oc-deploy-ops

# Deploy Ops

**On first invocation, read `references/orchestrator.md` and follow its welcome protocol.**

Orchestrate the full deployment lifecycle: pre-deploy quality gate → staging deploy →
smoke test → production promotion → health check → rollback if needed. Built for
Cloudflare Workers + D1 + Pages, with the aidops-core monorepo as the primary target.

## /oc-deploy — Command Reference

When the user types `/oc-deploy`, display this menu:

```
DEPLOY OPS COMMANDS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  PIPELINE
  /oc-deploy staging    Deploy to staging environment
  /oc-deploy prod       Promote staging to production (or direct deploy)
  /oc-deploy rollback   Revert to previous production version
  /oc-deploy status     Show current deployment state

  GATES
  /oc-deploy audit      Run pre-deploy audit (calls oc-code-auditor)
  /oc-deploy smoke      Run post-deploy smoke tests
  /oc-deploy health     Check production health

  SETUP
  /oc-deploy init       Set up deployment config for a project
  /oc-deploy env        Manage environment variables and secrets

  UTILITIES
  /checkpoint        Show checkpoint status

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Type any command to begin. /oc-deploy to see this again.
```

---

## How This Skill Works

```
CODE (committed)
    │
    ▼
┌────────────┐     FAIL → block
│ Pre-deploy │─────────────────► Fix issues first
│ audit gate │
└─────┬──────┘
      │ PASS
      ▼
┌────────────┐
│  Staging   │──► smoke tests ──► FAIL → fix + redeploy
│  deploy    │
└─────┬──────┘
      │ PASS
      ▼
┌────────────┐
│ Production │──► health check ──► FAIL → auto-rollback
│  promote   │
└─────┬──────┘
      │ PASS
      ▼
  Monitoring
  (ongoing)
```

---

## Phase 0: Setup (/oc-deploy init)

### Project Detection

Read the project's config to determine the deployment target:

```bash
# Check for wrangler.toml (Cloudflare Workers)
[[ -f wrangler.toml ]] && echo "Cloudflare Workers project detected"

# Check for Pages config
grep -q "pages" wrangler.toml 2>/dev/null && echo "Pages deployment detected"

# Check for existing deploy scripts
grep -q '"deploy"' package.json 2>/dev/null && echo "Deploy script found in package.json"
```

### Deploy Config

Create or update `.oc-deploy-ops.json`:

```json
{
  "project_name": "gtrack",
  "platform": "cloudflare-workers",
  "monorepo": true,
  "monorepo_root": "/home/claude/aidops-core",
  "app_path": "apps/gtrack",

  "environments": {
    "staging": {
      "wrangler_env": "staging",
      "d1_database": "gtrack-staging",
      "url": "https://gtrack-staging.aidops.workers.dev",
      "auto_deploy_branch": "staging"
    },
    "production": {
      "wrangler_env": null,
      "d1_database": "gtrack-prod",
      "url": "https://gtrack.aidops.workers.dev",
      "auto_deploy_branch": "main"
    }
  },

  "deploy_order": [
    "migrate",
    "deploy-api",
    "deploy-frontend"
  ],

  "smoke_tests": [
    { "name": "API health", "url": "/api/health", "expect_status": 200 },
    { "name": "Auth endpoint", "url": "/api/auth/status", "expect_status": 401 },
    { "name": "Frontend loads", "url": "/", "expect_contains": "<html" }
  ],

  "rollback": {
    "strategy": "wrangler-rollback",
    "keep_versions": 3
  }
}
```

### First-Time Setup Checklist

1. **Detect platform** from config files
2. **Check auth** — `wrangler whoami` or CF API token in env
3. **Check environments** — staging/prod wrangler.toml configured?
4. **Check D1 databases** — staging and prod DBs exist?
5. **Generate .oc-deploy-ops.json** — ask user to confirm/adjust
6. **Verify deploy works** — dry-run `wrangler deploy --dry-run`
7. **Set up smoke test URLs** — derive from wrangler.toml routes

---

## Pre-Deploy Audit Gate (/oc-deploy audit)

Before any deploy, run **two** audits in order: oc-code-auditor (code-level
findings) then oc-security-auditor (architecture / hardening / threat
model). Both must pass for `/oc-deploy staging` and `/oc-deploy prod` to
proceed.

### 1. oc-code-auditor — code-level gate

```bash
# Reuse the existing checkpoint if it's recent
node scripts/checkpoint.mjs status oc-code-auditor
# If updated_at < 1h old, reuse. Otherwise:
#   Skill(skill="oc-code-auditor", args="/oc-audit pre-deploy")
```

### 2. oc-security-auditor — posture gate

Code-auditor finds SQLi and hardcoded secrets; oc-security-auditor asks
"what's the threat model?" and "is the infra hardened?". Run it
before the first production deploy and any time the surface area
changes (new auth flow, new public endpoint, new third-party
integration).

```bash
node scripts/checkpoint.mjs status oc-security-auditor
# Reuse if updated_at < 24h old AND no high-impact changes since.
# Otherwise:
#   Skill(skill="oc-security-auditor", args="/oc-security pre-deploy")
```

### Gate Rules

| Audit Result | Deploy Decision |
|---|---|
| No CRITICAL findings (both audits) | ✅ Proceed |
| CRITICAL findings exist (either audit) | 🚫 Block — must fix before deploy |
| HIGH findings (≤ 3 total) | ⚠️ Warn — proceed with user confirmation |
| HIGH findings (> 3 total) | 🚫 Block — too many unresolved issues |
| No audit run | ⚠️ Warn — suggest running both audits first |

When blocked, show the specific findings and fix commands. When warned, list
the findings and ask for explicit confirmation before proceeding.

---

## Staging Deploy (/oc-deploy staging)

### Deploy Sequence (Cloudflare Workers + D1)

```bash
cd <project-dir>

# 1. Pre-flight
npm ci
npx tsc --noEmit          # Type check — fail fast
npx vitest run            # Tests — fail fast

# 2. Migrate (staging DB)
npx wrangler d1 migrations apply <staging-db> --remote --env staging

# 3. Deploy Worker (staging)
npx wrangler deploy --env staging

# 4. Deploy Pages frontend (if applicable)
if [[ -d frontend ]]; then
  cd frontend && npm ci && npm run build
  npx wrangler pages deploy dist --project-name=<project>-staging
  cd ..
fi

# 5. Smoke tests (immediate)
```

### Monorepo Deploy (aidops-core)

For the aidops