ci: scope checks and worker deployments (#55)

## Summary
- Route CI by changed surface and workspace dependency closure.
- Preserve one required `static-checks` result while skipping
inapplicable jobs.
- Skip unchanged Cloudflare Workers and rely on Vercel native monorepo
skipping.
- Declare shared TypeScript configuration dependencies explicitly.

## Decisions
- Core agent, webhooks, and gateway Workers deploy as one release set
because readiness requires a shared SHA.
- The preview proxy is independent and can deploy alone.
- Missing or inconsistent release metadata fails safe by redeploying the
relevant set.
- Root build configuration changes retain the complete validation gate.

## Validation
- [x] Actionlint and ShellCheck
- [x] Biome lint
- [x] TypeScript typecheck
- [x] Dependency-cruiser architecture check
- [x] Knip dead-code check
- [x] Production build
- [x] Root Trivy lockfile scan
- [x] Scoped Knip checks for web, Worker, and sandbox runtime
- [x] Historical frontend/backend dependency-routing checks

## Review order
1. `.github/workflows/static-checks.yml`
2. `scripts/deploy-cloudflare.ts`
3. Workspace manifest dependency declarations and README

Author: iamjr15

.github/workflows/static-checks.yml

@@ -91,18 +91,28 @@ pnpm cloudflare:set-hyperdrive -- \
 
 ## Production deployment
 
-The GitHub static-check workflow runs lint, typecheck, and build gates on pull
-requests and `main`. Vercel's Git integration deploys `apps/web` from the
-repository. Deploy the Cloudflare backend Workers from a reviewed checkout with:
+The required `static-checks` workflow classifies each change before allocating
+the heavier runners. It runs dependency-aware lint, typecheck, build,
+architecture, dead-code, workflow, and lockfile checks only for affected
+surfaces and their workspace dependents. Root build configuration changes still
+run the complete gate.
+
+Vercel's Git integration deploys `apps/web` from the repository. Its native
+monorepo dependency graph skips builds when neither the web app nor one of its
+declared workspace dependencies changed. Deploy the Cloudflare backend Workers
+from a clean reviewed checkout with:
 
 ```bash
 pnpm cloudflare:deploy
 ```
 
-The deploy command refuses a dirty tree, a non-`main` branch, or a checkout that
-does not exactly match `origin/main`. It injects that immutable commit SHA into
-every Worker and deploys the gateway last, after its agent and webhooks service
-dependencies share the same release identity.
+The deploy command refuses a dirty tree, reads the release SHA currently bound
+to each Worker, and uses the same workspace graph to deploy only affected
+Workers. The agent, webhooks, and gateway Workers remain an atomic release set
+because gateway readiness requires one shared release identity; the gateway is
+deployed last. The independent preview proxy deploys only when its dependency
+closure changed. If Cloudflare release metadata is unavailable or inconsistent,
+the command safely redeploys the relevant set instead of guessing.
 
 There is no second release orchestrator, compatibility deploy command, or hidden
 workspace-reconciliation command. Schema migrations, Worker deployment, and

README.md

@@ -31,6 +31,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "@cloudflare/workers-types": "catalog:",
     "typescript": "catalog:",
     "wrangler": "catalog:"

apps/agent-worker/package.json

@@ -25,6 +25,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "@cloudflare/workers-types": "catalog:",
     "typescript": "catalog:",
     "wrangler": "catalog:"

apps/gateway-worker/package.json

@@ -20,6 +20,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "@cloudflare/workers-types": "catalog:",
     "typescript": "catalog:",
     "wrangler": "catalog:"

apps/preview-proxy/package.json

@@ -42,6 +42,7 @@
     "zustand": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "@tailwindcss/postcss": "catalog:",
     "@types/node": "catalog:",
     "@types/react": "catalog:",

apps/web/package.json

@@ -26,6 +26,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "@cloudflare/workers-types": "catalog:",
     "typescript": "catalog:",
     "wrangler": "catalog:"

apps/webhooks-worker/package.json

@@ -1,8 +1,9 @@
 {
   "$schema": "./node_modules/knip/schema.json",
-  // CLI launched by operational TypeScript through `pnpm exec wrangler`; Knip
-  // cannot infer child-process binary dependencies from argument arrays.
-  "ignoreDependencies": ["cloudflare", "wrangler"],
+  // The shared compiler config is declared for the workspace graph but loaded
+  // through tsconfig `extends` paths. Cloudflare CLIs are launched by operational
+  // TypeScript. Knip cannot infer either dependency shape.
+  "ignoreDependencies": ["@cheatcode/tsconfig", "cloudflare", "wrangler"],
   "workspaces": {
     ".": {
       // Skill TypeScript files are executable snapshot entrypoints discovered by
@@ -16,14 +17,16 @@
       "entry": ["drizzle.config.ts", "src/schema/drizzle.ts"]
     },
     "infra/containers/sandbox/browser-driver": {
-      // Stagehand resolves these peer packages dynamically for its local
-      // Playwright backend, so no source-level import is visible to Knip.
+      // The snapshot launches this service from start-browser-driver.sh.
+      "entry": ["server.js"],
+      // Stagehand resolves these peer packages dynamically inside the snapshot,
+      // so a clean root-only CI install exposes no source-level import to Knip.
       "ignoreDependencies": ["playwright-core", "zod"]
     },
     "infra/containers/sandbox/skill-runtime": {
       "entry": ["bin/*.mjs"],
       // Snapshot launchers resolve these executables by installed binary name;
-      // Knip cannot infer dependencies or binaries passed to child_process.
+      // a root-only install cannot expose those child-process edges to Knip.
       "ignoreDependencies": ["agent-browser", "tsx"],
       "ignoreBinaries": ["agent-browser"]
     }

knip.jsonc

@@ -38,6 +38,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "typescript": "catalog:"
   }
 }

packages/agent-core/package.json

@@ -22,6 +22,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@cheatcode/tsconfig": "workspace:*",
     "typescript": "catalog:"
   }
 }