORM_GITHUB_RELEASE_HOOK_KEY,
+                desired: { org: GITHUB_RELEASE_HOOK_ORG, url, events: ['release'] },
+            },
+            step: {
+                description: `make the ${GITHUB_RELEASE_HOOK_ORG} organisation's release webhook to ${url}`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 function planUptime(platform, recordedIds, executorBlocked, heldOptional, archonApplied, uptimeHeld = {
     token: true,
     access: true,

package/dist/plan/platform-providers.d.ts

@@ -21,6 +21,7 @@ import { type BrokerDeployRecord, PLATFORM_ZITADEL_ORG_SCOPE_KEY } from './platf
 import type { PlatformOwnerInput } from './platform-org.js';
 import type { SigninDbBackupPort } from './signin-db-backup.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
+import { type PlatformGithubReleaseHookDeps } from './github-release-hook.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -324,6 +325,11 @@ export interface FoundryPlatformStepExecutorOptions {
      * unset, the step is reported blocked.
      */
     oikosIngress?: PlatformOikosIngressDeps;
+    /**
+     * The `github:release-hook` step. Optional like `auth`; without it the step is not planned and
+     * nothing is reported.
+     */
+    githubReleaseHook?: PlatformGithubReleaseHookDeps;
 }
 export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor {
     private readonly cloudflare;
@@ -345,6 +351,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly uptime?;
     private readonly accessProvider?;
     private readonly oikosIngress?;
+    private readonly githubReleaseHook?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
     private readonly platformPorts;
     /** The port placed on the platform's destination, made once per port so a server is listed once. */
@@ -388,6 +395,9 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
             pending: boolean;
             blocked?: string;
         };
+        githubReleaseHook?: string;
+        githubReleaseHookReady?: boolean;
+        githubReleaseHookHash?: string;
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;

