refactor(ops): remove redundant release controls (#72)

## Summary
- remove the permanently-open release gate and orphaned
database-readiness RPC
- delete one-off deploy/config helpers and duplicate dependency-audit CI
- retain migration identity checks, durable cleanup, release SHA
convergence, and affected-surface checks

## Validation
- pnpm lint
- pnpm typecheck
- pnpm build
- pnpm architecture:check
- pnpm deadcode
- actionlint .github/workflows/*.yml
- git diff --check

Author: iamjr15

.env.example

@@ -58,7 +58,6 @@ DATABASE_CONTEXT_SIGNING_SECRET_WEBHOOKS=replace_with_a_distinct_32_byte_secret
 GATEWAY_TO_WEBHOOKS_RESOURCE_DELETION_SECRET=replace_with_a_distinct_32_byte_secret
 WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET=replace_with_a_distinct_32_byte_secret
 INTERNAL_WEBHOOK_REPLAY_SECRET=replace_with_a_distinct_32_byte_secret
-RELEASE_DATABASE_READINESS_SECRET=replace_with_a_distinct_32_byte_secret
 OUTPUT_DOWNLOAD_SIGNING_SECRET=replace_with_a_distinct_32_byte_secret
 SKILL_RUNTIME_BASE_URL=https://gateway.trycheatcode.com/skill-runtime
 SKILL_RUNTIME_TOKEN_SECRET=replace_with_a_distinct_32_byte_secret

.github/workflows/deploy-cloudflare.yml

@@ -12,28 +12,21 @@ permissions:
 
 jobs:
   deploy:
-    name: Deploy affected Workers
-    runs-on: ubuntu-latest
+    name: Deploy Workers
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - name: Checkout reviewed release
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
-          fetch-depth: 0
+          ref: ${{ github.sha }}
 
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+      - uses: ./.github/actions/setup-repository
         with:
-          version: 11.15.0
+          release-sha: ${{ github.sha }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+      - name: Require main
+        run: test "$GITHUB_REF" = "refs/heads/main"
 
       - name: Build Worker release
         run: >-
@@ -43,8 +36,20 @@ jobs:
           --filter=@cheatcode/gateway-worker
           --filter=@cheatcode/preview-proxy
 
-      - name: Deploy affected Workers
-        run: pnpm cloudflare:deploy
+      - name: Deploy Workers
+        run: |
+          set -Eeuo pipefail
+          configs=(
+            apps/agent-worker/wrangler.jsonc
+            apps/webhooks-worker/wrangler.jsonc
+            apps/preview-proxy/wrangler.jsonc
+            apps/gateway-worker/wrangler.jsonc
+          )
+          for config in "${configs[@]}"; do
+            pnpm exec wrangler deploy \
+              --config "$config" \
+              --var "CHEATCODE_RELEASE_SHA:$GITHUB_SHA"
+          done
         env:
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.github/workflows/static-checks.yml

@@ -19,17 +19,6 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
-      audit: ${{ steps.scope.outputs.audit }}
-      audit_app_generators: ${{ steps.scope.outputs.audit_app_generators }}
-      audit_browser_driver: ${{ steps.scope.outputs.audit_browser_driver }}
-      audit_doc_runtime: ${{ steps.scope.outputs.audit_doc_runtime }}
-      audit_expo: ${{ steps.scope.outputs.audit_expo }}
-      audit_next: ${{ steps.scope.outputs.audit_next }}
-      audit_package_manager: ${{ steps.scope.outputs.audit_package_manager }}
-      audit_parquet_viewer: ${{ steps.scope.outputs.audit_parquet_viewer }}
-      audit_python: ${{ steps.scope.outputs.audit_python }}
-      audit_root: ${{ steps.scope.outputs.audit_root }}
-      audit_skill_runtime: ${{ steps.scope.outputs.audit_skill_runtime }}
       base_sha: ${{ steps.scope.outputs.base_sha }}
       code: ${{ steps.scope.outputs.code }}
       global_code: ${{ steps.scope.outputs.global_code }}
@@ -45,6 +34,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
       - name: Validate pull request title
         if: github.event_name == 'pull_request'
         env:
@@ -53,20 +43,18 @@ jobs:
           python3 - <<'PY'
           import os
           import re
-          import sys
 
