ci: fully automated prod deploy + snapshot build (no manual steps)

- deploy-workers.yml now auto-runs after Static Checks succeeds on main
  (workflow_run); workers deploy as a chain, web self-skips until its
  NEXT_PUBLIC vars are set so it can't block the backend cutover.
- build-snapshot.yml rebuilds+republishes the cheatcode-sandbox Daytona
  snapshot on any infra/containers/sandbox change (builds on Daytona infra).
- workflow_dispatch retained as manual fallback.

Author: iamjr15

.github/workflows/build-snapshot.yml

@@ -0,0 +1,41 @@
+name: Build Sandbox Snapshot
+
+# Rebuilds + republishes the Daytona sandbox snapshot whenever the sandbox image
+# changes. Builds on Daytona's infra (no Docker/cross-arch build needed in CI).
+# Keeps the `cheatcode-sandbox` snapshot name stable so the agent-worker's
+# DAYTONA_SANDBOX_SNAPSHOT var never has to change.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "infra/containers/sandbox/**"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: daytona-snapshot
+  cancel-in-progress: false
+
+jobs:
+  build-snapshot:
+    runs-on: ubuntu-latest
+    environment: production
+    env:
+      DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Daytona CLI
+        run: |
+          curl -sf -L https://download.daytona.io/daytona/install.sh | sudo bash
+          daytona version
+      - name: Build & publish snapshot
+        run: |
+          # Idempotent: drop the previous snapshot of this name (existing sandboxes
+          # are unaffected — they already hold their own copy) then rebuild.
+          daytona snapshot delete cheatcode-sandbox -y 2>/dev/null || true
+          daytona snapshot create cheatcode-sandbox \
+            -f infra/containers/sandbox/Dockerfile \
+            -c infra/containers/sandbox \
+            --cpu 2 --memory 4 --disk 10

.github/workflows/deploy-workers.yml

@@ -1,43 +1,33 @@
 name: Deploy Workers
 
+# Fully automated production deploy. Runs after "Static Checks" succeeds on main —
+# no manual step required. `workflow_dispatch` is kept only as a manual fallback.
+# The worker chain (agent → gateway → webhooks → preview-proxy) is the Daytona
+# backend; the web deploy runs independently and self-skips until its NEXT_PUBLIC
+# vars are configured (so a missing web var never blocks the backend cutover).
 on:
-  workflow_dispatch:
-    inputs:
-      confirm_production_deploy:
-        description: Type "deploy Cheatcode V2 to production" to approve production deployment.
-        required: true
-        type: string
+  workflow_run:
+    workflows: ["Static Checks"]
+    types: [completed]
+  workflow_dispatch: {}
 
 permissions:
   contents: read
 
 concurrency:
-  group: production-workers
+  group: production-deploy
   cancel-in-progress: false
 
 jobs:
-  prepare-production:
-    if: github.event.inputs.confirm_production_deploy == 'deploy Cheatcode V2 to production'
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10.33.2
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm typecheck:scripts
-
   deploy-agent:
+    # Only on a successful Static Checks run on main, or a manual dispatch.
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
     runs-on: ubuntu-latest
-    needs: prepare-production
     environment: production
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10.33.2
@@ -55,11 +45,13 @@ jobs:
           command: deploy
 
   deploy-gateway:
-    runs-on: ubuntu-latest
     needs: deploy-agent
+    runs-on: ubuntu-latest
     environment: production
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10.33.2
@@ -76,12 +68,14 @@ jobs:
           workingDirectory: apps/gateway-worker
           command: deploy
 
-  deploy-web:
-    runs-on: ubuntu-latest
+  deploy-webhooks:
     needs: deploy-gateway
+    runs-on: ubuntu-latest
     environment: production
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10.33.2
@@ -90,20 +84,22 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter @cheatcode/web deploy
-        env:
-          CHEATCODE_PROD_DEPLOY_APPROVED: "true"
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
-          NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID: ${{ vars.NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID }}
+      - run: pnpm turbo build --filter=@cheatcode/webhooks-worker
+      - uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          workingDirectory: apps/webhooks-worker
+          command: deploy
 
-  deploy-webhooks:
+  deploy-preview-proxy:
+    needs: deploy-webhooks
     runs-on: ubuntu-latest
-    needs: deploy-web
     environment: production
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10.33.2
@@ -112,20 +108,25 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm turbo build --filter=@cheatcode/webhooks-worker
+      - run: pnpm turbo build --filter=@cheatcode/preview-proxy
       - uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          workingDirectory: apps/webhooks-worker
+          workingDirectory: apps/preview-proxy
           command: deploy
 
-  deploy-preview-proxy:
+  deploy-web:
+    # Independent of the worker chain; self-skips until the NEXT_PUBLIC vars exist
+    # so a missing web var can never block the backend cutover.
+    needs: deploy-agent
+    if: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY != '' }}
     runs-on: ubuntu-latest
-    needs: deploy-webhooks
     environment: production
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - uses: pnpm/action-setup@v4
         with:
           version: 10.33.2
@@ -134,10 +135,10 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm turbo build --filter=@cheatcode/preview-proxy
-      - uses: cloudflare/wrangler-action@v3
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          workingDirectory: apps/preview-proxy
-          command: deploy
+      - run: pnpm --filter @cheatcode/web deploy
+        env:
+          CHEATCODE_PROD_DEPLOY_APPROVED: "true"
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
+          NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID: ${{ vars.NEXT_PUBLIC_POLAR_PRO_MONTHLY_PRODUCT_ID }}