package/dist/plan/platform-providers.js

@@ -28,7 +28,7 @@ import { MAIL_APP_SCOPE_KEY, MAIL_DATABASE_NAME, MAIL_DATABASE_PASSWORD_ENV, MAI
 import { OIKOS_INGRESS_BLOCKED, PLATFORM_OIKOS_INGRESS_KEY, oikosIngressApplied, oikosIngressZoneBlocked, provisionOikosIngress, } from './oikos-ingress.js';
 import { recordOwnDnsHostname } from './own-dns.js';
 import { platformNetwork, platformTarget, scopeFromPlatform, } from './own-services.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_AUTH_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FILES_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_ARCHON_ORG_DOMAIN_SCOPE_KEY, PLATFORM_ARCHON_ORG_POLICY_SCOPE_KEY, PLATFORM_ARCHON_ORG_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_ARCHON_OWNER_INVITE_SCOPE_KEY, PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY, PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_REGISTRATION_CLOSED_SCOPE_KEY, PLATFORM_AUTH_RESERVED_ADMIN_USERNAME_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_GITHUB_RELEASE_HOOK_KEY, PLATFORM_HC_ACCESS_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_HEARTBEATS_HOSTED_API_KEY_REF, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_HOST_PORTS_DIRECT, PLATFORM_MAIL_HOST_PORTS_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_RELAY_KEY, PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY, PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY, PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY, PLATFORM_MAIL_ROUTE_SCOPE_KEY, PLATFORM_MAIL_ROUTE_WANTED, PLATFORM_MAIL_USER_ROLE, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_BLOCKED_SCOPE_KEY, PLATFORM_OWNER_ORG_DOMAIN_SCOPE_KEY, PLATFORM_OWNER_ORG_SCOPE_KEY, PLATFORM_SFU_APPLIED_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_ZITADEL_ORG_SCOPE_KEY, archonFilesMarker, archonFirstOwnerLink, archonOrgDomain, archonOrgName, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailHostPorts, platformMailMxHost, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { PLATFORM_ARCHON_IN_APP_SCOPE_KEY, archonInAppBack, archonInAppBind, archonInAppHost, archonInAppPoint, archonInAppUnbind, } from './sign-in-archon.js';
 import { LOGIN_HOST_BINDINGS_ENV } from './sign-in-bindings.js';
 import { ensureSignInOrg, inviteOwnerWithLink, signInOrgDomain } from './sign-in-org.js';
@@ -36,6 +36,7 @@ import { SIGN_IN_BASE_PATH, SIGN_IN_BUILD_ARG_ENV, SIGN_IN_LOGIN_APP_SCOPE_KEY,
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
 import { SIGNIN_DB_APP_SCOPE_KEY, SIGNIN_DB_TLS_SCOPE_KEY, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
 export { PLATFORM_ZITADEL_ORG_SCOPE_KEY };
+import { githubReleaseHookPlanInputs, provisionGithubReleaseHook, } from './github-release-hook.js';
 import { applyCallsSfuPlatformStep, callsSfuAppliedFingerprint, } from './platform-sfu.js';
 import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, waitForSystemApi, } from './zitadel-system-api.js';
@@ -144,6 +145,7 @@ export class FoundryPlatformStepExecutor {
     uptime;
     accessProvider;
     oikosIngress;
+    githubReleaseHook;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -164,6 +166,7 @@ export class FoundryPlatformStepExecutor {
         this.uptime = options.uptime;
         this.accessProvider = options.accessProvider;
         this.oikosIngress = options.oikosIngress;
+        this.githubReleaseHook = options.githubReleaseHook;
     }
     platformPorts = new WeakMap();
     /** The port placed on the platform's destination, made once per port so a server is listed once. */
@@ -470,6 +473,15 @@ export class FoundryPlatformStepExecutor {
                 blocked.heartbeatsApiKeyMissing = true;
         }
         await this.uptimeBlocked(platform, recordedIds, blocked, owner);
+        if (this.githubReleaseHook && platform.archon.enabled) {
+            const inputs = await githubReleaseHookPlanInputs(this.githubReleaseHook, platform.archon.hostname, recordedIds);
+            if (inputs.blocked)
+                blocked.githubReleaseHook = inputs.blocked;
+            if (inputs.ready)
+                blocked.githubReleaseHookReady = true;
+            if (inputs.hash)
+                blocked.githubReleaseHookHash = inputs.hash;
+        }
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
@@ -693,12 +705,15 @@ export class FoundryPlatformStepExecutor {
             const redeployFailed = this.archon.runsInsideApp === true &&
                 Boolean(deployment) &&
                 (await archonDeploymentState(this.archon.coolify, deployment)) === 'failed';
+            const webhookSecretDrifted = !rollingUpdateDrifted &&
+                (await archonWebhookSecretDrifted(this.archon.coolify, recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`], recordedIds));
             if (accessDrifted ||
                 brokerDrifted ||
                 authOrgDrifted ||
                 authzDrifted ||
                 bridgeDrifted ||
                 rollingUpdateDrifted ||
+                webhookSecretDrifted ||
                 redeployFailed)
                 result.archon = true;
         }
@@ -923,6 +938,28 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformAccessProvider(context, this.accessProvider);
         }
+        if (action.system === 'github' &&
+            action.kind === 'release-hook' &&
+            action.key === PLATFORM_GITHUB_RELEASE_HOOK_KEY) {
