action.yml

name: Deploy backend stack
description: >-
  Build, validate, and promote the backend Cloud Run services, optional GKE
  surfaces, and shared release-vector evidence for manual and auto-dev deploys.

inputs:
  firebase_probe_signer_service_account:
    description: >-
      Optional service account for signing release-probe custom tokens when the
      Firebase auth project differs from project_id. Requires
      roles/iam.serviceAccountTokenCreator for the deploy identity on it.
    required: false
    default: ''
  firebase_probe_signer_credentials:
    description: >-
      Base64-encoded service-account key for the Firebase auth project, used to
      sign release-probe custom tokens locally. This is how the development lane
      signs for production Firebase without an IAM grant, matching
      desktop_backend_auto_dev.yml. Mutually exclusive with
      firebase_probe_signer_service_account.
    required: false
    default: ''
  deploy_profile:
    description: 'manual or auto-dev orchestration profile'
    required: true
  admitted_sha:
    description: 'Release Eligibility-admitted source SHA'
    required: true
  environment:
    description: 'GitHub environment name (development or prod)'
    required: true
  deploy_targets:
    description: 'all or cloud-run-only (manual profile only)'
    required: false
    default: cloud-run-only
  deploy_gateway:
    description: 'Whether to deploy the LLM gateway with the stack (manual profile)'
    required: false
    default: 'false'
  release_version:
    description: 'Optional release version label for production notifications'
    required: false
    default: ''
  gcp_credentials:
    description: 'GCP deployment credentials JSON'
    required: true
  project_id:
    description: 'GCP project ID for deployment'
    required: true
  runtime_gcp_project_id:
    description: 'Runtime GCP project ID for GKE values'
    required: true
  runtime_env:
    description: 'Backend runtime env slug (dev or prod)'
    required: true
  region:
    description: 'Cloud Run region'
    required: false
    default: us-central1
  service:
    description: 'Base Cloud Run service name'
    required: false
    default: backend
  transcription_candidate_tag:
    description: 'Development manual deploy transcription gate tag (empty disables)'
    required: false
    default: ''
  candidate_tag:
    description: 'Auto-dev stable no-traffic candidate tag'
    required: false
    default: candidate
  sync_backfill_budget_alerts:
    description: 'Provision sync-backfill budget alerts (manual prod all-target deploys)'
    required: false
    default: 'false'
  sync_backfill_alert_channels:
    description: 'Monitoring notification channels for sync-backfill budget alerts'
    required: false
    default: ''
  telegram_bot_token:
    description: 'Telegram bot token for production deployment notifications'
    required: false
    default: ''
  telegram_chat_id:
    description: 'Telegram chat ID for production deployment notifications'
    required: false
    default: ''

runs:
  using: composite
  steps:
    - name: Validate deploy profile boundary
      shell: bash
      run: |
        set -euo pipefail
        if [[ "${{ inputs.deploy_profile }}" == "manual" ]]; then
          bash "$GITHUB_WORKSPACE/.github/scripts/validate-backend-deploy-inputs.sh" \
            manual "${{ inputs.environment }}" "${{ inputs.deploy_targets }}" "${{ inputs.deploy_gateway }}"
          [[ "${{ inputs.environment }}" == "development" && "${{ inputs.runtime_env }}" == "dev" ]] || \
            [[ "${{ inputs.environment }}" == "prod" && "${{ inputs.runtime_env }}" == "prod" ]] || {
              echo "manual deploy environment and runtime_env must agree" >&2
              exit 1
            }
        elif [[ "${{ inputs.deploy_profile }}" == "auto-dev" ]]; then
          [[ "${{ inputs.environment }}" == "development" && "${{ inputs.runtime_env }}" == "dev" && \
             "${{ inputs.deploy_targets }}" == "all" && "${{ inputs.deploy_gateway }}" == "false" ]] || {
            echo "auto-dev must use development/dev, deploy_targets=all, and deploy_gateway=false" >&2
            exit 1
          }
        else
          echo "deploy_profile must be manual or auto-dev" >&2
          exit 1
        fi

    - name: Delete huge unnecessary tools folder
      shell: bash
      run: rm -rf /opt/hostedtoolcache

    - name: Checkout workflow-owned deploy-control source
      uses: actions/checkout@v7
      with:
        ref: ${{ github.sha }}
        path: .workflow-source

    - name: Stage immutable workflow validation source and deploy-control scripts
      shell: bash
      run: |
        set -euo pipefail
        workflow_source="$RUNNER_TEMP/backend-deploy-workflow-source"
        control_source="$RUNNER_TEMP/backend-deploy-control-source"
        rm -rf "$workflow_source"
        rm -rf "$control_source"
        mkdir -p "$workflow_source"
        cp -a .workflow-source/.github "$workflow_source/.github"
        mkdir -p "$control_source"
        # Deploy control must retain its repository layout: these scripts import
        # backend.config and sibling scripts, while runtime data stays in the
        # separately checked-out admitted source below.
        cp -a .workflow-source/backend "$control_source/backend"
        # runtime_image_contracts resolves declared deployment workflows from
        # its repository root, so preserve that immutable workflow surface
        # alongside the control scripts it validates.
        cp -a .workflow-source/.github "$control_source/.github"
        rm -rf .workflow-source

    - name: Checkout admitted runtime source
      uses: actions/checkout@v7
      with:
        ref: ${{ inputs.admitted_sha }}

    - name: Install immutable workflow validation source and deploy-control scripts
      shell: bash
      run: |
        set -euo pipefail
        workflow_root="$GITHUB_WORKSPACE/.deploy-workflow-source"
        control_root="$GITHUB_WORKSPACE/.deploy-control"
        control_scripts="$control_root/backend/scripts"
        rm -rf "$workflow_root"
        rm -rf "$GITHUB_WORKSPACE/.deploy-control"
        mkdir -p "$workflow_root"
        mkdir -p "$control_root"
        cp -a "$RUNNER_TEMP/backend-deploy-workflow-source/.github" "$workflow_root/.github"
        cp -a "$RUNNER_TEMP/backend-deploy-control-source/backend" "$control_root/backend"
        cp -a "$RUNNER_TEMP/backend-deploy-control-source/.github" "$control_root/.github"
        rm -rf "$RUNNER_TEMP/backend-deploy-workflow-source"
        rm -rf "$RUNNER_TEMP/backend-deploy-control-source"
        printf 'DEPLOY_CONTROL_SCRIPTS=%s\n' "$control_scripts" >> "$GITHUB_ENV"
        printf 'DEPLOY_WORKFLOW_ROOT=%s\n' "$workflow_root" >> "$GITHUB_ENV"

    - name: Google Auth
      id: auth
      uses: google-github-actions/auth@v3
      with:
        credentials_json: ${{ inputs.gcp_credentials }}

    - name: Set up gcloud
      uses: google-github-actions/setup-gcloud@v3

    - name: Verify serving sync ledger fence mode before deploy
      shell: bash
      env:
        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify_sync_ledger_fence_transition.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --desired-mode="$SYNC_LEDGER_FENCE_MODE" \
          --allow-tagged-no-percent-targets

    - name: Login to GCR
      shell: bash
      run: gcloud auth configure-docker

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v4

    - name: Compute short SHA
      id: image-tag
      shell: bash
      run: |
        SHORT_SHA="$(git rev-parse --short=7 HEAD)"
        echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
        echo "revision_suffix=${SHORT_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"

    - name: Install Python deps for deploy scripts
      shell: bash
      run: python3 -m pip install -q pyyaml

