From dbb75871ae97a90b4026d22cd10484c534a79480 Mon Sep 17 00:00:00 2001
From: github-ops <github-ops@rmcp.itexp.me>
Date: Wed, 24 Jun 2026 06:41:10 +0000
Subject: [PATCH] Remove manual deploy workflow

---
 .gitea/workflows/deploy.yml | 234 ------------------------------------
 1 file changed, 234 deletions(-)
 delete mode 100644 .gitea/workflows/deploy.yml

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
deleted file mode 100644
index 641a101..0000000
--- a/.gitea/workflows/deploy.yml
+++ /dev/null
@@ -1,234 +0,0 @@
-name: Manual Deploy
-
-on:
-  workflow_dispatch:
-
-env:
-  REGISTRY: git.itexp.me
-  IMAGE_TAG: ${{ gitea.sha }}
-  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
-  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
-  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
-  OPENBAO_ENV_FILE: .openbao-env
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Verify runner toolchain
-        run: |
-          docker --version
-          command -v bao
-          bao version
-
-      - name: Load deployment secrets from OpenBao
-        env:
-          BAO_ADDR: ${{ secrets.BAO_ADDR }}
-          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
-          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
-          OPENBAO_APP: crank
-        run: scripts/load-openbao-env.sh
-
-      - name: Login to registry
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
-            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
-
-      - name: Build and push images
-        run: |
-          docker build -f apps/admin-api/Dockerfile \
-            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
-            -t '${{ env.ADMIN_API_IMAGE }}:main' \
-            .
-          docker build -f apps/mcp-server/Dockerfile \
-            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
-            -t '${{ env.MCP_SERVER_IMAGE }}:main' \
-            .
-          docker build -f apps/ui/Dockerfile \
-            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
-            -t '${{ env.UI_IMAGE }}:main' \
-            .
-          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
-          docker push '${{ env.ADMIN_API_IMAGE }}:main'
-          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
-          docker push '${{ env.MCP_SERVER_IMAGE }}:main'
-          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
-          docker push '${{ env.UI_IMAGE }}:main'
-
-      - name: Configure SSH key
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-
-      - name: Configure known hosts
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          if [ -n "${DEPLOY_KNOWN_HOSTS:-}" ]; then
-            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
-          else
-            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > ~/.ssh/known_hosts
-          fi
-          chmod 644 ~/.ssh/known_hosts
-
-      - name: Sync deployment files to server
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
-            "mkdir -p '$DEPLOY_PATH'"
-          rsync -az -e "ssh -p $DEPLOY_PORT" deploy/community/docker-compose.yml \
-            "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml"
-
-      - name: Write environment file
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          tmp_env="$(mktemp)"
-          append_if_set() {
-            if [ -n "$2" ]; then
-              printf '%s=%s\n' "$1" "$2" >> "$tmp_env"
-            fi
-          }
-          : > "$tmp_env"
-          append_if_set POSTGRES_DB "$POSTGRES_DB"
-          append_if_set POSTGRES_USER "$POSTGRES_USER"
-          append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
-          append_if_set POSTGRES_HOST "$POSTGRES_HOST"
-          if [ -n "${POSTGRES_PORT:-}" ]; then
-            append_if_set POSTGRES_PORT "$POSTGRES_PORT"
-          elif [ -n "${PGBOUNCER_PORT:-}" ]; then
-            append_if_set POSTGRES_PORT "$PGBOUNCER_PORT"
-          fi
-          append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
-          append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND"
-          append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
-          append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
-          append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
-          append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL"
-          append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY"
-          append_if_set CRANK_BASE_URL "$CRANK_BASE_URL"
-          append_if_set CRANK_CACHE_BACKEND "$CRANK_CACHE_BACKEND"
-          append_if_set CRANK_CACHE_URL "$CRANK_CACHE_URL"
-          append_if_set CRANK_CACHE_DEFAULT_TTL_MS "$CRANK_CACHE_DEFAULT_TTL_MS"
-          append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET"
-          append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER"