           title = os.environ["PR_TITLE"]
           pattern = re.compile(
               r"(?:build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)"
               r"(?:\([a-z0-9][a-z0-9._/-]*\))?!?: \S.*"
           )
           if len(title) > 72 or pattern.fullmatch(title) is None:
-              print(
-                  "Pull request titles must use Conventional Commits and be at most 72 characters.",
-                  file=sys.stderr,
+              raise SystemExit(
+                  "Pull request titles must use Conventional Commits and be at most 72 characters."
               )
-              raise SystemExit(1)
           PY
+
       - name: Classify changed files
         id: scope
         env:
@@ -103,16 +91,6 @@ jobs:
           root_code="$force_global"
           skills=false
           workflow=false
-          audit_root=false
-          audit_expo=false
-          audit_next=false
-          audit_python=false
-          audit_app_generators=false
-          audit_browser_driver=false
-          audit_doc_runtime=false
-          audit_package_manager=false
-          audit_parquet_viewer=false
-          audit_skill_runtime=false
           knip_browser_driver=false
           knip_skill_runtime=false
 
@@ -121,9 +99,6 @@ jobs:
               .github/actions/* | .github/workflows/*)
                 workflow=true
                 ;;
-            esac
-
-            case "$file" in
               apps/* | packages/*)
                 if [[ "$file" != *.md ]]; then code=true; fi
                 ;;
@@ -155,72 +130,16 @@ jobs:
             esac
 
             case "$file" in
-              pnpm-lock.yaml)
-                audit_root=true
-                ;;
-              infra/containers/sandbox/app-templates/expo/package.json | infra/containers/sandbox/app-templates/expo/pnpm-lock.yaml)
-                audit_expo=true
-                ;;
-              infra/containers/sandbox/app-templates/next/package.json | infra/containers/sandbox/app-templates/next/pnpm-lock.yaml)
-                audit_next=true
-                ;;
-              infra/containers/sandbox/requirements.txt)
-                audit_python=true
-                ;;
-              infra/containers/sandbox/app-generators/package.json | infra/containers/sandbox/app-generators/package-lock.json)
-                audit_app_generators=true
-                ;;
               infra/containers/sandbox/browser-driver/*)
                 knip_browser_driver=true
-                case "$file" in
-                  */package.json | */package-lock.json) audit_browser_driver=true ;;
-                esac
-                ;;
-              infra/containers/sandbox/doc-runtime/package.json | infra/containers/sandbox/doc-runtime/package-lock.json)
-                audit_doc_runtime=true
-                ;;
-              infra/containers/sandbox/package-manager/package.json | infra/containers/sandbox/package-manager/package-lock.json)
-                audit_package_manager=true
-                ;;
-              infra/containers/sandbox/extension-overrides/parquet-viewer/package.json | infra/containers/sandbox/extension-overrides/parquet-viewer/package-lock.json)
-                audit_parquet_viewer=true
                 ;;
               infra/containers/sandbox/skill-runtime/*)
                 knip_skill_runtime=true
-                case "$file" in
-                  */package.json | */package-lock.json) audit_skill_runtime=true ;;
-                esac
                 ;;
             esac
           done < <(git diff --name-only --diff-filter=ACMR -z "$base_sha" "$head_sha")
 
-          audit=false
-          for value in \
-            "$audit_root" \
-            "$audit_expo" \
-            "$audit_next" \
-            "$audit_python" \
-            "$audit_app_generators" \
-            "$audit_browser_driver" \
-            "$audit_doc_runtime" \
-            "$audit_package_manager" \
-            "$audit_parquet_viewer" \
-            "$audit_skill_runtime"; do
-            if [ "$value" = true ]; then audit=true; break; fi
-          done
-
           {
-            echo "audit=$audit"
-            echo "audit_app_generators=$audit_app_generators"
-            echo "audit_browser_driver=$audit_browser_driver"
-            echo "audit_doc_runtime=$audit_doc_runtime"
-            echo "audit_expo=$audit_expo"
-            echo "audit_next=$audit_next"
-            echo "audit_package_manager=$audit_package_manager"
-            echo "audit_parquet_viewer=$audit_parquet_viewer"
-            echo "audit_python=$audit_python"
-            echo "audit_root=$audit_root"
-            echo "audit_skill_runtime=$audit_skill_runtime"
             echo "base_sha=$base_sha"
             echo "code=$code"
             echo "global_code=$global_code"
@@ -248,71 +167,6 @@ jobs:
           shellcheck: true
           version: 1.7.12
 
