gcp_backend_pusher.yml

name: Deploy Backend Pusher to GKE

on:
#  push:
#    branches: [ "main" ]
#    paths:
#      - 'backend/**'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Select the environment to deploy to'
        required: true
        default: 'development'
        type: choice
        options:
          - development
          - prod
      branch:
        description: 'Branch to deploy from'
        required: true
        default: 'main'
      release_version:
        description: 'Release version (optional)'
        required: false
        default: ''
      service:
        description: 'Service to deploy'
        required: false
        default: 'pusher'
      pusher_image_digest:
        description: 'Production Pusher only: exact digest from a successful automatic development qualification'
        required: false
        default: ''
      pusher_dev_qualification_run_id:
        description: 'Production Pusher only: successful gcp_backend_pusher_auto_deploy.yml run ID that qualified the digest'
        required: false
        default: ''
      skip_live_capacity_gate:
        description: 'Break-glass: deploy without the live surge-capacity gate (still requires a merged main SHA and immutable digest)'
        required: false
        default: false
        type: boolean
      break_glass_confirm:
        description: 'Type skip-live-capacity-gate when skip_live_capacity_gate is set'
        required: false
        default: ''
      break_glass_reason:
        description: 'Why the live capacity gate is unavailable (required with skip_live_capacity_gate)'
        required: false
        default: ''

# The LLM Gateway path reapplies shared backend-secrets; standalone pusher only
# mutates its own GKE release and therefore keeps a separate environment lock.
concurrency:
  group: ${{ (github.event.inputs.service || 'pusher') == 'llm-gateway' && format('deploy-backend-stack-{0}', github.event.inputs.environment) || format('deploy-gke-pusher-{0}', github.event.inputs.environment) }}
  cancel-in-progress: false

env:
  SERVICE: ${{ github.event.inputs.service || 'pusher' }}
  REGION: us-central1

jobs:
  deploy:
    environment: ${{ github.event.inputs.environment == 'prod' && 'prod' || 'development' }}
    permissions:
      actions: 'read'
      contents: 'read'
      id-token: 'write'

    runs-on: ubuntu-latest
    steps:
      - name: Validate Environment Input
        run: |
          if [[ "${{ github.event.inputs.environment }}" != "development" && "${{ github.event.inputs.environment }}" != "prod" ]]; then
            echo "Invalid environment: ${{ github.event.inputs.environment }}. Must be 'development' or 'prod'."
            exit 1
          fi
          if [[ "${{ env.SERVICE }}" != "pusher" && "${{ env.SERVICE }}" != "llm-gateway" ]]; then
            echo "Invalid service: ${{ env.SERVICE }}. Must be 'pusher' or 'llm-gateway'."
            exit 1
          fi
          if [[ "${{ env.SERVICE }}" == "llm-gateway" && "${{ github.event.inputs.environment }}" != "development" ]]; then
            echo "LLM Gateway deploys are dev-only until the prod launch checklist is explicitly completed."
            exit 1
          fi

      - name: Validate live-capacity-gate break-glass inputs
        if: env.SERVICE == 'pusher' && github.event.inputs.skip_live_capacity_gate == 'true'
        run: |
          if [[ "${{ github.event.inputs.break_glass_confirm }}" != "skip-live-capacity-gate" ]]; then
            echo "ERROR: skip_live_capacity_gate requires break_glass_confirm=skip-live-capacity-gate." >&2
            exit 1
          fi
          if [[ -z "${{ github.event.inputs.break_glass_reason }}" ]]; then
            echo "ERROR: skip_live_capacity_gate requires a non-empty break_glass_reason." >&2
            exit 1
          fi

      # To workaround "no space left on device" issue of GitHub-hosted runner
      - name: Delete huge unnecessary tools folder
        run: rm -rf /opt/hostedtoolcache

      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.inputs.environment == 'prod' && 'main' || github.event.inputs.branch }}
          fetch-depth: 0

      - name: Admit checked-out production source and image identity
        run: |
          set -euo pipefail
          CHECKED_OUT_SHA=$(git rev-parse HEAD)
          if [[ "${{ github.event.inputs.environment }}" == prod ]]; then
            git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
            if ! git merge-base --is-ancestor "$CHECKED_OUT_SHA" origin/main; then
              echo "ERROR: checked-out HEAD $CHECKED_OUT_SHA is not an ancestor of fresh origin/main $(git rev-parse origin/main)." >&2
              exit 1
            fi
          fi
          IMAGE_TAG=$(git rev-parse --short=7 "$CHECKED_OUT_SHA")
          echo "Admitted deployment source: $CHECKED_OUT_SHA"
          echo "CHECKED_OUT_SHA=$CHECKED_OUT_SHA" >> "$GITHUB_ENV"
          echo "IMAGE_TAG=$IMAGE_TAG" >> "$GITHUB_ENV"

