Converge CI/CD to deterministic 4-workflow architecture with bounded self-heal and provider-agnostic deployment#238
Conversation
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/3c2458ad-668b-49fc-9f9e-5bf4a0fdb2f1 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/3c2458ad-668b-49fc-9f9e-5bf4a0fdb2f1 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
SMSDAO
left a comment
SMSDAO
left a comment
There was a problem hiding this comment.
🚨 P238 FOLLOW-UP — REMOVE LEGACY VERCEL COUPLING + DEPLOYMENT CONVERGENCE
Requesting changes before merge approval.
Current CI/CD remains coupled to blocked legacy Vercel infrastructure:
- GXQ.vercel.app
- TradeOS.vercel.app
This is creating deployment instability, failing checks, and non-deterministic workflow behavior.
Required Convergence Actions
1. Remove Legacy Vercel Coupling
Audit and remove:
- hardcoded Vercel domains
- stale project/org references
- obsolete preview URLs
- blocked deployment hooks
- invalid deployment secrets
- provider-coupled CI assumptions
Required:
- no hardcoded GXQ.vercel.app references
- no hardcoded TradeOS.vercel.app references
2. Make CI Hosting-Provider Agnostic
CI must pass without:
- active Vercel account
- deployment tokens
- preview deployments
- org access
Core CI only:
- lint
- typecheck
- test
- build
Deployment must become optional/non-blocking until fresh infrastructure is established.
3. Deployment Workflow Refactor
Required behavior:
- graceful deploy skip if secrets absent
- no CI hard-fail from deployment provider issues
- preview deploys optional only
- production deploys protected and deterministic
No recursive deployment/self-healing mutation loops.
4. Prepare Future Single-Domain Architecture
Converge toward:
TradeOS.app
Required:
- deployment abstraction layer
- centralized domain resolution
- environment normalization
- provider-independent deployment config
Suggested:
config/deployment.ts
5. Environment + Workflow Cleanup
Normalize:
- .env.example
- deployment variables
- CI variables
- local development variables
Remove:
- dead Vercel IDs
- obsolete deployment references
- stale preview configuration
Success Criteria
Merge readiness requires:
- clean local build
- deterministic CI
- no legacy Vercel dependency
- workflows stable without deployment secrets
- localhost fully operational
- future deployment path preserved
- no hidden provider coupling
Current recommendation:
keep deployment workflows optional until new clean infrastructure is provisioned.
Production convergence target:
TradeOS.app
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/c8c88e83-7824-4ac2-8ca0-78170625a1d0 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/c8c88e83-7824-4ac2-8ca0-78170625a1d0 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Implemented in |
There was a problem hiding this comment.
Pull request overview
Converges the repository’s CI/CD automation into a deterministic, reduced workflow set and centralizes deployment/domain configuration so runtime consumers (scripts + API CORS) no longer depend on legacy Vercel hostnames.
Changes:
- Replaces the previous high-entropy GitHub Actions graph with four workflows:
ci,security,deploy,self-heal, removing self-mutating/overlapping pipelines. - Adds deterministic convergence/diagnostics tooling (
scripts/converge.sh,scripts/doctor.ts) and surfaces recommended branch protection checks. - Centralizes deployment URL/origin logic via
config/deployment.tsand updates runtime consumers + docs/env templates to useTradeOS.appdefaults.