-          append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS"
-          append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL"
-          append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD"
-          append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME"
-          append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED"
-          {
-            printf 'COMPOSE_PROJECT_NAME=community\n'
-            printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' '${{ env.ADMIN_API_IMAGE }}' '${{ env.IMAGE_TAG }}'
-            printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' '${{ env.MCP_SERVER_IMAGE }}' '${{ env.IMAGE_TAG }}'
-            printf 'CRANK_UI_IMAGE=%s:%s\n' '${{ env.UI_IMAGE }}' '${{ env.IMAGE_TAG }}'
-          } >> "$tmp_env"
-          cat "$tmp_env" | ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
-            "mkdir -p '$DEPLOY_PATH' && cat > '$DEPLOY_PATH/.env'"
-          rm -f "$tmp_env"
-
-      - name: Validate required environment variables
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
-            set -e
-            cd '$DEPLOY_PATH'
-            required_vars='
-              POSTGRES_HOST
-              POSTGRES_PORT
-              POSTGRES_DB
-              POSTGRES_USER
-              POSTGRES_PASSWORD
-              CRANK_MASTER_KEY
-              CRANK_SESSION_SECRET
-              CRANK_PASSWORD_PEPPER
-              CRANK_BOOTSTRAP_ADMIN_EMAIL
-              CRANK_BOOTSTRAP_ADMIN_PASSWORD
-              CRANK_BASE_URL
-            '
-            for var in \$required_vars; do
-              value=\$(grep -E \"^\${var}=\" .env | tail -n1 | cut -d= -f2- || true)
-              if [ -z \"\$value\" ]; then
-                echo \"missing required env: \$var\" >&2
-                exit 1
-              fi
-            done
-          "
-
-      - name: Deploy with Docker Compose
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
-            set -e
-            cd '$DEPLOY_PATH'
-            compose_profiles=''
-            cache_backend=\$(grep -E '^CRANK_CACHE_BACKEND=' .env | tail -n1 | cut -d= -f2- || true)
-            if [ \"\$cache_backend\" = 'valkey' ] || [ \"\$cache_backend\" = 'redis' ]; then
-              compose_profiles='--profile cache'
-            fi
-            echo '$DEPLOY_REGISTRY_TOKEN' | docker login '${{ env.REGISTRY }}' -u '$DEPLOY_REGISTRY_USER' --password-stdin
-            docker compose \$compose_profiles config -q
-            docker compose \$compose_profiles pull
-            docker compose \$compose_profiles down --remove-orphans
-            for container in \
-              crank-ui-1 \
-              crank-admin-api-1 \
-              crank-mcp-server-1 \
-              crank-postgres-1 \
-              crank-valkey-1 \
-              crank-community-ui-1 \
-              crank-community-admin-api-1 \
-              crank-community-mcp-server-1 \
-              crank-community-postgres-1 \
-              crank-community-valkey-1; do
-              if docker ps -a --format '{{.Names}}' | grep -Fx \"\$container\" >/dev/null; then
-                docker rm -f \"\$container\"
-              fi
-            done
-            echo 'Docker containers before freeing required ports:'
-            docker ps --format 'table {{.ID}}\t{{.Names}}\t{{.Ports}}'
-            for port in 3000 3001 3002; do
-              container_ids=\$(docker ps -aq --filter \"publish=\$port\")
-              if [ -n \"\$container_ids\" ]; then
-                echo \"Removing containers publishing port \$port\"
-                docker inspect --format '{{.Name}} {{json .NetworkSettings.Ports}}' \$container_ids || true
-                docker rm -f \$container_ids
-              fi
-            done
-            if command -v ss >/dev/null 2>&1; then
-              ss -ltnp '( sport = :3000 or sport = :3001 or sport = :3002 )' || true
-            fi
-            docker compose \$compose_profiles up -d --remove-orphans
-          "
-
-      - name: Verify health endpoints
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
-            set -e
-            cd '$DEPLOY_PATH'
-            for attempt in \$(seq 1 30); do
-              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
-                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
-                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
-                exit 0
-              fi
-              sleep 2
-            done
-            echo 'deployment health verification failed' >&2
-            docker compose ps >&2
-            exit 1
-          "
-
-      - name: Run authenticated product smoke
-        run: |
-          . "$OPENBAO_ENV_FILE"
-          CRANK_STAGING_ADMIN_EMAIL="$CRANK_BOOTSTRAP_ADMIN_EMAIL" \
-          CRANK_STAGING_ADMIN_PASSWORD="$CRANK_BOOTSTRAP_ADMIN_PASSWORD" \
-          scripts/authenticated-product-smoke.sh "$CRANK_BASE_URL"