cortexapps-cli 1.30.0__tar.gz → 1.32.0__tar.gz

{cortexapps_cli-1.30.0 → cortexapps_cli-1.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortexapps-cli
-Version: 1.30.0
+Version: 1.32.0
 Summary: Command Line Interface for cortexapps
 License: MIT
 License-File: LICENSE
@@ -14,6 +14,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: PyNaCl (>=1.5.0)
 Requires-Dist: pyyaml (>=6.0.1,<7)
 Requires-Dist: requests (>=2.33.0,<3.0.0)
 Requires-Dist: typer (>=0.15,<1.0)

{cortexapps_cli-1.30.0 → cortexapps_cli-1.32.0}/cortexapps_cli/commands/integrations.py

@@ -23,6 +23,7 @@ import cortexapps_cli.commands.integrations_commands.dynatrace as dynatrace
 import cortexapps_cli.commands.integrations_commands.firehydrant as firehydrant
 import cortexapps_cli.commands.integrations_commands.github as github
 import cortexapps_cli.commands.integrations_commands.gitlab as gitlab
+import cortexapps_cli.commands.integrations_commands.harness as harness
 import cortexapps_cli.commands.integrations_commands.incidentio as incidentio
 import cortexapps_cli.commands.integrations_commands.instana as instana
 import cortexapps_cli.commands.integrations_commands.jenkins as jenkins
@@ -72,6 +73,7 @@ app.add_typer(dynatrace.app, name="dynatrace")
 app.add_typer(firehydrant.app, name="firehydrant")
 app.add_typer(github.app, name="github")
 app.add_typer(gitlab.app, name="gitlab")
+app.add_typer(harness.app, name="harness")
 app.add_typer(incidentio.app, name="incidentio")
 app.add_typer(instana.app, name="instana")
 app.add_typer(jenkins.app, name="jenkins")

