vh
fb7b5959f3
Deferred-work capture: Vuong approved wiring soong-lab auto-redeploy; operator deferred execution to a fresh context. Recorded in Recent decisions with the mechanism (WT-style CI-deploy step), the blocker (a vh-owned deploy SSH-key secret), and next-session steps; handoff updated to make it the primary task. The "5 AM clock" report was a hallucination in another window — clock verified correct (US/Pacific, NTP-synced), no change.
2.3 KiB
[2026-07-18]soong-lab auto-redeploy — APPROVED, queued for next session (DEFERRED, not started).
Vuong approved wiring auto-redeploy for soong-lab (relayed via soong-dev, thread
01KXT3A6C3908TA4V9THV3AMH7): new images should go live on corviduo-dev without
the manual docker compose pull && up -d. Host-side implementation is infra-ops's
lane; mechanism is infra-ops's call per fleet conventions. Operator deferred
execution — "we'll do soong on fresh context."
Chosen mechanism (recommended, agrees with soong-dev): Worldtree-style CI-deploy step — NOT watchtower polling.
- Add a deploy job/step to soong-lab's
.gitea/workflows/build-and-push.ymlthat, after the build+push job succeeds, SSHes from the pfi-fleet runner to corviduo-dev and runscd /home/infra-ops/soong-lab-deploy && docker compose pull && docker compose up -d, then a health-gate (curl -fsS http://localhost:8443/api/version). - This is exactly how WT deploys the demo instance to the SAME host: see
~/development/Worldtree/.gitea/workflows/deploy.yml— the "Deploy to demo VM + health-gate" step usessecrets.DEMO_VM_SSH_KEY/DEMO_VM_HOST/DEMO_VM_USER. Explicit-over-implicit (visible in the run log, fires exactly on build success), one less always-on service than watchtower.
Constraints (from soong-dev): deploy on CI success only; keep the trigger
gated to v* tags + workflow_dispatch (as today); preserve the one-command
rollback posture (docker compose down / pin a previous tag).
BLOCKER — needs from vh (owner-only): a runner→corviduo-dev deploy SSH key
as a repo secret (+ host/user), same class as WT's DEMO_VM_SSH_KEY. Likely
reuse WT's existing demo-deploy key (WT's runner already SSHes to 10.250.50.152
as its deploy user). Repo secrets are vh-owner-only (see
2026-07-18-fleet-gitea-runner-build-recipe).
Next-session steps: (1) confirm/obtain the deploy SSH-key secret from vh (reuse WT's or mint fresh); (2) add the deploy job to build-and-push.yml (infra-ops has push on vh/soong-lab); (3) dispatch a build to verify it deploys + health-gates; (4) ping soong-dev so they sync DEPLOY.md's "open follow-up" note to the as-built mechanism. Auto-pull (watchtower) explicitly NOT chosen. See 2026-07-18-soong-lab-containerize-cutover.