Reviewed changes
Copilot reviewed 40 out of 41 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| webapp/.env.example | Adds NEXT_PUBLIC_APP_URL to document the public webapp origin. |
| tsconfig.json | Includes config/**/* in compilation inputs so new deployment config is built/typed. |
| scripts/doctor.ts | Adds a “platform doctor” diagnostic script for env/templates, workflows, TS paths, etc. |
| scripts/converge.sh | Adds an idempotent convergence script with bounded retry behavior for CI/self-heal. |
| scripts/canary-deployment.ts | Switches canary URLs to use centralized deployment config. |
| rename-vercel-hosts.yml | Removes legacy root-level hostname replacement workflow file. |
| package.json | Adds converge/doctor scripts and pins packageManager to npm@10. |
| docs/stuck.md | Updates documented deployment URLs to TradeOS.app. |
| docs/IMPLEMENTATION_SUMMARY_OLD.md | Updates documented CORS allowed domains to TradeOS.app. |
| docs/ENDPOINT_CONFIGURATION.md | Updates documented allowed domains to TradeOS.app. |
| docs/DEPLOYMENT_GUIDE.md | Updates example staging/production URLs to staging.tradeos.app / TradeOS.app. |
| docs/DEPLOYMENT_AUTOMATION.md | Updates documented production URL to TradeOS.app. |
| docs/ci-audit.md | Adds an audit record of removed/kept workflows and convergence rationale. |
| docs/CANARY_DEPLOYMENT.md | Updates canary deployment examples to new staging/production URLs. |
| docs/branch-protection.md | Adds recommended required checks aligned with the converged workflows. |
| docs/archive/VERCEL_DEPLOYMENT.md | Updates archived doc URLs to TradeOS.app. |
| docs/archive/COMPLETE_IMPLEMENTATION.md | Updates archived doc URLs to TradeOS.app. |
| config/deployment.ts | Introduces centralized deployment/provider config and derived allowed origins. |
| api/middleware/cors.ts | Uses centralized allowed-origins list for production CORS decisions. |
| .github/workflows/sync-railway-secrets.yml | Removes legacy Railway secret sync workflow. |
| .github/workflows/self-optimize.yml | Removes legacy self-optimizing (repo-mutating) workflow. |
| .github/workflows/self-heal.yml | Adds bounded, non-mutating “self-heal” workflow running scripts/converge.sh. |
| .github/workflows/security.yml | Adds centralized security lane (audit, dependency review, secret scanning). |
| .github/workflows/rename-vercel-hosts.yml | Removes legacy workflow that pushed/PR’d hostname mutations. |
| .github/workflows/powershell-merge-automation.yml | Removes legacy branch merge automation workflow. |
| .github/workflows/performance-monitoring.yml | Removes legacy performance monitoring workflow. |
| .github/workflows/gxq-scheduled-health.yml | Removes legacy scheduled health-check workflow. |
| .github/workflows/gxq-pr-check.yml | Removes legacy PR check workflow. |
| .github/workflows/gxq-master-ci.yml | Removes legacy “master CI” workflow. |
| .github/workflows/failed-job-handler.yml | Removes legacy failed-job retry/issue workflow. |
| .github/workflows/docker-build.yml | Removes legacy Docker build/push workflow. |
| .github/workflows/deploy.yml | Adds gated deploy workflow (preview optional; production triggered by successful ci run). |
| .github/workflows/deploy-railway.yml | Removes legacy Railway deploy workflow. |
| .github/workflows/deploy-railway-preview.yml | Removes legacy Railway preview deploy workflow. |
| .github/workflows/deploy-preview.yml | Removes legacy Vercel preview deploy workflow. |
| .github/workflows/complete-production-pipeline.yml | Removes legacy all-in-one production pipeline (incl. mutation paths). |
| .github/workflows/codeql-analysis.yml | Removes legacy CodeQL workflow (security lane now centralizes checks). |
| .github/workflows/ci.yml | Replaces prior comprehensive pipeline with deterministic lint, typecheck, test, build jobs. |
| .github/workflows/autonomous-oracle-pipeline.yml | Removes legacy autonomous “oracle” workflow that could push commits. |
| .github/workflows/auto-label.yml | Removes legacy PR auto-labeling workflow. |
| .env.example | Adds provider-agnostic deployment variables and updates staging/production URL defaults. |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: refs/heads/main |
| github.event.workflow_run.event == 'push' && | ||
| github.event.workflow_run.head_repository.full_name == github.repository | ||
| runs-on: ubuntu-latest | ||
| continue-on-error: true |
| - run: npm ci --no-audit --no-fund | ||
| - run: npm --prefix webapp ci --no-audit --no-fund | ||
| - run: npm test | ||
| - run: npm run test:webapp |
| PRODUCTION_URL=https://gxq.vercel.app | ||
| DEPLOYMENT_PROVIDER=none | ||
| DEPLOY_PREVIEW_ENABLED=false | ||
| DEPLOYMENT_PRIMARY_DOMAIN=https://TradeOS.app |
SMSDAO
left a comment
SMSDAO
left a comment
There was a problem hiding this comment.