      - name: Select development-qualified Pusher digest for production
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        env:
          GH_TOKEN: ${{ github.token }}
          REQUESTED_DIGEST: ${{ github.event.inputs.pusher_image_digest }}
          QUALIFICATION_RUN_ID: ${{ github.event.inputs.pusher_dev_qualification_run_id }}
        run: |
          set -euo pipefail
          if [[ ! "$REQUESTED_DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
            echo "Production Pusher requires pusher_image_digest=sha256:<64 lowercase hex>." >&2
            exit 1
          fi
          if [[ ! "$QUALIFICATION_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
            echo "Production Pusher requires a numeric successful development qualification run ID." >&2
            exit 1
          fi
          QUALIFICATION_DIR="$RUNNER_TEMP/pusher-dev-qualification-$QUALIFICATION_RUN_ID"
          mkdir -p "$QUALIFICATION_DIR"
          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$QUALIFICATION_RUN_ID" > "$QUALIFICATION_DIR/run.json"
          EXPECTED_WORKFLOW_ID="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/gcp_backend_pusher_auto_deploy.yml" --jq .id)"
          gh run download "$QUALIFICATION_RUN_ID" -n pusher-dev-qualification --dir "$QUALIFICATION_DIR"
          mapfile -t EVIDENCE_FILES < <(find "$QUALIFICATION_DIR" -type f -name pusher-dev-qualification.json -print)
          mapfile -t DEPLOYMENT_RECEIPTS < <(find "$QUALIFICATION_DIR" -type f -name pusher-dev-deployment-receipt.json -print)
          if [[ "${#EVIDENCE_FILES[@]}" -ne 1 ]]; then
            echo "Expected exactly one Pusher development qualification artifact." >&2
            exit 1
          fi
          if [[ "${#DEPLOYMENT_RECEIPTS[@]}" -ne 1 ]]; then
            echo "Expected exactly one exact live Pusher development deployment receipt." >&2
            exit 1
          fi
          DEV_PUSHER_REPOSITORY="gcr.io/based-hardware-dev/pusher"
          python3 backend/scripts/verify_pusher_promotion_evidence.py \
            --phase qualification \
            --evidence "${EVIDENCE_FILES[0]}" \
            --deployment-receipt "${DEPLOYMENT_RECEIPTS[0]}" \
            --run-json "$QUALIFICATION_DIR/run.json" \
            --expected-digest "$REQUESTED_DIGEST" \
            --expected-repository "$DEV_PUSHER_REPOSITORY" \
            --expected-workflow-id "$EXPECTED_WORKFLOW_ID" \
            --expected-run-id "$QUALIFICATION_RUN_ID"
          QUALIFIED_SOURCE_SHA="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["source_sha"])' "${EVIDENCE_FILES[0]}")"
          if ! git cat-file -e "${QUALIFIED_SOURCE_SHA}^{commit}" || ! git merge-base --is-ancestor "$QUALIFIED_SOURCE_SHA" origin/main; then
            echo "Development qualification source is not a commit on fresh origin/main." >&2
            exit 1
          fi
          # Compare the full Pusher image source closure, not a hardcoded subset.
          # The Dockerfile COPYs backend/{config,database,models,routers,services,
          # utils,pusher}/, so a change to any of those after qualification would
          # silently ship a stale digest. Derive the paths from the Dockerfile
          # itself so this never drifts from what the image actually baked in.
          mapfile -t PUSHER_SOURCE_PATHS < <(python3 backend/scripts/verify_pusher_source_closure.py)
          if ! git diff --quiet "$QUALIFIED_SOURCE_SHA" "$CHECKED_OUT_SHA" -- "${PUSHER_SOURCE_PATHS[@]}"; then
            echo "Current main changed Pusher image source or chart since the selected dev qualification; run a new dev bake." >&2
            git diff --stat "$QUALIFIED_SOURCE_SHA" "$CHECKED_OUT_SHA" -- "${PUSHER_SOURCE_PATHS[@]}" >&2 || true
            exit 1
          fi
          {
            echo "PUSHER_DEV_IMAGE_REPOSITORY=$DEV_PUSHER_REPOSITORY"
            echo "PUSHER_IMAGE_DIGEST=$REQUESTED_DIGEST"
            echo "PUSHER_QUALIFICATION_EVIDENCE=${EVIDENCE_FILES[0]}"
            echo "PUSHER_QUALIFICATION_DEPLOYMENT_RECEIPT=${DEPLOYMENT_RECEIPTS[0]}"
            echo "PUSHER_QUALIFICATION_RUN_JSON=$QUALIFICATION_DIR/run.json"
            echo "PUSHER_QUALIFICATION_WORKFLOW_ID=$EXPECTED_WORKFLOW_ID"
            echo "PUSHER_QUALIFICATION_RUN_ID=$QUALIFICATION_RUN_ID"
          } >> "$GITHUB_ENV"