-  dependency-audit:
-    name: Dependency audit
-    needs: changes
-    if: needs.changes.outputs.audit == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - name: Set up Node for npm lockfile audits
-        if: >-
-          needs.changes.outputs.audit_app_generators == 'true' ||
-          needs.changes.outputs.audit_browser_driver == 'true' ||
-          needs.changes.outputs.audit_doc_runtime == 'true' ||
-          needs.changes.outputs.audit_package_manager == 'true' ||
-          needs.changes.outputs.audit_parquet_viewer == 'true' ||
-          needs.changes.outputs.audit_skill_runtime == 'true'
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version: 22.22.2
-      - name: Set up uv for Python lockfile audit
-        if: needs.changes.outputs.audit_python == 'true'
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
-        with:
-          enable-cache: false
-          version: 0.11.28
-      - name: Set up Trivy for pnpm lockfile audits
-        if: >-
-          needs.changes.outputs.audit_root == 'true' ||
-          needs.changes.outputs.audit_expo == 'true' ||
-          needs.changes.outputs.audit_next == 'true'
-        uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
-        with:
-          cache: true
-          version: v0.72.0
-      - name: Audit root pnpm lockfile
-        if: needs.changes.outputs.audit_root == 'true'
-        run: trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 pnpm-lock.yaml
-      - name: Audit Expo template lockfile
-        if: needs.changes.outputs.audit_expo == 'true'
-        run: trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 infra/containers/sandbox/app-templates/expo
-      - name: Audit Next.js template lockfile
-        if: needs.changes.outputs.audit_next == 'true'
-        run: trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 infra/containers/sandbox/app-templates/next
-      - name: Audit sandbox Python lockfile
-        if: needs.changes.outputs.audit_python == 'true'
-        run: uvx --from pip-audit==2.10.1 pip-audit --disable-pip -r infra/containers/sandbox/requirements.txt
-      - name: Audit app generator lockfile
-        if: needs.changes.outputs.audit_app_generators == 'true'
-        run: npm --prefix infra/containers/sandbox/app-generators audit --audit-level=moderate
-      - name: Audit browser driver lockfile
-        if: needs.changes.outputs.audit_browser_driver == 'true'
-        run: npm --prefix infra/containers/sandbox/browser-driver audit --audit-level=moderate
-      - name: Audit document runtime lockfile
-        if: needs.changes.outputs.audit_doc_runtime == 'true'
-        run: npm --prefix infra/containers/sandbox/doc-runtime audit --audit-level=moderate
-      - name: Audit package manager lockfile
-        if: needs.changes.outputs.audit_package_manager == 'true'
-        run: npm --prefix infra/containers/sandbox/package-manager audit --audit-level=moderate
-      - name: Audit Parquet viewer overlay lockfile
-        if: needs.changes.outputs.audit_parquet_viewer == 'true'
-        run: npm --prefix infra/containers/sandbox/extension-overrides/parquet-viewer audit --audit-level=moderate
-      - name: Audit skill runtime lockfile
-        if: needs.changes.outputs.audit_skill_runtime == 'true'
-        run: npm --prefix infra/containers/sandbox/skill-runtime audit --audit-level=moderate
-
   code-checks:
     name: Affected code checks
     needs: changes
@@ -330,6 +184,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ needs.changes.outputs.head_sha }}
       - uses: ./.github/actions/setup-repository
+
       - name: Resolve dependency-aware workspace scope
         id: workspace-scope
         run: |
@@ -344,9 +199,11 @@ jobs:
           scope="$(pnpm exec turbo run build "${filters[@]}" --dry-run=json)"
           echo "packages=$(jq --compact-output '[.packages[] | select(. != "//")] | unique' <<< "$scope")" >> "$GITHUB_OUTPUT"
           echo "directories=$(jq --compact-output '[.tasks[].directory] | unique' <<< "$scope")" >> "$GITHUB_OUTPUT"
+
       - name: Lint all files under a changed global configuration
         if: needs.changes.outputs.global_code == 'true'
         run: pnpm lint
+
       - name: Lint changed non-workspace files
         if: needs.changes.outputs.global_code != 'true' && needs.changes.outputs.nonworkspace_code == 'true'
         run: |
@@ -362,6 +219,7 @@ jobs:
           if [ "${#lintable[@]}" -gt 0 ]; then
             pnpm exec biome check --error-on-warnings --no-errors-on-unmatched "${lintable[@]}"
           fi
+
       - name: Lint, typecheck, and build affected workspaces
         if: steps.workspace-scope.outputs.packages != '[]'
         env:
@@ -382,9 +240,11 @@ jobs:
             fi
           fi
           pnpm exec turbo run lint typecheck build "${filters[@]}"
+
       - name: Typecheck operational scripts
         if: needs.changes.outputs.root_code == 'true'
         run: pnpm typecheck:scripts
+
       - name: Check affected architecture boundaries
         if: steps.workspace-scope.outputs.directories != '[]'
         env:
@@ -397,6 +257,7 @@ jobs:
             --ts-config tsconfig.base.json \
             --exclude '(^|/)(dist|\.next|\.turbo|node_modules)/' \
             "${directories[@]}"
+
       - name: Check dead code
         env:
           KNIP_BROWSER_DRIVER: ${{ needs.changes.outputs.knip_browser_driver }}
@@ -426,7 +287,7 @@ jobs:
 