+            if (!this.githubReleaseHook) {
+                throw new Error('platform:github-release-hook needs FoundryPlatformStepExecutor to be constructed with its github release hook dependencies');
+            }
+            const hookDeps = this.githubReleaseHook;
+            return provisionGithubReleaseHook(context, hookDeps, async (appId) => {
+                const minted = await ensureGeneratedEnv(hookDeps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, () => randomBytes(32).toString('hex'));
+                if (minted) {
+                    await hookDeps.coolify.bulkUpsertEnvs(appId, [
+                        { key: GITHUB_RELEASE_WEBHOOK_SECRET_ENV, value: minted },
+                    ]);
+                    return minted;
+                }
+                const live = await currentEnvValue(hookDeps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV);
+                if (!live) {
+                    throw new Error(`platform:github-release-hook: Archon lost its ${GITHUB_RELEASE_WEBHOOK_SECRET_ENV} between two reads`);
+                }
+                return live;
+            });
+        }
         if (action.system === 'heartbeats' && action.kind === 'reconcile') {
             if (!this.heartbeats) {
                 throw new Error('heartbeats:reconcile needs FoundryPlatformStepExecutor to be constructed with its heartbeats dependencies (#540)');
@@ -3890,6 +3927,8 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'vipps-agreement', path: '/vipps/agreement' },
     { name: 'usage-tick', path: '/api/usage/tick' },
     { name: 'reporting-collect', path: '/api/reporting/collect' },
+    { name: 'release-health', path: '/api/reporting/release-health' },
+    { name: 'health', path: '/api/health' },
     { name: 'org-changes', path: '/api/orgs/*/changes' },
     { name: 'org-settings', path: '/api/orgs/*/settings' },
     { name: 'org-apps', path: '/api/orgs/*/apps' },
@@ -4456,6 +4495,10 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     const cookieSecret = await ensureGeneratedEnv(deps.coolify, appId, 'AUTH_COOKIE_SECRET', () => randomBytes(32).toString('base64'));
     if (cookieSecret)
         envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+    // The secret of the organisation's release webhook: minted once, never rotated, a hand-set value kept.
+    const webhookSecret = await ensureGeneratedEnv(deps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV, () => randomBytes(32).toString('hex'));
+    if (webhookSecret)
+        envs.push({ key: GITHUB_RELEASE_WEBHOOK_SECRET_ENV, value: webhookSecret });
     const runtimeUrl = await ensureArchonRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     if (runtimeUrl)
         envs.push({ key: 'DATABASE_URL', value: runtimeUrl });
@@ -4492,6 +4535,12 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     if (effectiveCookieSecret) {
         archonEnvHashOverrides.set('AUTH_COOKIE_SECRET', effectiveCookieSecret);
     }
+    const effectiveWebhookSecret = webhookSecret ??
+        (await currentEnvValue(deps.coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV));
+    if (effectiveWebhookSecret) {
+        archonEnvHashOverrides.set(GITHUB_RELEASE_WEBHOOK_SECRET_ENV, effectiveWebhookSecret);
+        runtime.onSecret?.(effectiveWebhookSecret);
+    }
     const effectiveRuntimeUrl = runtimeUrl ?? (await currentEnvValue(deps.coolify, appId, 'DATABASE_URL'));
     if (effectiveRuntimeUrl) {
         archonEnvHashOverrides.set('DATABASE_URL', effectiveRuntimeUrl);
@@ -4939,6 +4988,9 @@ async function provisionPlatformArchon(context, deps, ownerCompany = null) {
     // when no deploy was needed this run, left exactly as it already was --
     // `envsHashChanged` false means it already equals `envsHash`).
     await record(PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, envsHash);
+    if (effectiveWebhookSecret) {
+        await record(PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY, createHash('sha256').update(effectiveWebhookSecret).digest('hex'));
+    }
     // Last, after every write the applied values depend on, so a run that failed
     // halfway plans again.
     await record(PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
@@ -5724,6 +5776,26 @@ async function authAppsNotRunning(coolify, recordedIds) {
     }
     return false;
 }
+/**
+ * Archon's live release webhook secret is missing, or is not the one its last deploy recorded
+ * (`PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY`): the release hook step wrote it after Archon's
+ * last deploy, so the running Archon does not have it. A Coolify read error counts as not drifted.
+ */
+async function archonWebhookSecretDrifted(coolify, appId, recorded) {
+    if (!appId)
+        return false;
+    try {
+        const live = await currentEnvValue(coolify, appId, GITHUB_RELEASE_WEBHOOK_SECRET_ENV);
+        if (!live)
+            return true;
+        return (recorded[PLATFORM_ARCHON_WEBHOOK_SECRET_DEPLOYED_SCOPE_KEY] !==
+            createHash('sha256').update(live).digest('hex'));
+    }
+    catch (error) {
+        console.error(`platform:archon: could not read Archon's webhook secret from Coolify (${error instanceof Error ? error.name : 'error'})`);
+        return false;
+    }
+}
 async function archonRollingUpdateDrifted(coolify, appId) {
     if (!appId)
         return false;