    - name: Resolve production account-deletion task target
      if: ${{ inputs.runtime_env == 'prod' }}
      id: account-deletion-target
      shell: bash
      run: |
        set -euo pipefail
        SYNC_SERVICE_URL="$(
          gcloud run services describe "${{ inputs.service }}-sync" \
            --region="${{ inputs.region }}" \
            --project="${{ inputs.project_id }}" \
            --format='value(status.url)'
        )"
        SYNC_TASKS_INVOKER_SA="$(
          gcloud run services describe "${{ inputs.service }}-sync" \
            --region="${{ inputs.region }}" \
            --project="${{ inputs.project_id }}" \
            --format=json \
            | jq -r '.spec.template.spec.containers[0].env[]? | select(.name == "SYNC_TASKS_INVOKER_SA") | .value'
        )"
        test -n "$SYNC_SERVICE_URL"
        test -n "$SYNC_TASKS_INVOKER_SA"
        {
          echo "account_deletion_handler_url=${SYNC_SERVICE_URL}/v1/users/account-deletion-wipes/run"
          echo "listen_finalization_tasks_handler_url=${SYNC_SERVICE_URL}/v1/conversation-finalization-jobs/run"
          echo "listen_finalization_tasks_invoker_sa=${SYNC_TASKS_INVOKER_SA}"
          echo "sync_tasks_handler_url=${SYNC_SERVICE_URL}/v2/sync-jobs/run"
          echo "sync_tasks_invoker_sa=${SYNC_TASKS_INVOKER_SA}"
        } >> "$GITHUB_OUTPUT"

    - name: Determine whether this deploy requests gateway-first serving
      if: ${{ inputs.deploy_profile == 'manual' }}
      id: gateway-intent
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify-llm-gateway-serving.py" \
          --environment="${{ inputs.runtime_env }}" \
          --project="${{ inputs.project_id }}" \
          --region="${{ inputs.region }}" \
          --listener-values="backend/charts/backend-listen/${{ inputs.runtime_env }}_omi_backend_listen_values.yaml" \
          --intent-only >> "$GITHUB_OUTPUT"

    - name: Get GKE credentials for gateway serving gate
      if: >-
        ${{ inputs.deploy_profile == 'auto-dev' ||
        inputs.deploy_targets == 'all' ||
        (inputs.deploy_profile == 'manual' && steps.gateway-intent.outputs.enabled == 'true') }}
      uses: google-github-actions/get-gke-credentials@v3
      with:
        cluster_name: ${{ env.GKE_CLUSTER }}
        location: ${{ inputs.region }}
        project_id: ${{ inputs.project_id }}

    - name: Verify LLM gateway control plane before promotion
      id: gateway-serving
      if: >-
        ${{ inputs.deploy_profile == 'manual' &&
        inputs.deploy_gateway != 'true' &&
        steps.gateway-intent.outputs.enabled == 'true' }}
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify-llm-gateway-serving.py" \
          --environment="${{ inputs.runtime_env }}" \
          --project="${{ inputs.project_id }}" \
          --region="${{ inputs.region }}" \
          --github-output "$GITHUB_OUTPUT"

    - name: Preflight Cloud Run deploy
      shell: bash
      run: |
        PREFLIGHT_ARGS=(
          --env ${{ inputs.runtime_env }}
          --project ${{ inputs.project_id }}
          --region ${{ inputs.region }}
          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml"
          --check-secrets
          --check-traffic
        )
        if [[ "${{ inputs.deploy_profile }}" == "auto-dev" ||
              "${{ inputs.environment }}" == "prod" ||
              "${{ inputs.environment }}" == "development" ]]; then
          PREFLIGHT_ARGS+=(--repair-traffic)
        fi
        python3 "$DEPLOY_CONTROL_SCRIPTS/preflight-cloud-run-deploy.py" "${PREFLIGHT_ARGS[@]}"

    - name: Build runtime image
      uses: docker/build-push-action@v7
      with:
        context: .
        file: ./backend/Dockerfile
        push: false
        load: true
        tags: |
          gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:latest
          gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        cache-from: type=registry,ref=gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:buildcache
        cache-to: type=registry,ref=gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:buildcache,mode=max

    - name: Verify built runtime image before publish
      shell: bash
      run: |
        image=gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        python3 "$DEPLOY_CONTROL_SCRIPTS/runtime_image_contracts.py" smoke --dockerfile backend/Dockerfile --image "$image"

    - name: Push verified runtime image
      shell: bash
      run: |
        docker push gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:latest
        docker push gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}

    - name: Install Helm for combined LLM Gateway deployment
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_gateway == 'true' }}
      uses: azure/setup-helm@v5

    - name: Build, smoke, and push combined LLM Gateway image
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_gateway == 'true' }}
      shell: bash
      run: |
        gateway_image="gcr.io/${{ inputs.project_id }}/llm-gateway:${{ steps.image-tag.outputs.short_sha }}"
        docker build -t "$gateway_image" -f backend/Dockerfile .
        python3 "$DEPLOY_CONTROL_SCRIPTS/runtime_image_contracts.py" smoke \
          --dockerfile backend/Dockerfile \
          --image "$gateway_image"
        docker push "$gateway_image"

    - name: Deploy LLM Gateway with backend stack
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_gateway == 'true' }}
      shell: bash
      env:
        LLM_GATEWAY_GSA: ${{ env.LLM_GATEWAY_GSA }}
        ENVIRONMENT: ${{ inputs.runtime_env }}
        GCP_PROJECT_ID: ${{ inputs.project_id }}
        GKE_CLUSTER: ${{ env.GKE_CLUSTER }}
        REGION: ${{ inputs.region }}
      run: |
        test -n "$LLM_GATEWAY_GSA"
        python3 "$DEPLOY_CONTROL_SCRIPTS/validate-llm-gateway-env.py" \
          backend/charts/backend-listen/${{ inputs.runtime_env }}_omi_backend_listen_values.yaml \
          backend/charts/llm-gateway/${{ inputs.runtime_env }}_omi_llm_gateway_values.yaml
        IMAGE_TAG="${{ steps.image-tag.outputs.short_sha }}" "$DEPLOY_CONTROL_SCRIPTS/deploy-llm-gateway.sh"

    - name: Verify combined LLM gateway serving data plane
      id: combined-gateway-serving
      if: >-
        ${{ (inputs.deploy_profile == 'auto-dev' ||
             (inputs.deploy_gateway == 'true' && steps.gateway-intent.outputs.enabled == 'true')) }}
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify-llm-gateway-serving.py" \
          --environment="${{ inputs.runtime_env }}" \
          --project="${{ inputs.project_id }}" \
          --region="${{ inputs.region }}" \
          --github-output "$GITHUB_OUTPUT"