   static-checks:
     name: static-checks
-    needs: [changes, workflow-lint, dependency-audit, code-checks]
+    needs: [changes, workflow-lint, code-checks]
     if: always()
     runs-on: ubuntu-24.04
     timeout-minutes: 5
@@ -435,15 +296,10 @@ jobs:
         env:
           CHANGES_RESULT: ${{ needs.changes.result }}
           CODE_RESULT: ${{ needs.code-checks.result }}
-          DEPENDENCY_AUDIT_RESULT: ${{ needs.dependency-audit.result }}
           WORKFLOW_LINT_RESULT: ${{ needs.workflow-lint.result }}
         run: |
           set -Eeuo pipefail
-          for result in \
-            "$CHANGES_RESULT" \
-            "$CODE_RESULT" \
-            "$DEPENDENCY_AUDIT_RESULT" \
-            "$WORKFLOW_LINT_RESULT"; do
+          for result in "$CHANGES_RESULT" "$CODE_RESULT" "$WORKFLOW_LINT_RESULT"; do
             case "$result" in
               success | skipped) ;;
               *) exit 1 ;;

AGENTS.md

@@ -82,8 +82,8 @@ part of the V2 command surface, and source-level `*.test.ts` files are
 intentionally absent. Do not generate temporary validation scripts either;
 operate the UI directly and check logs, and remove any throwaway product QA
 script that appears in the V2 tree. Operational scripts may exist only for
-build, migration, secret sync, Docker cleanup, and guarded deploy orchestration;
-they are not product tests and must not simulate UI/user flows. Do not create temporary
+build, migration, audit retention, and local-stack configuration; they are not
+product tests and must not simulate UI/user flows. Do not create temporary
 testing scripts in `scripts/`, package folders, `/tmp`, or any out-of-tree
 location.
 
@@ -159,11 +159,10 @@ COMPOSIO_WEBHOOK_SECRET=
 # Internal ops alerts
 INTERNAL_ALERT_WEBHOOK_SECRET=
 
-# Capability-scoped ccm2 contracts (four distinct secrets, each at least 32 bytes)
+# Capability-scoped ccm2 contracts (three distinct secrets, each at least 32 bytes)
 GATEWAY_TO_WEBHOOKS_RESOURCE_DELETION_SECRET=
 WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET=
 INTERNAL_WEBHOOK_REPLAY_SECRET=
-RELEASE_DATABASE_READINESS_SECRET=
 
 # Gateway
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787