🚨 Request Changes — PR #238 Needs Conversion to Patch-Level Fix
This PR is currently still at architectural/spec level, not yet a mergeable implementation patch.
To make this PR approvable, it must be converted into deterministic code changes with file-level diffs.
⸻
🔧 Required Actions Before Merge
- Convert from spec → patch PR
Must include actual repo changes:
• .github/workflows/* refactor (CI independence)
• removal or neutralization of vercel.json
• environment cleanup (.env.example)
• deployment abstraction layer (provider-agnostic)
• CI gating logic updated for optional deployment
PR must clearly show what changed in code, not only design intent.
⸻
- CI Independence Proof Required
PR description must explicitly confirm:
• npm install && npm run build works without Vercel credentials
• CI passes with:
• no VERCEL_TOKEN
• no deployment secrets
• deploy step does NOT fail when disabled or skipped
This is required for merge validation.
⸻
- Add Deployment Guard Pattern
Must be implemented in code:
• If VERCEL_TOKEN is missing → skip deploy gracefully
• If present → deploy normally
• CI must NEVER fail due to deployment layer
Deployment must be optional, not blocking.
⸻
- Keep PR #238 (do NOT split)
Do not open a new PR — splitting will fragment stabilization context.
Instead:
• upgrade this PR into a deterministic CI stabilization patch PR
⸻
• Where exactly are Vercel dependencies removed?
• What happens if deployment fails?
• How is deployment handled now?
• Does local build remain unchanged?
⸻
🧩 Merge Readiness Checklist
Repo-level
• No hardcoded Vercel domains
• No legacy project references
• No required Vercel CI gating
Workflow-level
• CI independent of hosting provider
• Deploy is optional / non-blocking
• No recursive automation loops
Runtime-level
• Clean local build
• No regression in dev workflow
⸻
⚙️ Summary
This PR is directionally correct but not yet merge-ready.
It must be upgraded from:
architectural guidance
to:
deterministic, file-level implementation patch
Once that conversion is done, it becomes safe for merge.
…ehavior Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
…erminism Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Converted to concrete patch-level implementation in What changed:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 42 out of 43 changed files in this pull request and generated 4 comments.
Comments suppressed due to low confidence (1)
api/middleware/cors.ts:145
allowedDomainsnow comes fromgetAllowedOrigins(), and the subsequent check uses string prefix matching (origin.startsWith(domain)). This is case-sensitive (mixed-case domains likehttps://TradeOS.appcan fail to match browserOriginheaders) and can be bypassed by origins such ashttps://tradeos.app.evil.com. Prefer parsing/normalizingoriginand doing exact origin/host comparisons against the allow-list.
const allowedDomains = getAllowedOrigins();
// Allow requests with no origin (mobile apps, curl, etc.)
if (!origin) return true;
| validate_vercel_config() { | ||
| log "validate vercel config" | ||
| [ -f vercel.json ] || die "vercel.json missing" | ||
| [ -f webapp/vercel.json ] || die "webapp/vercel.json missing" | ||
| validate_json_file vercel.json | ||
| validate_json_file webapp/vercel.json | ||
| } |
| test) | ||
| npm test | ||
| npm run test:webapp | ||
| ;; |
| function checkVercelConfig(repoRoot: string): void { | ||
| const configs = [path.join(repoRoot, 'vercel.json'), path.join(repoRoot, 'webapp', 'vercel.json')]; | ||
|
|
||
| for (const filePath of configs) { | ||
| if (!fs.existsSync(filePath)) { | ||
| addFinding('vercel-config', 'error', `Missing ${path.relative(repoRoot, filePath)}`, 'Restore Vercel config.'); | ||
| continue; | ||
| } |
| const DEFAULT_PRODUCTION_URL = 'https://TradeOS.app'; | ||
| const DEFAULT_STAGING_URL = 'https://staging.tradeos.app'; | ||
|
|
||
| function normalizeUrl(url: string): string { | ||
| return url.endsWith('/') ? url.slice(0, -1) : url; |
|
@copilot apply changes based on the comments in this thread |
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/931fde24-2e6e-4749-8119-e2f59de5f602 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/931fde24-2e6e-4749-8119-e2f59de5f602 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/931fde24-2e6e-4749-8119-e2f59de5f602 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/931fde24-2e6e-4749-8119-e2f59de5f602 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Applied all requested fixes from that review thread in
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 42 out of 43 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
api/middleware/cors.ts:148
- The production CORS origin check uses
origin.startsWith(domain), which can be bypassed by attacker-controlled origins likehttps://tradeos.app.evil.com(it still starts withhttps://tradeos.app). Parseoriginas a URL and compare the full normalized origin (scheme + hostname + optional port) against an allowlist, or at least compare hostname equality instead of prefix matching.