    - name: Smoke LLM Gateway
      if: ${{ inputs.deploy_profile == 'auto-dev' }}
      shell: bash
      run: |
        set -euo pipefail
        NAMESPACE="${{ inputs.runtime_env }}-omi-backend"
        SMOKE_POD="llm-gateway-smoke-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
        # Image pulls are independent of the smoke client's HTTP request
        # deadline. A cold 800 MB image exceeded kubectl run's implicit
        # one-minute pod-running timeout before the smoke process started.
        SMOKE_STARTUP_BUDGET_SECONDS=300
        SMOKE_PROBE_BUDGET_SECONDS=180

        show_smoke_diagnostics() {
          echo "=== llm-gateway smoke pod ==="
          kubectl --request-timeout=30s -n "$NAMESPACE" get pod "$SMOKE_POD" -o wide || true
          kubectl --request-timeout=30s -n "$NAMESPACE" get pod "$SMOKE_POD" -o jsonpath='{.status.phase}{"\n"}{range .status.containerStatuses[*]}{.name}{" ready="}{.ready}{" state="}{.state.waiting.reason}{.state.terminated.reason}{" exit="}{.state.terminated.exitCode}{"\n"}{end}' || true
          kubectl --request-timeout=30s -n "$NAMESPACE" describe pod "$SMOKE_POD" || true
          echo "=== llm-gateway smoke logs ==="
          kubectl --request-timeout=30s -n "$NAMESPACE" logs "$SMOKE_POD" --all-containers=true || true
          echo "=== llm-gateway smoke events ==="
          kubectl --request-timeout=30s -n "$NAMESPACE" get events --field-selector "involvedObject.name=$SMOKE_POD" --sort-by=.lastTimestamp || true
        }
        cleanup_smoke_pod() {
          kubectl --request-timeout=30s -n "$NAMESPACE" delete pod "$SMOKE_POD" --ignore-not-found=true --wait=false || true
        }
        trap cleanup_smoke_pod EXIT

        if ! cat <<EOF | kubectl --request-timeout=30s -n "$NAMESPACE" apply -f -
        apiVersion: v1
        kind: Pod
        metadata:
          name: $SMOKE_POD
        spec:
          restartPolicy: Never
          containers:
            - name: smoke
              image: gcr.io/${{ inputs.project_id }}/llm-gateway:${{ steps.image-tag.outputs.short_sha }}
              command: ["sh", "-c", "python scripts/smoke-llm-gateway.py --url \"\$SMOKE_URL\" --token \"\$SMOKE_TOKEN\" --check-metrics"]
              env:
                - name: SMOKE_URL
                  value: http://${{ inputs.runtime_env }}-omi-llm-gateway.${{ inputs.runtime_env }}-omi-backend.svc.cluster.local:8080
                - name: SMOKE_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: ${{ inputs.runtime_env }}-omi-backend-secrets
                      key: OMI_LLM_GATEWAY_SERVICE_TOKEN
                - name: METRICS_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: ${{ inputs.runtime_env }}-omi-backend-secrets
                      key: METRICS_SECRET
        EOF
        then
          echo "LLM gateway smoke pod could not be created" >&2
          show_smoke_diagnostics
          exit 1
        fi

        phase=""
        startup_deadline=$((SECONDS + SMOKE_STARTUP_BUDGET_SECONDS))
        while (( SECONDS < startup_deadline )); do
          phase="$(kubectl --request-timeout=10s -n "$NAMESPACE" get pod "$SMOKE_POD" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
          case "$phase" in
            Running)
              break
              ;;
            Succeeded)
              show_smoke_diagnostics
              exit 0
              ;;
            Failed)
              show_smoke_diagnostics
              exit 1
              ;;
          esac
          sleep 1
        done
        if [[ "$phase" != "Running" ]]; then
          echo "LLM gateway smoke pod did not start within ${SMOKE_STARTUP_BUDGET_SECONDS}s" >&2
          show_smoke_diagnostics
          exit 1
        fi

        probe_deadline=$((SECONDS + SMOKE_PROBE_BUDGET_SECONDS))
        while (( SECONDS < probe_deadline )); do
          phase="$(kubectl --request-timeout=10s -n "$NAMESPACE" get pod "$SMOKE_POD" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
          case "$phase" in
            Succeeded)
              show_smoke_diagnostics
              exit 0
              ;;
            Failed)
              show_smoke_diagnostics
              exit 1
              ;;
          esac
          sleep 1
        done
        echo "LLM gateway smoke probe did not complete within ${SMOKE_PROBE_BUDGET_SECONDS}s after pod startup" >&2
        show_smoke_diagnostics
        exit 1

    - name: Probe LLM gateway from the Cloud Run VPC before promotion
      if: >-
        ${{ inputs.deploy_profile == 'auto-dev' ||
        (inputs.deploy_profile == 'manual' && steps.gateway-intent.outputs.enabled == 'true') }}
      shell: bash
      run: |
        if [[ "${{ inputs.deploy_profile }}" == "auto-dev" ]]; then
          probe_image="gcr.io/${{ inputs.project_id }}/llm-gateway:${{ steps.image-tag.outputs.short_sha }}"
        else
          probe_image="gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}"
        fi
        bash "$DEPLOY_CONTROL_SCRIPTS/probe-llm-gateway-from-cloud-run.sh" \
          --project "${{ inputs.project_id }}" \
          --region "${{ inputs.region }}" \
          --image "$probe_image" \
          --gateway-url "${{ steps.combined-gateway-serving.outputs.gateway_url || steps.gateway-serving.outputs.gateway_url }}" \
          --network "${{ env.CLOUD_RUN_VPC_NETWORK }}" \
          --subnet "${{ env.CLOUD_RUN_VPC_SUBNET }}" \
          --vpc-egress private-ranges-only \
          --lane omi:auto:public-shared-conversation-chat \
          --lane omi:auto:memory-l2 \
          --name-suffix "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

    - name: Reject an inert gateway endpoint when source-controlled gateway mode is requested
      if: ${{ inputs.deploy_profile == 'manual' && steps.gateway-intent.outputs.enabled == 'true' }}
      shell: bash
      env:
        GATEWAY_URL: ${{ steps.combined-gateway-serving.outputs.gateway_url || steps.gateway-serving.outputs.gateway_url }}
      run: |
        set -euo pipefail
        if [[ -z "$GATEWAY_URL" || "$GATEWAY_URL" == "http://127.0.0.1:9" ]]; then
          echo "Gateway mode requires a verified non-sentinel endpoint." >&2
          exit 1
        fi

    - name: Render backend runtime env
      id: runtime-env
      shell: bash
      env:
        ACCOUNT_DELETION_HANDLER_URL: ${{ steps.account-deletion-target.outputs.account_deletion_handler_url }}
        LISTEN_FINALIZATION_TASKS_HANDLER_URL: ${{ steps.account-deletion-target.outputs.listen_finalization_tasks_handler_url }}
        LISTEN_FINALIZATION_TASKS_INVOKER_SA: ${{ steps.account-deletion-target.outputs.listen_finalization_tasks_invoker_sa }}
        CLOUD_RUN_VPC_NETWORK: ${{ env.CLOUD_RUN_VPC_NETWORK }}
        CLOUD_RUN_VPC_SUBNET: ${{ env.CLOUD_RUN_VPC_SUBNET }}
        GOOGLE_CLIENT_ID: ${{ env.GOOGLE_CLIENT_ID }}
        MCP_OAUTH_CLAUDE_CLIENT_ID: ${{ env.MCP_OAUTH_CLAUDE_CLIENT_ID }}
        MCP_OAUTH_CLAUDE_CLIENT_NAME: ${{ env.MCP_OAUTH_CLAUDE_CLIENT_NAME }}
        MCP_OAUTH_CLAUDE_REDIRECT_URIS: ${{ env.MCP_OAUTH_CLAUDE_REDIRECT_URIS }}
        OMI_LLM_GATEWAY_URL: ${{ steps.combined-gateway-serving.outputs.gateway_url || steps.gateway-serving.outputs.gateway_url || 'http://127.0.0.1:9' }}
        PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE: ${{ env.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_AUDIENCE }}
        PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA: ${{ env.PUBLIC_SHARED_CONVERSATION_CHAT_FRONTEND_INVOKER_SA }}
        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
        SYNC_TASKS_HANDLER_URL: ${{ steps.account-deletion-target.outputs.sync_tasks_handler_url }}
        SYNC_TASKS_INVOKER_SA: ${{ steps.account-deletion-target.outputs.sync_tasks_invoker_sa }}
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/render_backend_runtime_env.py" \
          --env ${{ inputs.runtime_env }} \
          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
          --state-output "$RUNNER_TEMP/backend-runtime-env-state.json" >> "$GITHUB_OUTPUT"