cortexapps_cli-1.32.0/cortexapps_cli/commands/integrations_commands/harness.py

@@ -0,0 +1,160 @@
+import json
+from rich import print_json
+import typer
+from typing_extensions import Annotated
+
+app = typer.Typer(help="Harness commands", no_args_is_help=True)
+
+
+@app.command()
+def add(
+    ctx: typer.Context,
+    alias: str = typer.Option(..., "--alias", "-a", help="Alias for this configuration"),
+    api_key: str = typer.Option(..., "--api-key", "-k", help="Harness API key"),
+    account_id: str = typer.Option(..., "--account-id", "-id", help="Harness account ID"),
+    host: str = typer.Option(None, "--host", "-h", help="Harness host URL (optional; defaults to https://app.harness.io)"),
+    is_default: bool = typer.Option(False, "--is-default", "-i", help="Set as the default configuration"),
+    file_input: Annotated[typer.FileText, typer.Option("--file", "-f", help="JSON file containing configuration; use - for stdin")] = None,
+):
+    """
+    Add a Harness configuration
+    """
+    client = ctx.obj["client"]
+
+    if file_input:
+        if alias or api_key or account_id or host or is_default:
+            raise typer.BadParameter("When providing a configuration file, do not specify any other attributes")
+        data = json.loads("".join([line for line in file_input]))
+    else:
+        data = {
+            "alias": alias,
+            "apiKey": api_key,
+            "accountId": account_id,
+            "isDefault": is_default,
+        }
+        if host is not None:
+            data["host"] = host
+
+    r = client.post("api/v1/harness/configuration", data=data)
+    print_json(data=r)
+
+
+@app.command()
+def get(
+    ctx: typer.Context,
+    alias: str = typer.Option(..., "--alias", "-a", help="Alias of the configuration to retrieve"),
+):
+    """
+    Get a single Harness configuration by alias
+    """
+    client = ctx.obj["client"]
+    r = client.get(f"api/v1/harness/configuration/{alias}")
+    print_json(data=r)
+
+
+@app.command()
+def list(
+    ctx: typer.Context,
+):
+    """
+    List all Harness configurations
+    """
+    client = ctx.obj["client"]
+    r = client.get("api/v1/harness/configurations")
+    print_json(data=r)
+
+
+@app.command()
+def get_default(
+    ctx: typer.Context,
+):
+    """
+    Get the default Harness configuration
+    """
+    client = ctx.obj["client"]
+    r = client.get("api/v1/harness/default-configuration")
+    print_json(data=r)
+
+
+@app.command()
+def update(
+    ctx: typer.Context,
+    alias: str = typer.Option(..., "--alias", "-a", help="Alias of the configuration to update"),
+    api_key: str = typer.Option(None, "--api-key", "-k", help="New Harness API key"),
+    account_id: str = typer.Option(None, "--account-id", "-id", help="New Harness account ID"),
+    host: str = typer.Option(None, "--host", "-h", help="New Harness host URL"),
+    is_default: bool = typer.Option(None, "--is-default", "-i", help="Set as the default configuration"),
+    file_input: Annotated[typer.FileText, typer.Option("--file", "-f", help="JSON file containing update fields; use - for stdin")] = None,
+):
+    """
+    Update a Harness configuration
+    """
+    client = ctx.obj["client"]
+
+    if file_input:
+        if alias or api_key or account_id or host or is_default is not None:
+            raise typer.BadParameter("When providing a configuration file, do not specify any other attributes")
+        data = json.loads("".join([line for line in file_input]))
+    else:
+        data = {}
+        if api_key is not None:
+            data["apiKey"] = api_key
+        if account_id is not None:
+            data["accountId"] = account_id
+        if host is not None:
+            data["host"] = host
+        if is_default is not None:
+            data["isDefault"] = is_default
+
+    r = client.put(f"api/v1/harness/configuration/{alias}", data=data)
+    print_json(data=r)
+
+
+@app.command()
+def delete(
+    ctx: typer.Context,
+    alias: str = typer.Option(..., "--alias", "-a", help="Alias of the configuration to delete"),
+):
+    """
+    Delete a single Harness configuration
+    """
+    client = ctx.obj["client"]
+    r = client.delete(f"api/v1/harness/configuration/{alias}")
+    print_json(data=r)
+
+
+@app.command()
+def delete_all(
+    ctx: typer.Context,
+):
+    """
+    Delete all Harness configurations
+    """
+    client = ctx.obj["client"]
+    r = client.delete("api/v1/harness/configurations")
+    print_json(data=r)
+
+
+@app.command()
+def validate(
+    ctx: typer.Context,
+    alias: str = typer.Option(..., "--alias", "-a", help="Alias of the configuration to validate"),
+):
+    """
+    Validate a single Harness configuration
+    """
+    client = ctx.obj["client"]
+    r = client.post(f"api/v1/harness/configuration/validate/{alias}")
+    print_json(data=r)
+
+
+@app.command()
+def validate_all(
+    ctx: typer.Context,
+):
+    """
+    Validate all Harness configurations
+    """
+    client = ctx.obj["client"]
+    r = client.post("api/v1/harness/configuration/validate")
+    print_json(data=r)

{cortexapps_cli-1.30.0 → cortexapps_cli-1.32.0}/cortexapps_cli/commands/solutions.py

@@ -74,13 +74,26 @@ class _ToggleableCapture:
 
 
 def _run_import_with_toggle(fn) -> str:
-    """Run fn() capturing stdout. On a TTY, Ctrl+o toggles live output."""
+    """Run fn() capturing stdout. On a TTY, Ctrl+o toggles live output.
+
+    If fn() raises for any reason, all buffered output is flushed to the
+    terminal before the exception propagates — no silent failures.
+    """
     real_stdout = sys.stdout
     capture = _ToggleableCapture(real_stdout)
 
     if not (_TTY_SUPPORT and sys.stdin.isatty()):
-        with contextlib.redirect_stdout(capture):
-            fn()
+        success = False
+        try:
+            with contextlib.redirect_stdout(capture):
+                fn()
+            success = True
+        finally:
+            if not success:
+                buffered = capture.getvalue()
+                if buffered:
+                    real_stdout.write(buffered)
+                    real_stdout.flush()
         return capture.getvalue()
 
     done = threading.Event()
@@ -112,9 +125,11 @@ def _run_import_with_toggle(fn) -> str:
 
     t = threading.Thread(target=_listen, daemon=True)
     t.start()
+    success = False
     try:
         with contextlib.redirect_stdout(capture):
             fn()
+        success = True
     finally:
         done.set()
         t.join(timeout=0.5)
@@ -122,6 +137,11 @@ def _run_import_with_toggle(fn) -> str:
             _termios.tcsetattr(fd, _termios.TCSADRAIN, old_settings)
         except Exception:
             pass
+        if not success:
+            buffered = capture.getvalue()
+            if buffered:
+                real_stdout.write(buffered)
+                real_stdout.flush()
 
     return capture.getvalue()
 
