Conversation
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/3c2458ad-668b-49fc-9f9e-5bf4a0fdb2f1 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/3c2458ad-668b-49fc-9f9e-5bf4a0fdb2f1 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
SMSDAO
left a comment
SMSDAO
left a comment
There was a problem hiding this comment.
🚨 P238 FOLLOW-UP — REMOVE LEGACY VERCEL COUPLING + DEPLOYMENT CONVERGENCE
Requesting changes before merge approval.
Current CI/CD remains coupled to blocked legacy Vercel infrastructure:
- GXQ.vercel.app
- TradeOS.vercel.app
This is creating deployment instability, failing checks, and non-deterministic workflow behavior.
Required Convergence Actions
1. Remove Legacy Vercel Coupling
Audit and remove:
- hardcoded Vercel domains
- stale project/org references
- obsolete preview URLs
- blocked deployment hooks
- invalid deployment secrets
- provider-coupled CI assumptions
Required:
- no hardcoded GXQ.vercel.app references
- no hardcoded TradeOS.vercel.app references
2. Make CI Hosting-Provider Agnostic
CI must pass without:
- active Vercel account
- deployment tokens
- preview deployments
- org access
Core CI only:
- lint
- typecheck
- test
- build
Deployment must become optional/non-blocking until fresh infrastructure is established.
3. Deployment Workflow Refactor
Required behavior:
- graceful deploy skip if secrets absent
- no CI hard-fail from deployment provider issues
- preview deploys optional only
- production deploys protected and deterministic
No recursive deployment/self-healing mutation loops.
4. Prepare Future Single-Domain Architecture
Converge toward:
TradeOS.app
Required:
- deployment abstraction layer
- centralized domain resolution
- environment normalization
- provider-independent deployment config
Suggested:
config/deployment.ts
5. Environment + Workflow Cleanup
Normalize:
- .env.example
- deployment variables
- CI variables
- local development variables
Remove:
- dead Vercel IDs
- obsolete deployment references
- stale preview configuration
Success Criteria
Merge readiness requires:
- clean local build
- deterministic CI
- no legacy Vercel dependency
- workflows stable without deployment secrets
- localhost fully operational
- future deployment path preserved
- no hidden provider coupling
Current recommendation:
keep deployment workflows optional until new clean infrastructure is provisioned.
Production convergence target:
TradeOS.app
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/c8c88e83-7824-4ac2-8ca0-78170625a1d0 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/c8c88e83-7824-4ac2-8ca0-78170625a1d0 Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Implemented in |
There was a problem hiding this comment.
Pull request overview
Converges the repository’s CI/CD automation into a deterministic, reduced workflow set and centralizes deployment/domain configuration so runtime consumers (scripts + API CORS) no longer depend on legacy Vercel hostnames.
Changes:
- Replaces the previous high-entropy GitHub Actions graph with four workflows:
ci,security,deploy,self-heal, removing self-mutating/overlapping pipelines. - Adds deterministic convergence/diagnostics tooling (
scripts/converge.sh,scripts/doctor.ts) and surfaces recommended branch protection checks. - Centralizes deployment URL/origin logic via
config/deployment.tsand updates runtime consumers + docs/env templates to useTradeOS.appdefaults.
Reviewed changes
Copilot reviewed 40 out of 41 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| webapp/.env.example | Adds NEXT_PUBLIC_APP_URL to document the public webapp origin. |
| tsconfig.json | Includes config/**/* in compilation inputs so new deployment config is built/typed. |
| scripts/doctor.ts | Adds a “platform doctor” diagnostic script for env/templates, workflows, TS paths, etc. |
| scripts/converge.sh | Adds an idempotent convergence script with bounded retry behavior for CI/self-heal. |
| scripts/canary-deployment.ts | Switches canary URLs to use centralized deployment config. |
| rename-vercel-hosts.yml | Removes legacy root-level hostname replacement workflow file. |
| package.json | Adds converge/doctor scripts and pins packageManager to npm@10. |
| docs/stuck.md | Updates documented deployment URLs to TradeOS.app. |
| docs/IMPLEMENTATION_SUMMARY_OLD.md | Updates documented CORS allowed domains to TradeOS.app. |
| docs/ENDPOINT_CONFIGURATION.md | Updates documented allowed domains to TradeOS.app. |
| docs/DEPLOYMENT_GUIDE.md | Updates example staging/production URLs to staging.tradeos.app / TradeOS.app. |
| docs/DEPLOYMENT_AUTOMATION.md | Updates documented production URL to TradeOS.app. |
| docs/ci-audit.md | Adds an audit record of removed/kept workflows and convergence rationale. |
| docs/CANARY_DEPLOYMENT.md | Updates canary deployment examples to new staging/production URLs. |
| docs/branch-protection.md | Adds recommended required checks aligned with the converged workflows. |
| docs/archive/VERCEL_DEPLOYMENT.md | Updates archived doc URLs to TradeOS.app. |