    - name: Validate backend runtime env before deploy
      shell: bash
      env:
        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/validate-backend-runtime-env.py" \
          --env ${{ inputs.runtime_env }} \
          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
          --check-workflows \
          --workflow-root "$DEPLOY_WORKFLOW_ROOT" \
          --cloud-run-state "$RUNNER_TEMP/backend-runtime-env-state.json"

    - name: Migrate legacy public Cloud Run bindings
      shell: bash
      run: >-
        python3 "$DEPLOY_CONTROL_SCRIPTS/preflight-cloud-run-deploy.py"
        --env ${{ inputs.runtime_env }}
        --project="${{ inputs.project_id }}"
        --region="${{ inputs.region }}"
        --migrate-legacy-public-binding backend
        --migrate-legacy-public-binding backend-sync
        --migrate-legacy-public-binding backend-sync-backfill
        --migrate-legacy-public-binding backend-integration

    - name: Check development Cloud Run runtime bindings
      if: ${{ inputs.deploy_profile == 'auto-dev' }}
      shell: bash
      run: >-
        python3 "$DEPLOY_CONTROL_SCRIPTS/preflight-cloud-run-deploy.py"
        --env ${{ inputs.runtime_env }}
        --project="${{ inputs.project_id }}"
        --region="${{ inputs.region }}"
        --check-runtime-bindings

    - name: Deploy ${{ inputs.service }} to Cloud Run
      id: deploy-backend
      uses: google-github-actions/deploy-cloudrun@v3
      with:
        service: ${{ inputs.service }}
        region: ${{ inputs.region }}
        project_id: ${{ inputs.project_id }}
        image: gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        no_traffic: true
        flags: >-
          --revision-suffix=${{ steps.image-tag.outputs.revision_suffix }}-base
          ${{ inputs.transcription_candidate_tag != '' && format('--tag={0}', inputs.transcription_candidate_tag) || '' }}
          ${{ inputs.deploy_profile == 'auto-dev' && format('--tag={0}', inputs.candidate_tag) || '' }}
          --remove-env-vars=MEMORY_ENABLED_USERS,MEMORY_CANONICAL_PROMOTION_CRON_ENABLED,MEMORY_CANONICAL_PROMOTION_CRON_INTERVAL_HOURS,MEMORY_CANONICAL_PROMOTION_FAST_TRACK_ENABLED
          ${{ steps.runtime-env.outputs.cloud_run_flags }}
        env_vars: |-
          ${{ steps.runtime-env.outputs.backend_env_vars }}
          OMI_BACKEND_RELEASE_SHA=${{ inputs.admitted_sha }}
        secrets: ${{ steps.runtime-env.outputs.backend_secrets }}

    - name: Attach Managed Prometheus sidecar to ${{ inputs.service }} candidate
      id: attach-backend-gmp-sidecar
      shell: bash
      env:
        GMP_CANDIDATE_TAG: ${{ inputs.transcription_candidate_tag != '' && inputs.transcription_candidate_tag || (inputs.deploy_profile == 'auto-dev' && inputs.candidate_tag || '') }}
      run: |
        set -euo pipefail
        args=(
          --project="${{ inputs.project_id }}"
          --region="${{ inputs.region }}"
          --service="${{ inputs.service }}"
          --base-revision="backend-${{ steps.image-tag.outputs.revision_suffix }}-base"
          --final-revision="backend-${{ steps.image-tag.outputs.revision_suffix }}"
          --ingress-container=backend-1
          --config="$DEPLOY_CONTROL_SCRIPTS/../deploy/cloud_run_gmp_sidecar.yaml"
          --expected-env-state="$RUNNER_TEMP/backend-runtime-env-state.json"
        )
        if [[ -n "$GMP_CANDIDATE_TAG" ]]; then
          args+=(--tag="$GMP_CANDIDATE_TAG")
        fi
        python3 "$DEPLOY_CONTROL_SCRIPTS/attach_cloud_run_gmp_sidecar.py" "${args[@]}"

    - name: Capture ${{ inputs.service }} revision
      id: capture-backend-revision
      shell: bash
      run: |
        echo "revision=backend-${{ steps.image-tag.outputs.revision_suffix }}" >> "$GITHUB_OUTPUT"

    # deploy-cloudrun stamps a `commit-sha` label from GITHUB_SHA -- the ref the
    # workflow was TRIGGERED on, not the release_sha this job checked out and
    # built. For any pinned deploy (release_sha != main HEAD) that label names a
    # commit that was never deployed, and it is the marker an operator reaches
    # for first. On 2026-08-19 it sent an incident responder chasing five
    # commits that were not in production. The label cannot be corrected here,
    # so the fix is to publish a marker that is true by construction and then
    # prove it: read the value back off the revision that was actually created.
    - name: Verify ${{ inputs.service }} release provenance
      shell: bash
      run: |
        set -euo pipefail
        expected='${{ inputs.admitted_sha }}'
        revision='${{ steps.capture-backend-revision.outputs.revision }}'
        actual="$(gcloud run revisions describe "$revision" \
          --region='${{ inputs.region }}' --project='${{ inputs.project_id }}' --format=json \
          | jq -r '[.spec.containers[0].env[]? | select(.name == "OMI_BACKEND_RELEASE_SHA") | .value] | first // ""')"
        if [[ "$actual" != "$expected" ]]; then
          echo "ERROR: ${{ inputs.service }} revision $revision reports release sha '$actual'," >&2
          echo "       but this deploy admitted '$expected'. Refusing to report success:" >&2
          echo "       an untrue provenance marker is worse than none." >&2
          exit 1
        fi
        echo "$revision publishes OMI_BACKEND_RELEASE_SHA=$actual"

    - name: Deploy sync-backfill worker
      id: sync-backfill
      uses: ./.deploy-workflow-source/.github/actions/sync-backfill-lifecycle
      with:
        mode: worker
        project_id: ${{ inputs.project_id }}
        region: ${{ inputs.region }}
        service: ${{ inputs.service }}
        image: gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        revision_suffix: ${{ steps.image-tag.outputs.revision_suffix }}
        cloud_run_flags: ${{ steps.runtime-env.outputs.cloud_run_flags }}
        backfill_env_vars: ${{ steps.runtime-env.outputs.backend_sync_backfill_env_vars }}
        backfill_secrets: ${{ steps.runtime-env.outputs.backend_sync_backfill_secrets }}
        candidate_tag: ${{ inputs.deploy_profile == 'auto-dev' && inputs.candidate_tag || '' }}

    - name: Deploy ${{ inputs.service }}-sync to Cloud Run
      id: deploy-backend-sync
      uses: google-github-actions/deploy-cloudrun@v3
      with:
        service: ${{ inputs.service }}-sync
        region: ${{ inputs.region }}
        project_id: ${{ inputs.project_id }}
        image: gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        no_traffic: true
        flags: >-
          --revision-suffix=${{ steps.image-tag.outputs.revision_suffix }}
          ${{ inputs.deploy_profile == 'auto-dev' && format('--tag={0}', inputs.candidate_tag) || '' }}
          --remove-env-vars=HOSTED_PUSHER_API_URL,MEMORY_ENABLED_USERS,MEMORY_CANONICAL_PROMOTION_CRON_ENABLED,MEMORY_CANONICAL_PROMOTION_CRON_INTERVAL_HOURS,MEMORY_CANONICAL_PROMOTION_FAST_TRACK_ENABLED
          ${{ steps.runtime-env.outputs.cloud_run_flags }}
        env_vars: |-
          ${{ steps.runtime-env.outputs.backend_sync_env_vars }}
          ${{ steps.sync-backfill.outputs.sync_backfill_env_vars }}
        secrets: ${{ steps.runtime-env.outputs.backend_sync_secrets }}