@@ -175,6 +195,53 @@ def _get_readme(tag: str, path: str | None = None) -> str | None:
         return None
 
 
+def _has_post_install(tag: str, path: str | None = None) -> bool:
+    """Return True if this solution has a post-install setup.py."""
+    try:
+        (_solutions_root(path) / tag / "setup.py").read_bytes()
+        return True
+    except Exception:
+        return False
+
+
+def _load_setup_module(solution_tag: str, solutions_dir: str | None = None):
+    """Load a solution's setup.py module. Returns the module or None if not found."""
+    import importlib.util
+
+    root = _solutions_root(solutions_dir)
+    try:
+        with as_file(root / solution_tag / "setup.py") as setup_path:
+            spec = importlib.util.spec_from_file_location(f"{solution_tag}_setup", setup_path)
+            module = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(module)
+            return module
+    except FileNotFoundError:
+        return None
+
+
+def _get_setup_description(solution_tag: str, solutions_dir: str | None = None) -> str:
+    """Return the SETUP_DESCRIPTION from a solution's setup.py, or a generic fallback."""
+    module = _load_setup_module(solution_tag, solutions_dir)
+    if module:
+        return getattr(module, "SETUP_DESCRIPTION", "This solution includes a post-install setup script.")
+    return "This solution includes a post-install setup script."
+
+
+def _run_post_install_script(solution_tag: str, solutions_dir: str | None = None, ctx=None, no_prompt: bool = False) -> None:
+    """Find and invoke the solution's setup.py main() function."""
+    module = _load_setup_module(solution_tag, solutions_dir)
+    if module is None:
+        typer.echo("No post-install setup available for this solution.")
+        return
+    kwargs = {}
+    if ctx and ctx.obj and "client" in ctx.obj:
+        client = ctx.obj["client"]
+        kwargs["cortex_api_key"] = client.api_key
+        kwargs["cortex_base_url"] = client.base_url
+    kwargs["no_prompt"] = no_prompt
+    module.main(**kwargs)
+
+
 def _extract_first_codeblock(text: str) -> str | None:
     """Return content of the first fenced code block."""
     m = re.search(r"```[^\n]*\n(.*?)```", text, re.DOTALL)
@@ -333,10 +400,10 @@ def _run_uninstall(client, path: Path, yes: bool) -> None:
     total = sum(len(v) for v in resources.values())
 
     if total == 0:
-        typer.echo("No resources found to remove.")
+        typer.echo("No entities found to remove.")
         return
 
-    typer.echo("\nThis will remove the following resources:")
+    typer.echo("\nThis will remove the following entities:")
     for kind in ("workflows", "scorecards", "plugins", "catalog", "entity-relationship-types", "entity-types"):
         count = len(resources[kind])
         if count:
@@ -538,17 +605,6 @@ def _show_next_steps(readme: str) -> None:
             section = re.sub(r'\[([^\]]+)\]\(([^)]+)\)', r'\1 (\2)', section)
         console.print()
         console.print(Markdown(section))
-    console.print()
-    console.print(
-        "[magenta]Planned for Q4 2027:[/magenta] CQL metadata traversal will enable scorecard rules "
-        "across relationship chains — for example, a Vulnerability Scorecard checking that no "
-        "deployed service-version has open Snyk issues:"
-    )
-    console.print(
-        "  [dim]entity.destinations(relationshipType = \"environments\", depth = 3)\n"
-        "    .filter((d) => d.type == \"service-version\")\n"
-        "    .all((sv) => sv.snyk.issues == 0)[/dim]"
-    )
 
 
 def _post_install_menu(
@@ -604,6 +660,12 @@ def install(
     ctx: typer.Context,
     solution: str = typer.Option(..., "--solution", "-s", help="Solution tag"),
     no_prompt: bool = typer.Option(False, "--no-prompt", help="Skip the post-install interactive menu"),
+    skip_post_install_setup: bool = typer.Option(
+        False,
+        "--skip-post-install-setup",
+        help="Skip the post-install setup script prompt",
+        is_flag=True,
+    ),
 ):
     """Install a solution."""
     solutions_dir = ctx.obj.get("solutions_dir") if ctx.obj else None
@@ -639,10 +701,24 @@ def install(
                 typer.echo(failed_m.group(0))
             typer.echo(f"\n  {total_imported} imported, {total_failed} failed")
         else:
-            typer.echo(f"  {total_imported} resources imported")
+            typer.echo(f"  {total_imported} entities imported")
     else:
         typer.echo(output)
 
