# AgentTeam Production Deploy App

This App runs a production deploy when the installed App service member is directly mentioned. It is intended for a trusted operator channel only.

On each delivery it executes, in order:

```bash
git fetch origin refs/heads/<branch>
git worktree add --detach <temporary-checkout> FETCH_HEAD
scripts/agentteam-prod-build-release.sh
```

The repository path is configurable. The runner fetches from that checkout, creates a temporary worktree for the requested branch, and runs the production deploy script from the temporary checkout so the source checkout is not switched in place.

## Install

Use `manifest.json` to create a developer App, install it in the target workspace, add the App service member to an operator channel, then create a runner token from the App detail page.

The mention target is:

```text
@production-deploy-app
```

Without extra arguments, the App deploys the default branch from `AGENTTEAM_DEPLOY_APP_GIT_BRANCH` (`main` by default). Operators can override the branch in the mention:

```text
@production-deploy-app --branch release/2026.06
@production-deploy-app branch=release/2026.06
@production-deploy-app deploy release/2026.06
```

## Run

Run from this repository:

```bash
AGENTTEAM_RUNTIME_BASE_URL=https://agentteam.example.test \
AGENTTEAM_WORKSPACE_ID=<workspace-id> \
AGENTTEAM_RUNNER_TOKEN=<runner-token> \
AGENTTEAM_DEPLOY_APP_REPO_DIR=/opt/agentteam \
go run ./kits/production-deploy-app/cmd/production-deploy-app
```

Or build a binary:

```bash
go build -o .artifacts/production-deploy-app ./kits/production-deploy-app/cmd/production-deploy-app
```

## systemd

Build the binary to a stable path, then install the service from that binary:

```bash
go build -o /opt/agentteam/production-deploy-app ./kits/production-deploy-app/cmd/production-deploy-app

sudo install -d -m 0755 /etc/agentteam
sudo tee /etc/agentteam/production-deploy-app.env >/dev/null <<'EOF'
AGENTTEAM_RUNTIME_BASE_URL=https://agentteam.example.test
AGENTTEAM_WORKSPACE_ID=<workspace-id>
AGENTTEAM_RUNNER_TOKEN=<runner-token>
EOF
sudo chmod 600 /etc/agentteam/production-deploy-app.env

sudo /opt/agentteam/production-deploy-app service install --repo-dir /opt/agentteam
sudo /opt/agentteam/production-deploy-app service start
```

`service install` writes and enables `agentteam-production-deploy-app.service`. Add `--start` to start it immediately. On Linux user-level systemd, add `--user` and use a user-readable env file path. The unit sets `HOME` for the service user so Go can resolve its default caches.

## Configuration

| Variable | Default | Purpose |
| --- | --- | --- |
| `AGENTTEAM_RUNTIME_BASE_URL` | required | AgentTeam server origin. |
| `AGENTTEAM_WORKSPACE_ID` | required | Workspace that owns the installed App. |
| `AGENTTEAM_RUNNER_TOKEN` | required | Runner token displayed once by AgentTeam. |
| `AGENTTEAM_RUNNER_ID` | `production-deploy-app-runner` | Stable runner identity shown in Apps diagnostics. |
| `AGENTTEAM_RUNNER_LEASE_SECONDS` | `900` | Delivery lease. AgentTeam currently caps runner leases at 15 minutes. |
| `AGENTTEAM_DEPLOY_APP_REPO_DIR` | current working directory | Source checkout used for `git fetch` and temporary worktree creation. |
| `AGENTTEAM_DEPLOY_APP_GIT_REMOTE` | `origin` | Git remote used by `git fetch`. |
| `AGENTTEAM_DEPLOY_APP_GIT_BRANCH` | `main` | Default branch when the mention does not specify one. |
| `AGENTTEAM_DEPLOY_APP_DEPLOY_SCRIPT` | `scripts/agentteam-prod-build-release.sh` | Deploy script relative to the temporary checkout, or an absolute path. |
| `AGENTTEAM_DEPLOY_APP_LOCK_FILE` | `.artifacts/app/production-deploy.lock` | Local lock file preventing overlapping deploys. Relative paths resolve under repo dir. |
| `AGENTTEAM_DEPLOY_APP_WORKTREE_DIR` | `.artifacts/app/worktrees` | Parent directory for temporary deployment checkouts. Relative paths resolve under repo dir. |
| `AGENTTEAM_DEPLOY_APP_TIMEOUT_SECONDS` | `840` | Combined timeout for fetch, temporary checkout, and deploy script. Keep below the delivery lease for final ack/fail in the same attempt. |
| `AGENTTEAM_DEPLOY_APP_REPLY_TAIL_CHARS` | `3500` | Max command-output tail included in the final reply. |
| `GOPATH` | `$HOME/go` when both `GOPATH` and `GOMODCACHE` are unset | Go workspace path used by deploy scripts. |
| `GOMODCACHE` | `$GOPATH/pkg/mod` when unset | Go module cache used by deploy scripts. |
| `GOCACHE` | `$HOME/.cache/go-build` when unset | Go build cache used by deploy scripts. |

## Operator Notes

- This App deploys production on any direct mention in a bound target. Restrict App installation and channel membership accordingly.
- Mention-specified branch names are validated and passed to `git fetch origin refs/heads/<branch>` as arguments, not through a shell.
- The runner process must have production deployment permissions, including whatever `scripts/agentteam-prod-build-release.sh` and `scripts/agentteam-prod-activate-release.sh` require.
- The runner uses a local lock file so repeated mentions do not start overlapping deployments. If a deployment is already running, the later delivery is skipped and the reply includes the active deployment's start time, delivery ID, branch, repository, and deploy script.
- Final replies include only the tail of stdout/stderr and redact common token, secret, password, API key, private key, and bearer-token shapes.

## Validation

```bash
go test ./kits/production-deploy-app/...
```