package/dist/plan/proxy-labels.d.ts

@@ -51,7 +51,19 @@ export declare function entryRoutes(org: DeclaredOrg, recorded?: Readonly<Record
     hostname: string;
     service: string;
 }>;
-/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+/**
+ * The tunnel routes of the company's Boule and Agora that run behind a balancer: their names go to it once the
+ * structure on the primary is applied. Until then (and for an app that does not declare blue/green) a name keeps
+ * the Coolify proxy origin it had, so none appears here.
+ */
+export declare function builtinRoutes(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): Array<{
+    hostname: string;
+    service: string;
+}>;
+/**
+ * The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}.
+ * A built-in app's balancer route is added only when there is one, so a company without it keeps its marker.
+ */
 export declare function entryRoutesMarker(org: DeclaredOrg, recorded?: Readonly<Record<string, string>>): string;
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the

package/dist/plan/proxy-labels.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { PRIMARY_SERVER_SCOPE_KEY, balancerApplied, lbAppName, liveAppNameFor, } from './blue-green.js';
+import { BUILTIN_APPS, PRIMARY_SERVER_SCOPE_KEY, balancerApplied, builtinSubject, lbAppName, lbOrigin, liveAppNameFor, } from './blue-green.js';
 import { entryHostnames, wildcardHostname } from './hostnames.js';
 import { NO_DOMAIN_ZONE } from './own-hostnames.js';
 import { appNameFor } from './platform-diff.js';
@@ -85,9 +85,32 @@ export function entryRoutes(org, recorded = {}) {
         routes.push(wildcard);
     return routes;
 }
-/** The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}. */
+/**
+ * The tunnel routes of the company's Boule and Agora that run behind a balancer: their names go to it once the
+ * structure on the primary is applied. Until then (and for an app that does not declare blue/green) a name keeps
+ * the Coolify proxy origin it had, so none appears here.
+ */
+export function builtinRoutes(org, recorded = {}) {
+    const routes = [];
+    for (const app of BUILTIN_APPS) {
+        const subject = builtinSubject(org, app, recorded);
+        if (!subject || !balancerApplied(subject.id, recorded, recorded[PRIMARY_SERVER_SCOPE_KEY])) {
+            continue;
+        }
+        for (const hostname of subject.hostnames) {
+            routes.push({ hostname, service: lbOrigin(subject) });
+        }
+    }
+    return routes;
+}
+/**
+ * The scope value recording the routes the tunnel step last wrote; the planner compares it to {@link entryRoutes}.
+ * A built-in app's balancer route is added only when there is one, so a company without it keeps its marker.
+ */
 export function entryRoutesMarker(org, recorded = {}) {
-    return JSON.stringify(entryRoutes(org, recorded));
+    const builtin = builtinRoutes(org, recorded);
+    const routes = entryRoutes(org, recorded);
+    return JSON.stringify(builtin.length > 0 ? [...routes, ...builtin] : routes);
 }
 /**
  * A short digest of the spec; the same spec always gives the same hash. The token is left out: the

package/dist/plan/release-host.d.ts

@@ -21,7 +21,7 @@ export interface ReleaseHost {
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
     context: ReleaseContext;
-    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
+    coolify: Pick<CoolifyPort, 'getApplication' | 'updateApplication' | 'bulkUpsertEnvs' | 'listEnvs' | 'deployAndWait' | 'raw' | 'listStorages' | 'createFileStorage' | 'updateFileStorage'> & {
         listApplicationDeployments?: CoolifyPort['listApplicationDeployments'];
     };
     /** Reads the entry's health token (`sharedSecretRef(org.id, healthTokenName(id))`). Never mints. */