+    # Post-install setup hook — runs before the informational menu
+    if not no_prompt and not skip_post_install_setup and _has_post_install(solution, solutions_dir):
+        state_file = Path.home() / ".cortex" / "solutions" / f"{solution}.json"
+        if state_file.exists():
+            typer.echo(f"\nRetrieving previous responses from: {state_file}")
+        desc = _get_setup_description(solution, solutions_dir)
+        typer.echo(f"\n{desc}")
+        if typer.confirm("Run setup now?", default=True):
+            _run_post_install_script(solution, solutions_dir=solutions_dir, ctx=ctx)
+        else:
+            typer.echo(f"\nRun setup later with: cortex solutions post-install -s {solution}")
+    elif skip_post_install_setup and _has_post_install(solution, solutions_dir):
+        typer.echo(f"\nRun setup later with: cortex solutions post-install -s {solution}")
+
     if not no_prompt:
         readme = _get_readme(solution, solutions_dir)
         if readme:
@@ -660,6 +736,27 @@ def install(
             _post_install_menu(readme, import_report=output, entity_tags=entity_tags, ui_url=ui_url)
 
 
+@app.command(name="post-install")
+def post_install(
+    ctx: typer.Context,
+    solution: str = typer.Option(..., "--solution", "-s", help="Solution tag"),
+    no_prompt: bool = typer.Option(
+        False,
+        "--no-prompt",
+        "-N",
+        help="Use saved answers from ~/.cortex/solutions/<tag>.json without prompting.",
+    ),
+):
+    """Run post-install setup for a solution."""
+    solutions_dir = ctx.obj.get("solutions_dir") if ctx.obj else None
+    if solution not in _list_solution_tags(solutions_dir):
+        avail = ", ".join(_list_solution_tags(solutions_dir))
+        typer.echo(f"Error: Solution '{solution}' not found. Available: {avail}")
+        raise typer.Exit(1)
+    ctx.obj["client"] = _build_client(ctx)
+    _run_post_install_script(solution, solutions_dir=solutions_dir, ctx=ctx, no_prompt=no_prompt)
+
+
 @app.command()
 def uninstall(
     ctx: typer.Context,