| docs/archive/COMPLETE_IMPLEMENTATION.md | Updates archived doc URLs to TradeOS.app. |
| config/deployment.ts | Introduces centralized deployment/provider config and derived allowed origins. |
| api/middleware/cors.ts | Uses centralized allowed-origins list for production CORS decisions. |
| .github/workflows/sync-railway-secrets.yml | Removes legacy Railway secret sync workflow. |
| .github/workflows/self-optimize.yml | Removes legacy self-optimizing (repo-mutating) workflow. |
| .github/workflows/self-heal.yml | Adds bounded, non-mutating “self-heal” workflow running scripts/converge.sh. |
| .github/workflows/security.yml | Adds centralized security lane (audit, dependency review, secret scanning). |
| .github/workflows/rename-vercel-hosts.yml | Removes legacy workflow that pushed/PR’d hostname mutations. |
| .github/workflows/powershell-merge-automation.yml | Removes legacy branch merge automation workflow. |
| .github/workflows/performance-monitoring.yml | Removes legacy performance monitoring workflow. |
| .github/workflows/gxq-scheduled-health.yml | Removes legacy scheduled health-check workflow. |
| .github/workflows/gxq-pr-check.yml | Removes legacy PR check workflow. |
| .github/workflows/gxq-master-ci.yml | Removes legacy “master CI” workflow. |
| .github/workflows/failed-job-handler.yml | Removes legacy failed-job retry/issue workflow. |
| .github/workflows/docker-build.yml | Removes legacy Docker build/push workflow. |
| .github/workflows/deploy.yml | Adds gated deploy workflow (preview optional; production triggered by successful ci run). |
| .github/workflows/deploy-railway.yml | Removes legacy Railway deploy workflow. |
| .github/workflows/deploy-railway-preview.yml | Removes legacy Railway preview deploy workflow. |
| .github/workflows/deploy-preview.yml | Removes legacy Vercel preview deploy workflow. |
| .github/workflows/complete-production-pipeline.yml | Removes legacy all-in-one production pipeline (incl. mutation paths). |
| .github/workflows/codeql-analysis.yml | Removes legacy CodeQL workflow (security lane now centralizes checks). |
| .github/workflows/ci.yml | Replaces prior comprehensive pipeline with deterministic lint, typecheck, test, build jobs. |
| .github/workflows/autonomous-oracle-pipeline.yml | Removes legacy autonomous “oracle” workflow that could push commits. |
| .github/workflows/auto-label.yml | Removes legacy PR auto-labeling workflow. |
| .env.example | Adds provider-agnostic deployment variables and updates staging/production URL defaults. |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: refs/heads/main |
| github.event.workflow_run.event == 'push' && | ||
| github.event.workflow_run.head_repository.full_name == github.repository | ||
| runs-on: ubuntu-latest | ||
| continue-on-error: true |
| - run: npm ci --no-audit --no-fund | ||
| - run: npm --prefix webapp ci --no-audit --no-fund | ||
| - run: npm test | ||
| - run: npm run test:webapp |
| PRODUCTION_URL=https://gxq.vercel.app | ||
| DEPLOYMENT_PROVIDER=none | ||
| DEPLOY_PREVIEW_ENABLED=false | ||
| DEPLOYMENT_PRIMARY_DOMAIN=https://TradeOS.app |
SMSDAO
left a comment
SMSDAO
left a comment
There was a problem hiding this comment.
🚨 Request Changes — PR #238 Needs Conversion to Patch-Level Fix
This PR is currently still at architectural/spec level, not yet a mergeable implementation patch.
To make this PR approvable, it must be converted into deterministic code changes with file-level diffs.
⸻
🔧 Required Actions Before Merge
- Convert from spec → patch PR
Must include actual repo changes:
• .github/workflows/* refactor (CI independence)
• removal or neutralization of vercel.json
• environment cleanup (.env.example)
• deployment abstraction layer (provider-agnostic)
• CI gating logic updated for optional deployment
PR must clearly show what changed in code, not only design intent.
⸻
- CI Independence Proof Required
PR description must explicitly confirm:
• npm install && npm run build works without Vercel credentials
• CI passes with:
• no VERCEL_TOKEN
• no deployment secrets
• deploy step does NOT fail when disabled or skipped
This is required for merge validation.
⸻
- Add Deployment Guard Pattern
Must be implemented in code:
• If VERCEL_TOKEN is missing → skip deploy gracefully
• If present → deploy normally
• CI must NEVER fail due to deployment layer
Deployment must be optional, not blocking.
⸻
- Keep PR #238 (do NOT split)
Do not open a new PR — splitting will fragment stabilization context.
Instead:
• upgrade this PR into a deterministic CI stabilization patch PR
⸻
• Where exactly are Vercel dependencies removed?
• What happens if deployment fails?
• How is deployment handled now?
• Does local build remain unchanged?
⸻
🧩 Merge Readiness Checklist
Repo-level
• No hardcoded Vercel domains
• No legacy project references
• No required Vercel CI gating
Workflow-level
• CI independent of hosting provider
• Deploy is optional / non-blocking
• No recursive automation loops
Runtime-level
• Clean local build
• No regression in dev workflow
⸻
⚙️ Summary
This PR is directionally correct but not yet merge-ready.