package/dist/plan/release-host.js

@@ -1,6 +1,6 @@
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease } from '../release/run.js';
-import { applyBlueGreenWeights } from './blue-green-apply.js';
+import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
 import { DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, parseWeights, reportingEnv, } from './blue-green.js';
 import { waitForNewDeployment } from './deploy-health.js';
 import { isNotFoundError } from './executor.js';
@@ -19,21 +19,23 @@ export function createReleaseHost(input) {
     const id = subject.id;
     const recorded = () => context.recordedIds();
     /** Every Coolify app of `color`, one per server that has the structure applied. */
-    const colorApps = (color) => {
+    const colorAppsOnServers = (color) => {
         const ids = recorded();
         const apps = [];
         if (color === 'blue')
-            apps.push(input.primaryBlueAppId);
+            apps.push({ appId: input.primaryBlueAppId, server: input.primaryUuid });
         const prefix = `bg.${id}.app.`;
         for (const key of Object.keys(ids).sort()) {
             if (!key.startsWith(prefix) || !key.endsWith(`.${color}`))
                 continue;
             const value = ids[key];
+            const server = key.slice(prefix.length, key.length - color.length - 1);
             if (value)
-                apps.push(value);
+                apps.push({ appId: value, server });
         }
         return apps;
     };
+    const colorApps = (color) => colorAppsOnServers(color).map((a) => a.appId);
     const primaryColorApp = (color) => color === 'blue' ? input.primaryBlueAppId : recorded()[bgKey.app(id, input.primaryUuid, color)];
     /**
      * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
@@ -66,21 +68,39 @@ export function createReleaseHost(input) {
     const deployTo = async (color, digest) => {
         if (!COMMIT.test(digest))
             throw new Error(`${input.label}: the release is not a built commit`);
-        const token = await input.healthToken();
-        if (!token)
-            throw new Error(`${input.label}: the health token is not held`);
-        input.secret(token);
-        const apps = colorApps(color);
+        const token = subject.reporting ? await input.healthToken() : null;
+        if (subject.reporting) {
+            if (!token)
+                throw new Error(`${input.label}: the health token is not held`);
+            input.secret(token);
+        }
+        const apps = colorAppsOnServers(color);
         if (apps.length === 0)
             throw new Error(`${input.label}: ${color} has no app recorded`);
-        for (const appId of apps) {
+        for (const { appId, server } of apps) {
             await input.renew();
             await coolify.updateApplication(appId, { git_commit_sha: digest });
+            // The color takes blue's env as it is now, so a change made after the structure apply (sign-in, mail,
+            // credentials) reaches it before it serves. Blue on the primary is the source itself.
+            let source = [];
+            if (appId !== input.primaryBlueAppId) {
+                try {
+                    source = await coolify.listEnvs(input.primaryBlueAppId);
+                }
+                catch {
+                    throw new Error(`${input.label}: reading the env of the blue app failed`);
+                }
+            }
+            const refreshed = copiedEnv({ label: input.label, secret: input.secret }, subject, source, {
+                uuid: server,
+                primaryUuid: input.primaryUuid,
+            });
+            const reporting = token ? reportingEnv({ color, release: digest, healthToken: token }) : [];
             try {
-                await coolify.bulkUpsertEnvs(appId, reportingEnv({ color, release: digest, healthToken: token }).map((e) => ({
-                    ...e,
-                    literal: true,
-                })));
+                const envs = [...refreshed, ...reporting];
+                if (envs.length > 0) {
+                    await coolify.bulkUpsertEnvs(appId, envs.map((e) => ({ ...e, literal: true })));
+                }
             }
             catch {
                 // A Coolify error can echo the request body, which holds the token.
@@ -128,6 +148,7 @@ export function createReleaseHost(input) {
                 address: await checkColorAddress({
                     ...addressOf(color),
                     healthPath: subject.healthPath,
+                    expectJson: subject.reporting && subject.healthPath === '/api/health',
                     ...(input.fetch ? { fetchImpl: input.fetch } : {}),
                 }),
             };
@@ -221,6 +242,7 @@ export async function runSubjectRelease(input) {
         entry: subject.config,
         now: input.now,
         deps: input.host.deps,
+        ...(subject.reporting ? {} : { hardOnly: true }),
     });
     for (const [key, value] of Object.entries(result.writes)) {
         if (value === null)