cortexapps_cli-1.32.0/cortexapps_cli/solutions/_lib/setup_base.py

@@ -0,0 +1,183 @@
+import getpass
+import json
+import os
+import sys
+from abc import ABC, abstractmethod
+from pathlib import Path
+from typing import Optional
+
+
+class SolutionSetup(ABC):
+    """
+    Base class for solution post-install setup scripts.
+    Subclasses define solution_tag, collect_prompts(), and steps().
+    """
+
+    solution_tag: str  # must be set by subclass
+
+    def __init__(self, state_dir: Optional[Path] = None, no_prompt: bool = False):
+        self._no_prompt = no_prompt
+        self._save_answers = True
+        self._secret_keys: set = set()
+        self._answers: dict = {}
+
+        solutions_dir = state_dir or Path.home() / ".cortex" / "solutions"
+        solutions_dir.mkdir(parents=True, exist_ok=True)
+        self._state_file = solutions_dir / f"{self.solution_tag}.json"
+
+        data = self._load_file()
+        self._answers = data.get("answers", {})
+        self._state: dict = data.get("state", {})
+
+        self._migrate_old_state()
+
+    def _load_file(self) -> dict:
+        if self._state_file.exists():
+            try:
+                return json.loads(self._state_file.read_text())
+            except (json.JSONDecodeError, OSError):
+                return {}
+        return {}
+
+    def _save_file(self) -> None:
+        saved_answers = (
+            {k: v for k, v in self._answers.items() if k not in self._secret_keys}
+            if self._save_answers
+            else {}
+        )
+        data = {"answers": saved_answers, "state": self._state}
+        self._state_file.write_text(json.dumps(data, indent=2))
+
+    def _save_state(self) -> None:
+        self._save_file()
+
+    def _migrate_old_state(self) -> None:
+        """Move state from the old flat ~/.cortex/setup-<tag>.json into the new file."""
+        old_file = Path.home() / ".cortex" / f"setup-{self.solution_tag}.json"
+        if not old_file.exists():
+            return
+        try:
+            old_data = json.loads(old_file.read_text())
+            if old_data and not self._state:
+                self._state.update(old_data)
+                self._save_file()
+            old_file.unlink()
+        except Exception:
+            pass
+
+    def prompt(
+        self,
+        key: str,
+        message: str,
+        env_var: Optional[str] = None,
+        default: Optional[str] = None,
+        secret: bool = False,
+        hidden: bool = False,
+    ) -> str:
+        """Prompt for a value. Uses saved answer or env var when available.
+
+        secret=True  — mask input AND exclude from saved JSON
+        hidden=True  — mask input only; value is still saved to JSON
+        """
+        use_getpass = secret or hidden
+        if secret:
+            self._secret_keys.add(key)
+
+        # Use saved answer when --no-prompt (works for both plain and hidden keys)
+        if self._no_prompt and not secret and key in self._answers:
+            return self._answers[key]
+
+        # Saved answer takes precedence over any derived default
+        if not secret and key in self._answers:
+            default = self._answers[key]
+
+        if env_var:
+            env_val = os.environ.get(env_var)
+            if env_val:
+                masked = "********" if use_getpass else env_val
+                if self._no_prompt or self.confirm(f"{message} [{masked} from {env_var}]", default=True):
+                    self._answers[key] = env_val
+                    return env_val
+
+        # Secrets in --no-prompt mode still need a prompt if no env var provided
+        if self._no_prompt and secret and key not in self._answers:
+            print(f"  (secret required — no env var set for {key})", file=sys.stderr)
+
+        if use_getpass and default:
+            hint = f"********{default[-4:]}"
+        elif default:
+            hint = default
+        else:
+            hint = None
+        prompt_str = f"{message} [{hint}]: " if hint else f"{message}: "
+
+        if use_getpass:
+            value = getpass.getpass(prompt_str).strip()
+        else:
+            value = input(prompt_str).strip()
+        if not value:
+            value = default or ""
+        self._answers[key] = value
+        return value
+
+    def confirm(self, message: str, default: bool = True) -> bool:
+        """Y|N confirmation prompt. Auto-accepts default when --no-prompt."""
+        if self._no_prompt:
+            return default
+        hint = "[Y/n]" if default else "[y/N]"
+        response = input(f"{message} {hint}: ").strip().lower()
+        if not response:
+            return default
+        return response in ("y", "yes")
+
+    def already_done(self, key: str) -> bool:
+        """Return True if this step was previously completed."""
+        return self._state.get(key, False)
+
+    def mark_done(self, key: str) -> None:
+        """Mark a step as completed in the persistent state file."""
+        self._state[key] = True
+        self._save_file()
+
+    @abstractmethod
+    def collect_prompts(self) -> None:
+        """Collect all user inputs upfront before executing steps."""
+
+    @abstractmethod
+    def steps(self) -> list[tuple[str, callable]]:
+        """Return ordered list of (label, callable) tuples."""
+
+    def post_steps(self) -> None:
+        """Optional hook called after all steps complete. Override in subclass."""
+
+    def run(self) -> None:
+        """Collect prompts then execute steps with progress display."""
+        if self._no_prompt and self._answers:
+            saved = {k: v for k, v in self._answers.items() if k not in self._secret_keys}
+            if saved:
+                print("Using saved configuration:")
+                for k, v in saved.items():
+                    print(f"  {k}: {v}")
+                print()
+        elif not self._no_prompt:
+            self._save_answers = self.confirm(f"Save answers for future runs to {self._state_file}", default=True)
+
+        self.collect_prompts()
+        self._save_file()
+
+        print()
+        step_list = self.steps()
+        total = len(step_list)
+        for i, (label, fn) in enumerate(step_list, 1):
+            try:
+                detail = fn()
+                print(f"[{i}/{total}] {label}... \u2713")
+                if detail:
+                    lines = [detail] if isinstance(detail, str) else detail
+                    for line in lines:
+                        print(f"  {line}")
+                print()
+            except Exception as e:
+                print(f"[{i}/{total}] {label}... \u2717  {e}", file=sys.stderr)
+                raise SystemExit(1)
+        self.post_steps()