    - name: Capture ${{ inputs.service }}-sync revision
      id: capture-backend-sync-revision
      shell: bash
      run: |
        echo "revision=backend-sync-${{ steps.image-tag.outputs.revision_suffix }}" >> "$GITHUB_OUTPUT"

    - name: Provision sync-backfill platform
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      uses: ./.deploy-workflow-source/.github/actions/sync-backfill-lifecycle
      with:
        mode: platform
        project_id: ${{ inputs.project_id }}
        firestore_project_id: ${{ inputs.runtime_gcp_project_id }}
        region: ${{ inputs.region }}
        service: ${{ inputs.service }}
        provision_sync_ledger_ttl: 'true'
        provision_budget_alerts: ${{ inputs.sync_backfill_budget_alerts }}
        alert_notification_channels: ${{ inputs.sync_backfill_alert_channels }}

    - name: Configure production conversation-finalization Cloud Tasks queue
      if: ${{ inputs.runtime_env == 'prod' && inputs.deploy_targets == 'all' }}
      shell: bash
      env:
        TASKS_INVOKER_SA: ${{ steps.account-deletion-target.outputs.listen_finalization_tasks_invoker_sa }}
      run: |
        set -euo pipefail
        test -n "$TASKS_INVOKER_SA"
        gcloud run services add-iam-policy-binding "${{ inputs.service }}-sync" \
          --region="${{ inputs.region }}" \
          --project="${{ inputs.project_id }}" \
          --member="serviceAccount:${TASKS_INVOKER_SA}" \
          --role=roles/run.invoker \
          --quiet
        if gcloud tasks queues describe conversation-finalization \
          --location="${{ inputs.region }}" \
          --project="${{ inputs.project_id }}" >/dev/null 2>&1; then
          gcloud tasks queues update conversation-finalization \
            --location="${{ inputs.region }}" \
            --project="${{ inputs.project_id }}" \
            --max-attempts=5 \
            --max-concurrent-dispatches=4
        else
          gcloud tasks queues create conversation-finalization \
            --location="${{ inputs.region }}" \
            --project="${{ inputs.project_id }}" \
            --max-attempts=5 \
            --max-concurrent-dispatches=4
        fi

    - name: Deploy ${{ inputs.service }}-integration to Cloud Run
      id: deploy-backend-integration
      uses: google-github-actions/deploy-cloudrun@v3
      with:
        service: ${{ inputs.service }}-integration
        region: ${{ inputs.region }}
        project_id: ${{ inputs.project_id }}
        image: gcr.io/${{ inputs.project_id }}/${{ inputs.service }}:${{ steps.image-tag.outputs.short_sha }}
        no_traffic: true
        flags: >-
          --revision-suffix=${{ steps.image-tag.outputs.revision_suffix }}
          ${{ inputs.deploy_profile == 'auto-dev' && format('--tag={0}', inputs.candidate_tag) || '' }}
          --remove-env-vars=HOSTED_PUSHER_API_URL,MEMORY_ENABLED_USERS,MEMORY_CANONICAL_PROMOTION_CRON_ENABLED,MEMORY_CANONICAL_PROMOTION_CRON_INTERVAL_HOURS,MEMORY_CANONICAL_PROMOTION_FAST_TRACK_ENABLED
          ${{ steps.runtime-env.outputs.cloud_run_flags }}
          --cpu=2
          --memory=2Gi
          --concurrency=40
          --min-instances=3
          --max-instances=50
          --no-cpu-throttling
        env_vars: ${{ steps.runtime-env.outputs.backend_integration_env_vars }}
        secrets: ${{ steps.runtime-env.outputs.backend_integration_secrets }}

    - name: Capture ${{ inputs.service }}-integration revision
      id: capture-backend-integration-revision
      shell: bash
      run: |
        echo "revision=backend-integration-${{ steps.image-tag.outputs.revision_suffix }}" >> "$GITHUB_OUTPUT"

    - name: Wait for Cloud Run revisions to become ready
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/preflight-cloud-run-deploy.py" \
          --env ${{ inputs.runtime_env }} \
          --project ${{ inputs.project_id }} \
          --region ${{ inputs.region }} \
          --wait-revision-ready backend=${{ steps.capture-backend-revision.outputs.revision }} \
          --wait-revision-ready backend-sync=${{ steps.capture-backend-sync-revision.outputs.revision }} \
          --wait-revision-ready backend-sync-backfill=${{ steps.sync-backfill.outputs.revision }} \
          --wait-revision-ready backend-integration=${{ steps.capture-backend-integration-revision.outputs.revision }}

    - name: Capture exact no-traffic candidate URLs
      id: candidate-urls
      if: ${{ inputs.deploy_profile == 'auto-dev' }}
      shell: bash
      run: |
        set -euo pipefail
        backend_url="$(python3 "$DEPLOY_CONTROL_SCRIPTS/resolve_cloud_run_tagged_url.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --service=backend \
          --revision=${{ steps.capture-backend-revision.outputs.revision }} \
          --tag=${{ inputs.candidate_tag }})"
        backend_sync_url="$(python3 "$DEPLOY_CONTROL_SCRIPTS/resolve_cloud_run_tagged_url.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --service=backend-sync \
          --revision=${{ steps.capture-backend-sync-revision.outputs.revision }} \
          --tag=${{ inputs.candidate_tag }})"
        backend_sync_backfill_url="$(python3 "$DEPLOY_CONTROL_SCRIPTS/resolve_cloud_run_tagged_url.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --service=backend-sync-backfill \
          --revision=${{ steps.sync-backfill.outputs.revision }} \
          --tag=${{ inputs.candidate_tag }})"
        backend_integration_url="$(python3 "$DEPLOY_CONTROL_SCRIPTS/resolve_cloud_run_tagged_url.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --service=backend-integration \
          --revision=${{ steps.capture-backend-integration-revision.outputs.revision }} \
          --tag=${{ inputs.candidate_tag }})"
        backend_audience="$(gcloud run services describe backend --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.url)')"
        backend_sync_audience="$(gcloud run services describe backend-sync --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.url)')"
        backend_sync_backfill_audience="$(gcloud run services describe backend-sync-backfill --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.url)')"
        backend_integration_audience="$(gcloud run services describe backend-integration --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.url)')"
        test -n "$backend_audience"
        test -n "$backend_sync_audience"
        test -n "$backend_sync_backfill_audience"
        test -n "$backend_integration_audience"
        {
          echo "backend_url=${backend_url}"
          echo "backend_sync_url=${backend_sync_url}"
          echo "backend_sync_backfill_url=${backend_sync_backfill_url}"
          echo "backend_integration_url=${backend_integration_url}"
          echo "backend_audience=${backend_audience}"
          echo "backend_sync_audience=${backend_sync_audience}"
          echo "backend_sync_backfill_audience=${backend_sync_backfill_audience}"
          echo "backend_integration_audience=${backend_integration_audience}"
        } >> "$GITHUB_OUTPUT"