// Allow requests with no origin (mobile apps, curl, etc.)
if (!origin) return true;
// Check if origin matches allowed domains
return allowedDomains.some((domain) => origin.startsWith(domain));
},
| normalize_lockfiles() { | ||
| log "normalize lockfiles" | ||
| npm install --package-lock-only --ignore-scripts --no-audit --no-fund | ||
| npm --prefix webapp install --package-lock-only --ignore-scripts --no-audit --no-fund | ||
| } |
There was a problem hiding this comment.
Implemented in 58741bf and wording refinement in d6214fe.
scripts/converge.sh now fails in --ci/--self-heal mode when git workspace drift is detected (including after lockfile normalization), and prints the changed files so lockfile drift is surfaced and fixed in a PR instead of being hidden by a successful run.
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/018cee29-e998-45e7-9d33-6905c96dee01 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/018cee29-e998-45e7-9d33-6905c96dee01 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This PR collapses a high-entropy, overlapping workflow graph into a deterministic CI/CD model to eliminate recursive automation, duplicate deploy paths, and flaky blocking checks. It preserves production deployment safeguards while making preview deployment non-blocking.
Workflow convergence (single source of truth)
.github/workflows/ci.yml.github/workflows/security.yml.github/workflows/deploy.yml.github/workflows/self-heal.ymlDeterministic CI + security lanes
ci.ymlnow contains only deterministic required jobs:lint,typecheck,test,build.security.ymlcentralizesnpm audit, dependency review, and secret scanning.npm --prefix webapp run test --if-present -- --ci --coverageso real test failures fail CI, while cleanly skipping when no webapp test script exists.Deploy hardening + provider-agnostic convergence
cicompletion onmainviaworkflow_run.workflow_runexecution contexts.github.event.workflow_run.head_shato deploy the same commit that passed CI (race-free, deterministic behavior).DEPLOYMENT_PROVIDERto decouple CI from legacy hosting assumptions.continue-on-errorfrom production deploy job so real deploy attempts fail the deploy workflow when provider is enabled/configured.Legacy Vercel coupling removal
GXQ.vercel.app/TradeOS.vercel.appreferences from active configs/docs touched by this work.rename-vercel-hosts.ymllegacy coupling artifact.vercel.jsonto neutralize legacy top-level Vercel coupling (webapp-scoped config remains inwebapp/vercel.json).Future single-domain architecture (
TradeOS.app)config/deployment.tsas centralized deployment abstraction/domain resolution layer.scripts/canary-deployment.tsapi/middleware/cors.tsDEPLOYMENT_PRIMARY_DOMAINinto deployment config fallback resolution..env.example(DEPLOYMENT_PROVIDER,DEPLOY_PREVIEW_ENABLED,DEPLOYMENT_PRIMARY_DOMAIN, normalized staging/production URLs)webapp/.env.example(NEXT_PUBLIC_APP_URL)Bounded self-healing (no mutation loops)
scripts/converge.shfor idempotent convergence operations (lockfile normalization, deterministic regeneration, config validation, quality gates).Platform diagnostics + governance docs
scripts/doctor.tsfor actionable diagnostics (env/templates, imports/cycles, TS paths, workflow graph integrity, Node/toolchain/config drift).docs/ci-audit.md(kept/removed inventory, dependency graph, risks, migration/rollback notes).docs/branch-protection.mdwith recommended required checks:ci / lintci / typecheckci / testci / buildsecurity / auditValidation evidence for provider independence
npm install(withoutVERCEL_TOKEN/Vercel secrets)npm run build(withoutVERCEL_TOKEN/Vercel secrets)