cortexapps_cli-1.32.0/cortexapps_cli/solutions/github-actions-deploy/README.md

@@ -0,0 +1,97 @@
+---
+name: GitHub Actions Deploy Tracking
+description: Track deployments from GitHub Actions in Cortex, with a deploy health scorecard measuring delivery cadence.
+---
+
+# GitHub Actions Deploy Tracking
+
+Trigger deploys from Cortex, track them as they run in GitHub Actions, and surface deploy health back in your service catalog.
+
+```
+  ┌─────────────────────────────────┐
+  │         Cortex Catalog          │
+  │                                 │
+  │  github-actions-demo  (service) │
+  │  ├── x-cortex-git.github        │
+  │  │     repository: owner/repo   │
+  │  └── Scorecard: Deploy Health   │
+  │        Bronze / Silver / Gold   │
+  └──────────────┬──────────────────┘
+                 │
+                 │  Run workflow from entity page
+                 │  (or: cortex workflows run -t
+                 │   github-actions-deploy
+                 │   --scope ENTITY --entity <tag>)
+                 ▼
+  ┌─────────────────────────────────┐
+  │       Cortex Workflow           │
+  │  Solution: Add Cortex Deploy    │
+  │       from GitHub Actions       │
+  │                                 │
+  │  1. Read linked repo from       │
+  │     entity catalog config       │
+  │  2. POST workflow_dispatch      │
+  │     to GitHub Actions           │
+  │  3. Wait for callback           │
+  └──────────────┬──────────────────┘
+                 │  POST /dispatches  (GitHub integration)
+                 ▼
+  ┌─────────────────────────────────┐
+  │        GitHub Actions           │
+  │    cortex-deploy.yml            │
+  │                                 │
+  │  job: build                     │
+  │    └── run your deploy steps    │
+  │                                 │
+  │  job: cortex-callback           │
+  │    ├── POST /deploys            │◄── registers deploy event
+  │    │   (entity: github-actions- │    on the Cortex entity
+  │    │    demo)                   │
+  │    └── POST callbackUrl  ───────┼──► Cortex marks workflow
+  │        status: SUCCESS/FAILURE  │    run complete
+  └─────────────────────────────────┘
+```
+
+## What's Included
+
+- **Entity:** `github-actions-demo` service — a sample entity to receive deploy events
+- **Scorecard:** Deploy Health — Bronze/Silver/Gold based on deploy frequency
+- **GitHub Actions workflow:** `cortex-deploy.yml` — a two-job workflow (build → notify) seeded into your GitHub repo
+- **Cortex workflow:** `github-actions-deploy` — reads the linked repo from the entity, triggers the GitHub Actions deploy, and waits for the result
+- **Setup script:** Interactive wizard that creates and seeds a GitHub repo end-to-end
+
+## Quick Start
+
+1. Install the solution:
+
+   ```
+   cortex solutions install -s github-actions-deploy
+   ```
+
+2. Follow the post-install setup prompts, or run later:
+
+   ```
+   cortex solutions post-install -s github-actions-deploy
+   ```
+
+## How It Works
+
+The Cortex workflow reads `x-cortex-git.github.repository` from the entity's catalog config to determine which GitHub repo to deploy. It triggers `cortex-deploy.yml` via `workflow_dispatch` and waits asynchronously for a callback.
+
+GitHub Actions runs the build, then notifies Cortex twice on completion:
+- **Deploy registration** (`POST /api/v1/catalog/{tag}/deploys`) — records the deploy event on the entity, feeding the Deploy Health scorecard
+- **Workflow callback** — signals the Cortex workflow run as SUCCESS or FAILURE
+
+## After Installing
+
+If you ran the post-install setup, you're already done — it created the GitHub repo, seeded the workflow, set secrets, linked the entity, and triggered a test deploy.
+
+To roll the pattern out to your own services, add `cortex-deploy.yml` to any GitHub repo and link that repo to its Cortex entity. The same **Solution: Add Cortex Deploy from GitHub Actions** workflow will work across all of them — it reads the linked repo from the entity automatically.
+
+## Customizing for Production
+
+- Point the workflow at your real entity by replacing `github-actions-demo` with your service tag
+- Add `CORTEX_API_KEY` and `CORTEX_BASE_URL` secrets to your real repos
+- The Deploy Health scorecard is scoped to `demo-github-actions-deploys` to avoid affecting your
+  existing services. To roll it out broadly, remove the group filter from the scorecard.
+  To opt in individual services, add the `demo-github-actions-deploys` group to them.