    - name: Validate backend runtime env after deploy
      shell: bash
      env:
        SYNC_LEDGER_FENCE_MODE: ${{ env.SYNC_LEDGER_FENCE_MODE }}
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/validate-backend-runtime-env.py" \
          --env ${{ inputs.runtime_env }} \
          --manifest "$GITHUB_WORKSPACE/backend/deploy/runtime_env.yaml" \
          --check-workflows \
          --workflow-root "$DEPLOY_WORKFLOW_ROOT" \
          --check-live-cloud-run

    - name: Gate candidate revisions with the acceptance manifest
      if: ${{ inputs.deploy_profile == 'auto-dev' }}
      shell: bash
      env:
        PROJECT_ID: ${{ inputs.project_id }}
      run: |
        set -euo pipefail
        ADMIN_KEY="$(gcloud secrets versions access latest --secret=ADMIN_KEY --project="$PROJECT_ID")"
        export ADMIN_KEY
        trap 'unset ADMIN_KEY' EXIT
        python3 "$DEPLOY_CONTROL_SCRIPTS/run_dev_candidate_acceptance.py" \
          --candidate backend=${{ steps.candidate-urls.outputs.backend_url }} \
          --candidate backend-sync=${{ steps.candidate-urls.outputs.backend_sync_url }} \
          --candidate backend-sync-backfill=${{ steps.candidate-urls.outputs.backend_sync_backfill_url }} \
          --candidate backend-integration=${{ steps.candidate-urls.outputs.backend_integration_url }} \
          --audience backend=${{ steps.candidate-urls.outputs.backend_audience }} \
          --audience backend-sync=${{ steps.candidate-urls.outputs.backend_sync_audience }} \
          --audience backend-sync-backfill=${{ steps.candidate-urls.outputs.backend_sync_backfill_audience }} \
          --audience backend-integration=${{ steps.candidate-urls.outputs.backend_integration_audience }} \
          --evidence-path artifacts/dev-backend-candidate-acceptance.json

    - name: Resolve transcription candidate URL
      id: transcription-candidate
      if: ${{ inputs.deploy_profile == 'manual' && inputs.environment == 'development' }}
      shell: bash
      run: |
        candidate_url="$(python3 "$DEPLOY_CONTROL_SCRIPTS/resolve_cloud_run_tagged_url.py" \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --service=${{ inputs.service }} \
          --revision=${{ steps.capture-backend-revision.outputs.revision }} \
          --tag="${{ inputs.transcription_candidate_tag }}")"
        printf 'url=%s\n' "$candidate_url" >> "$GITHUB_OUTPUT"

    - name: Gate backend candidate on known audio
      if: ${{ inputs.deploy_profile == 'manual' && inputs.environment == 'development' }}
      uses: ./.deploy-workflow-source/.github/actions/transcription-release-candidate-probe
      with:
        candidate_api_url: ${{ steps.transcription-candidate.outputs.url }}
        project_id: ${{ inputs.project_id }}
        firebase_auth_project_id: based-hardware
        # The development backend authenticates against production Firebase, so
        # a development deploy identity cannot sign this gate's custom token: it
        # failed at custom_token_signing and blocked every manual development
        # deploy. Sign locally with the Firebase project's own key instead --
        # the same resolution desktop_backend_auto_dev.yml already uses. The
        # named-signer input stays available but needs an IAM grant, so it is
        # only consulted when a credential is not supplied.
        firebase_signer_service_account: ${{ inputs.firebase_probe_signer_credentials == '' && inputs.firebase_probe_signer_service_account || '' }}
        firebase_signer_credentials: ${{ inputs.firebase_probe_signer_credentials }}

    - name: Accept no-traffic Cloud Run candidate
      id: verify-cloud-run-candidate
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify_backend_release_vector.py" \
          --candidate \
          --cloud-run-only \
          --commit-sha "${{ inputs.admitted_sha }}" \
          --short-sha "${{ steps.image-tag.outputs.short_sha }}" \
          --deploy-run-id "${{ github.run_id }}" \
          --deploy-run-attempt "${{ github.run_attempt }}" \
          --project "${{ inputs.project_id }}" \
          --region "${{ inputs.region }}" \
          --environment "${{ inputs.runtime_env }}" \
          --evidence-path ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-candidate-release-vector.json' || 'artifacts/backend-cloud-run-candidate-release-vector.json' }}

    - name: Remove passed transcription candidate tag
      if: ${{ success() && inputs.deploy_profile == 'manual' && inputs.environment == 'development' }}
      shell: bash
      run: |
        gcloud run services update-traffic ${{ inputs.service }} \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --remove-tags="${{ inputs.transcription_candidate_tag }}" \
          --quiet

    - name: Remove failed transcription candidate tag
      if: >-
        ${{ failure() && steps.deploy-backend.outcome == 'success' &&
        inputs.deploy_profile == 'manual' && inputs.environment == 'development' }}
      shell: bash
      run: |
        gcloud run services update-traffic ${{ inputs.service }} \
          --project=${{ inputs.project_id }} \
          --region=${{ inputs.region }} \
          --remove-tags="${{ inputs.transcription_candidate_tag }}" \
          --quiet

    - name: Install Helm
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      uses: azure/setup-helm@v5

    - name: Apply non-secret backend runtime config
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      shell: bash
      env:
        ENVIRONMENT: ${{ inputs.runtime_env }}
        RUNTIME_ENV_MANIFEST: ${{ github.workspace }}/backend/deploy/runtime_env.yaml
        ACCOUNT_DELETION_HANDLER_URL: ${{ steps.account-deletion-target.outputs.account_deletion_handler_url }}
        CONVERSATION_SUMMARIZED_APP_IDS: ${{ env.CONVERSATION_SUMMARIZED_APP_IDS }}
        GOOGLE_CLIENT_ID: ${{ env.GOOGLE_CLIENT_ID }}
        MCP_AUTHORIZATION_SERVER_URL: ${{ env.MCP_AUTHORIZATION_SERVER_URL }}
        MCP_OAUTH_CHATGPT_CLIENT_ID: ${{ env.MCP_OAUTH_CHATGPT_CLIENT_ID }}
        MCP_OAUTH_CHATGPT_REDIRECT_URIS: ${{ env.MCP_OAUTH_CHATGPT_REDIRECT_URIS }}
        MCP_OAUTH_CLAUDE_CLIENT_ID: ${{ env.MCP_OAUTH_CLAUDE_CLIENT_ID }}
        MCP_OAUTH_CLAUDE_CLIENT_NAME: ${{ env.MCP_OAUTH_CLAUDE_CLIENT_NAME }}
        MCP_OAUTH_CLAUDE_REDIRECT_URIS: ${{ env.MCP_OAUTH_CLAUDE_REDIRECT_URIS }}
        MCP_OAUTH_PUBLIC_CLIENT_ID: ${{ env.MCP_OAUTH_PUBLIC_CLIENT_ID }}
        MCP_OAUTH_PUBLIC_REDIRECT_URIS: ${{ env.MCP_OAUTH_PUBLIC_REDIRECT_URIS }}
        MCP_RESOURCE_URL: ${{ env.MCP_RESOURCE_URL }}
        RAPID_API_HOST: ${{ env.RAPID_API_HOST }}
        REDIS_DB_HOST: ${{ env.REDIS_DB_HOST }}
        STT_PRERECORDED_MODEL: ${{ env.STT_PRERECORDED_MODEL }}
        STT_SERVICE_MODELS: ${{ env.STT_SERVICE_MODELS }}
        SYNC_TASKS_HANDLER_URL: ${{ steps.account-deletion-target.outputs.sync_tasks_handler_url }}
        SYNC_TASKS_INVOKER_SA: ${{ steps.account-deletion-target.outputs.sync_tasks_invoker_sa }}
        TYPESENSE_HOST: ${{ env.TYPESENSE_HOST }}
        TWILIO_ACCOUNT_SID: ${{ env.TWILIO_ACCOUNT_SID }}
        TWILIO_API_KEY_SID: ${{ env.TWILIO_API_KEY_SID }}
        TWILIO_TWIML_APP_SID: ${{ env.TWILIO_TWIML_APP_SID }}
        X_OAUTH_CLIENT_ID: ${{ env.X_OAUTH_CLIENT_ID }}
        X_OAUTH_REDIRECT_URI: ${{ env.X_OAUTH_REDIRECT_URI }}
      run: bash "$DEPLOY_CONTROL_SCRIPTS/deploy-backend-config.sh"