It must be upgraded from:
architectural guidance
to:
deterministic, file-level implementation patch
Once that conversion is done, it becomes safe for merge.
…ehavior Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
…erminism Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/e347e08a-3e2e-47a3-bb5d-dfcd0d18dbdf Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
Converted to concrete patch-level implementation in What changed:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 42 out of 43 changed files in this pull request and generated 4 comments.
Comments suppressed due to low confidence (1)
api/middleware/cors.ts:145
allowedDomainsnow comes fromgetAllowedOrigins(), and the subsequent check uses string prefix matching (origin.startsWith(domain)). This is case-sensitive (mixed-case domains likehttps://TradeOS.appcan fail to match browserOriginheaders) and can be bypassed by origins such ashttps://tradeos.app.evil.com. Prefer parsing/normalizingoriginand doing exact origin/host comparisons against the allow-list.
const allowedDomains = getAllowedOrigins();
// Allow requests with no origin (mobile apps, curl, etc.)
if (!origin) return true;
| validate_vercel_config() { | ||
| log "validate vercel config" | ||
| [ -f vercel.json ] || die "vercel.json missing" | ||
| [ -f webapp/vercel.json ] || die "webapp/vercel.json missing" | ||
| validate_json_file vercel.json | ||
| validate_json_file webapp/vercel.json | ||
| } |
| test) | ||
| npm test | ||
| npm run test:webapp | ||
| ;; |
| function checkVercelConfig(repoRoot: string): void { | ||
| const configs = [path.join(repoRoot, 'vercel.json'), path.join(repoRoot, 'webapp', 'vercel.json')]; | ||
|
|
||
| for (const filePath of configs) { | ||
| if (!fs.existsSync(filePath)) { | ||
| addFinding('vercel-config', 'error', `Missing ${path.relative(repoRoot, filePath)}`, 'Restore Vercel config.'); | ||
| continue; | ||
| } |
| const DEFAULT_PRODUCTION_URL = 'https://TradeOS.app'; | ||
| const DEFAULT_STAGING_URL = 'https://staging.tradeos.app'; | ||
|
|
||
| function normalizeUrl(url: string): string { | ||
| return url.endsWith('/') ? url.slice(0, -1) : url; |
This PR collapses a high-entropy, overlapping workflow graph into a deterministic CI/CD model to eliminate recursive automation, duplicate deploy paths, and flaky blocking checks. It preserves production deployment safeguards while making preview deployment non-blocking.
Workflow convergence (single source of truth)
.github/workflows/ci.yml.github/workflows/security.yml.github/workflows/deploy.yml.github/workflows/self-heal.ymlDeterministic CI + security lanes
ci.ymlnow contains only deterministic required jobs:lint,typecheck,test,build.security.ymlcentralizesnpm audit, dependency review, and secret scanning.npm --prefix webapp run test --if-present -- --ci --coverageso real test failures fail CI, while cleanly skipping when no webapp test script exists.Deploy hardening + provider-agnostic convergence
cicompletion onmainviaworkflow_run.workflow_runexecution contexts.github.event.workflow_run.head_shato deploy the same commit that passed CI (race-free, deterministic behavior).DEPLOYMENT_PROVIDERto decouple CI from legacy hosting assumptions.continue-on-errorfrom production deploy job so real deploy attempts fail the deploy workflow when provider is enabled/configured.Legacy Vercel coupling removal
GXQ.vercel.app/TradeOS.vercel.appreferences from active configs/docs touched by this work.rename-vercel-hosts.ymllegacy coupling artifact.vercel.jsonto neutralize legacy top-level Vercel coupling (webapp-scoped config remains inwebapp/vercel.json).Future single-domain architecture (
TradeOS.app)config/deployment.tsas centralized deployment abstraction/domain resolution layer.scripts/canary-deployment.tsapi/middleware/cors.tsDEPLOYMENT_PRIMARY_DOMAINinto deployment config fallback resolution..env.example(DEPLOYMENT_PROVIDER,DEPLOY_PREVIEW_ENABLED,DEPLOYMENT_PRIMARY_DOMAIN, normalized staging/production URLs)webapp/.env.example(NEXT_PUBLIC_APP_URL)Bounded self-healing (no mutation loops)
scripts/converge.shfor idempotent convergence operations (lockfile normalization, deterministic regeneration, config validation, quality gates).Platform diagnostics + governance docs
scripts/doctor.tsfor actionable diagnostics (env/templates, imports/cycles, TS paths, workflow graph integrity, Node/toolchain/config drift).docs/ci-audit.md(kept/removed inventory, dependency graph, risks, migration/rollback notes).docs/branch-protection.mdwith recommended required checks:ci / lintci / typecheckci / testci / buildsecurity / auditValidation evidence for provider independence
npm install(withoutVERCEL_TOKEN/Vercel secrets)npm run build(withoutVERCEL_TOKEN/Vercel secrets)