    - name: Deploy backend-secrets to GKE
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      shell: bash
      env:
        ENVIRONMENT: ${{ inputs.runtime_env }}
        GCP_PROJECT_ID: ${{ inputs.project_id }}
        GKE_CLUSTER: ${{ env.GKE_CLUSTER }}
        REGION: ${{ inputs.region }}
      run: bash "$DEPLOY_CONTROL_SCRIPTS/deploy-backend-secrets.sh"

    - name: Deploy ${{ env.SERVICE }}-listen to GKE using Helm
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      shell: bash
      run: |
        helm -n ${{ inputs.runtime_env }}-omi-backend upgrade --install ${{ inputs.runtime_env }}-omi-backend-listen ./backend/charts/backend-listen \
          -f ./backend/charts/backend-listen/${{ inputs.runtime_env }}_omi_backend_listen_values.yaml \
          --set image.repository=gcr.io/${{ inputs.project_id }}/${{ inputs.service }} \
          --set gcpProjectId=${{ inputs.project_id }} \
          --set runtimeGcpProjectId=${{ inputs.runtime_gcp_project_id }} \
          --set-string image.tag=${{ steps.image-tag.outputs.short_sha }}
        if ! kubectl -n ${{ inputs.runtime_env }}-omi-backend rollout status deploy/${{ inputs.runtime_env }}-omi-backend-listen --timeout=1800s; then
          python3 "$DEPLOY_CONTROL_SCRIPTS/deploy_status_report.py" --env ${{ inputs.runtime_env }} --include-gke --gke-service backend-listen || true
          exit 1
        fi
        python3 "$DEPLOY_CONTROL_SCRIPTS/deploy_status_report.py" --env ${{ inputs.runtime_env }} --include-gke --gke-service backend-listen

    - name: Verify exact candidate composition
      if: ${{ inputs.deploy_profile == 'auto-dev' || inputs.deploy_targets == 'all' }}
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify_backend_release_vector.py" \
          --candidate \
          --commit-sha "${{ inputs.admitted_sha }}" \
          --short-sha "${{ steps.image-tag.outputs.short_sha }}" \
          --deploy-run-id "${{ github.run_id }}" \
          --deploy-run-attempt "${{ github.run_attempt }}" \
          --project "${{ inputs.project_id }}" \
          --region "${{ inputs.region }}" \
          --environment "${{ inputs.runtime_env }}" \
          --evidence-path ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-deployment-composition.json' || 'artifacts/backend-deployment-composition.json' }}

    - name: Capture Cloud Run pre-promotion traffic snapshot
      id: cloud-run-traffic-snapshot
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/cloud_run_traffic_snapshot.py" capture \
          --project "${{ inputs.project_id }}" \
          --region "${{ inputs.region }}" \
          --service backend \
          --service backend-sync \
          --service backend-sync-backfill \
          --service backend-integration \
          --output ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-pre-promotion-traffic-snapshot.json' || 'artifacts/backend-cloud-run-pre-promotion-traffic-snapshot.json' }}

    - name: Verify validated revisions are still current
      shell: bash
      run: |
        test "$(gcloud run services describe backend --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.latestCreatedRevisionName)')" = "${{ steps.capture-backend-revision.outputs.revision }}"
        test "$(gcloud run services describe backend-sync --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.latestCreatedRevisionName)')" = "${{ steps.capture-backend-sync-revision.outputs.revision }}"
        test "$(gcloud run services describe backend-sync-backfill --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.latestCreatedRevisionName)')" = "${{ steps.sync-backfill.outputs.revision }}"
        test "$(gcloud run services describe backend-integration --project=${{ inputs.project_id }} --region=${{ inputs.region }} --format='value(status.latestCreatedRevisionName)')" = "${{ steps.capture-backend-integration-revision.outputs.revision }}"

    - name: Shift Cloud Run traffic to validated revisions
      id: shift-cloud-run-traffic
      shell: bash
      run: |
        gcloud run services update-traffic backend --project=${{ inputs.project_id }} --region=${{ inputs.region }} --to-revisions=${{ steps.capture-backend-revision.outputs.revision }}=100 --quiet
        gcloud run services update-traffic backend-sync --project=${{ inputs.project_id }} --region=${{ inputs.region }} --to-revisions=${{ steps.capture-backend-sync-revision.outputs.revision }}=100 --quiet
        gcloud run services update-traffic backend-sync-backfill --project=${{ inputs.project_id }} --region=${{ inputs.region }} --to-revisions=${{ steps.sync-backfill.outputs.revision }}=100 --quiet
        gcloud run services update-traffic backend-integration --project=${{ inputs.project_id }} --region=${{ inputs.region }} --to-revisions=${{ steps.capture-backend-integration-revision.outputs.revision }}=100 --quiet

    - name: Verify serving backend release vector
      id: verify-serving-release-vector
      shell: bash
      run: |
        CLOUD_RUN_ONLY=""
        if [[ "${{ inputs.deploy_profile }}" == "manual" && "${{ inputs.deploy_targets }}" == "cloud-run-only" ]]; then
          CLOUD_RUN_ONLY="--cloud-run-only"
        fi
        python3 "$DEPLOY_CONTROL_SCRIPTS/verify_backend_release_vector.py" \
          --commit-sha "${{ inputs.admitted_sha }}" \
          --short-sha "${{ steps.image-tag.outputs.short_sha }}" \
          --deploy-run-id "${{ github.run_id }}" \
          --deploy-run-attempt "${{ github.run_attempt }}" \
          --project "${{ inputs.project_id }}" \
          --region "${{ inputs.region }}" \
          --environment "${{ inputs.runtime_env }}" \
          --evidence-path ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-serving-release-vector.json' || 'artifacts/backend-serving-release-vector.json' }} \
          $CLOUD_RUN_ONLY

    - name: Smoke promoted production serving API
      id: smoke-promoted-production-serving-api
      if: ${{ inputs.deploy_profile == 'manual' && inputs.environment == 'prod' }}
      shell: bash
      env:
        PROBE_SECRET_PROJECT: ${{ inputs.project_id }}
        FIREBASE_AUTH_PROJECT_ID: based-hardware
      run: |
        set -euo pipefail
        umask 077
        token_file="$RUNNER_TEMP/firebase-production-serving-token"
        trap 'rm -f "$token_file"' EXIT
        python3 "$DEPLOY_CONTROL_SCRIPTS/firebase_release_probe_token.py" \
          --secret-project "$PROBE_SECRET_PROJECT" \
          --firebase-project "$FIREBASE_AUTH_PROJECT_ID" \
          --token-output "$token_file"
        reservation_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
          --request POST https://api.omi.me/v2/desktop/beta/candidates/reserve \
          --header 'Content-Type: application/json' --data '{"tag":"v0.0.0+1-macos"}')"
        # A schema-valid inert tag reaches the authorization wall without reserving a real candidate.
        test "$reservation_status" = 401
        python3 "$DEPLOY_CONTROL_SCRIPTS/transcription_capability_probe.py" \
          --candidate-api-url https://api.omi.me \
          --bearer-token-file "$token_file" --json-only

    - name: Smoke What Matters Now datastore query
      id: smoke-what-matters-now-datastore-query
      if: ${{ inputs.deploy_profile == 'manual' && inputs.environment == 'development' }}
      shell: bash
      env:
        PROJECT_ID: ${{ inputs.project_id }}
      run: |
        set -euo pipefail
        ADMIN_KEY="$(gcloud secrets versions access latest --secret=ADMIN_KEY --project="$PROJECT_ID")"
        export ADMIN_KEY
        trap 'unset ADMIN_KEY' EXIT
        # api.omi.dev has never resolved (NXDOMAIN), so this smoke could not reach
        # anything; api.omiapi.com is development's real public API host, matching
        # the rest of the dev domain family (parakeet/nllb/pusher.omiapi.com).
        python3 "$DEPLOY_CONTROL_SCRIPTS/smoke_what_matters_now.py" --base-url https://api.omiapi.com

    - name: Restore Cloud Run traffic snapshot after failed promotion
      if: >-
        ${{ inputs.deploy_profile == 'auto-dev' && (failure() || cancelled()) &&
        steps.cloud-run-traffic-snapshot.outcome == 'success' &&
        (steps.shift-cloud-run-traffic.outcome == 'failure' ||
        steps.verify-serving-release-vector.outcome == 'failure') }}
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/cloud_run_traffic_snapshot.py" restore \
          --snapshot artifacts/dev-backend-cloud-run-pre-promotion-traffic-snapshot.json \
          --evidence-path artifacts/dev-backend-cloud-run-traffic-restore.json

    - name: Restore Cloud Run traffic snapshot after failed promotion
      if: >-
        ${{ inputs.deploy_profile == 'manual' && (failure() || cancelled()) &&
        steps.cloud-run-traffic-snapshot.outcome == 'success' &&
        (steps.shift-cloud-run-traffic.outcome == 'failure' ||
        steps.verify-serving-release-vector.outcome == 'failure' ||
        steps.smoke-promoted-production-serving-api.outcome == 'failure' ||
        steps.smoke-what-matters-now-datastore-query.outcome == 'failure') }}
      shell: bash
      run: |
        python3 "$DEPLOY_CONTROL_SCRIPTS/cloud_run_traffic_snapshot.py" restore \
          --snapshot artifacts/backend-cloud-run-pre-promotion-traffic-snapshot.json \
          --evidence-path artifacts/backend-cloud-run-traffic-restore.json

    - name: Cloud Run deploy status report
      if: always()
      shell: bash
      run: |
        set -o pipefail
        if [[ "${{ steps.verify-cloud-run-candidate.outcome }}" != "success" ]]; then
          echo "Cloud Run candidate verification failed before traffic promotion; candidate evidence follows."
          cat ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-candidate-release-vector.json' || 'artifacts/backend-cloud-run-candidate-release-vector.json' }} || true
          if [[ "${{ inputs.deploy_profile }}" == "manual" ]]; then
            exit 0
          fi
        fi
        expected_traffic=()
        if [[ "${{ steps.shift-cloud-run-traffic.outcome }}" == "success" ]]; then
          expected_traffic=(
            --expect-cloud-run-traffic backend=${{ steps.capture-backend-revision.outputs.revision }}
            --expect-cloud-run-traffic backend-sync=${{ steps.capture-backend-sync-revision.outputs.revision }}
            --expect-cloud-run-traffic backend-sync-backfill=${{ steps.sync-backfill.outputs.revision }}
            --expect-cloud-run-traffic backend-integration=${{ steps.capture-backend-integration-revision.outputs.revision }}
          )
        fi
        report_args=(
          --env ${{ inputs.runtime_env }}
          --project ${{ inputs.project_id }}
          --region ${{ inputs.region }}
          --include-cloud-run
          --cloud-run-service backend
          --cloud-run-service backend-sync
          --cloud-run-service backend-sync-backfill
          --cloud-run-service backend-integration
        )
        if [[ "${{ inputs.deploy_profile }}" == "auto-dev" ]]; then
          python3 "$DEPLOY_CONTROL_SCRIPTS/deploy_status_report.py" \
            "${report_args[@]}" \
            "${expected_traffic[@]}" \
            --candidate-acceptance-manifest backend/deploy/dev_candidate_acceptance.json \
            --candidate-acceptance-evidence artifacts/dev-backend-candidate-acceptance.json \
            --candidate-status-output artifacts/dev-backend-candidate-status.json
        else
          python3 "$DEPLOY_CONTROL_SCRIPTS/deploy_status_report.py" \
            "${report_args[@]}" \
            "${expected_traffic[@]}" \
            | tee /tmp/cloud-run-deploy-status.txt
          if [[ "${{ inputs.environment }}" == "prod" ]]; then
            {
              echo ""
              echo "### Cloud Run rollout status"
              echo ""
              echo '```text'
              cat /tmp/cloud-run-deploy-status.txt
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
          fi
        fi

    - name: Upload backend release-vector evidence
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: ${{ inputs.deploy_profile == 'auto-dev' && format('dev-backend-deployment-acceptance-{0}', github.run_id) || format('backend-deployment-evidence-{0}-{1}', github.run_id, github.run_attempt) }}
        path: |
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-candidate-release-vector.json' || 'artifacts/backend-cloud-run-candidate-release-vector.json' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-deployment-composition.json' || 'artifacts/backend-deployment-composition.json' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-pre-promotion-traffic-snapshot.json' || 'artifacts/backend-cloud-run-pre-promotion-traffic-snapshot.json' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-serving-release-vector.json' || 'artifacts/backend-serving-release-vector.json' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-candidate-acceptance.json' || '' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-candidate-status.json' || '' }}
          ${{ inputs.deploy_profile == 'auto-dev' && 'artifacts/dev-backend-cloud-run-traffic-restore.json' || 'artifacts/backend-cloud-run-traffic-restore.json' }}
        if-no-files-found: warn

    - name: Show Output
      shell: bash
      run: |
        if [[ "${{ inputs.deploy_profile }}" == "auto-dev" ]]; then
          echo "Backend deployed to development environment"
        else
          echo "${{ steps.deploy-backend.outputs.url }}"
        fi

    - name: Generate deployment summary
      if: always() && inputs.deploy_profile == 'manual' && inputs.environment == 'prod'
      uses: ./.deploy-workflow-source/.github/actions/deployment-summary
      with:
        environment: ${{ inputs.environment }}
        release_version: ${{ inputs.release_version }}
        status: ${{ job.status }}
        service: ${{ inputs.service }}

    - name: Notify deployment status on Telegram
      if: always() && inputs.deploy_profile == 'manual' && inputs.environment == 'prod'
      uses: ./.deploy-workflow-source/.github/actions/deployment-notifier
      with:
        environment: ${{ inputs.environment }}
        release_version: ${{ inputs.release_version }}
        status: ${{ job.status }}
        telegram_bot_token: ${{ inputs.telegram_bot_token }}
        telegram_chat_id: ${{ inputs.telegram_chat_id }}