      - name: Google Auth
        id: auth
        uses: 'google-github-actions/auth@v3'
        with:
          credentials_json: ${{ secrets.GCP_CREDENTIALS }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Bootstrap LLM Gateway dev service token
        if: env.SERVICE == 'llm-gateway' && github.event.inputs.environment == 'development'
        run: |
          SECRET_NAME="OMI_LLM_GATEWAY_SERVICE_TOKEN"
          if gcloud secrets describe "$SECRET_NAME" --project="${{ vars.GCP_PROJECT_ID }}" >/dev/null 2>&1; then
            if [[ "${{ github.event.inputs.release_version }}" == "rotate-dev-token" ]]; then
              echo "Rotating $SECRET_NAME in ${{ vars.GCP_PROJECT_ID }}."
              openssl rand -base64 48 | tr -d '\n' | gcloud secrets versions add "$SECRET_NAME" \
                --project="${{ vars.GCP_PROJECT_ID }}" \
                --data-file=- >/dev/null
              exit 0
            fi
            echo "$SECRET_NAME already exists in ${{ vars.GCP_PROJECT_ID }}."
            exit 0
          fi

          echo "Creating $SECRET_NAME in ${{ vars.GCP_PROJECT_ID }}."
          # Tolerate a concurrent create from another workflow run losing the
          # check-then-create race (ALREADY_EXISTS); the secret existing is the
          # desired end state regardless of which run created it.
          openssl rand -base64 48 | tr -d '\n' | gcloud secrets create "$SECRET_NAME" \
            --project="${{ vars.GCP_PROJECT_ID }}" \
            --replication-policy="automatic" \
            --data-file=- >/dev/null || {
              if gcloud secrets describe "$SECRET_NAME" --project="${{ vars.GCP_PROJECT_ID }}" >/dev/null 2>&1; then
                echo "$SECRET_NAME now exists (created concurrently by another run)."
                exit 0
              fi
              echo "Failed to create or find $SECRET_NAME." >&2
              exit 1
            }

      - name: Login to GCR
        run: gcloud auth configure-docker

      - name: Validate Pusher runtime capability admission before publishing
        if: env.SERVICE == 'pusher'
        run: |
          python3 -m pip install -q pyyaml
          python3 backend/scripts/validate-backend-runtime-env.py --env "${{ vars.ENV }}"

      - name: Verify live finalization alert route before publishing
        if: env.SERVICE == 'pusher'
        env:
          # Dest: repo MONITOR_GRAFANA_TOKEN → monitor.omiapi.com
          # Prod: environment MONITOR_GRAFANA_TOKEN → monitor.omi.me
          # Do not use GRAFANA_TOKEN; that belongs to the TV Cloud Run Grafana.
          MONITOR_GRAFANA_TOKEN: ${{ secrets.MONITOR_GRAFANA_TOKEN }}
        run: |
          set -euo pipefail
          umask 077
          token_file="$(mktemp "$RUNNER_TEMP/omi-grafana-token.XXXXXX")"
          cleanup() { rm -f "$token_file"; unset MONITOR_GRAFANA_TOKEN; }
          trap cleanup EXIT
          test -n "$MONITOR_GRAFANA_TOKEN"
          case "${{ vars.ENV }}" in
            dev|development) grafana_url=https://monitor.omiapi.com ;;
            prod) grafana_url=https://monitor.omi.me ;;
            *) echo "Unsupported Grafana environment." >&2; exit 1 ;;
          esac
          printf '%s' "$MONITOR_GRAFANA_TOKEN" > "$token_file"
          python3 backend/scripts/verify_pusher_live_alert_route.py \
            --grafana-url "$grafana_url" \
            --token-file "$token_file" \
            --phase prepublish

      - name: Set up Docker Buildx
        if: env.SERVICE == 'llm-gateway' || github.event.inputs.environment != 'prod'
        uses: docker/setup-buildx-action@v4

      - name: Build and Push Docker image
        if: env.SERVICE == 'llm-gateway' || github.event.inputs.environment != 'prod'
        run: |
          if [[ "${{ env.SERVICE }}" == "llm-gateway" ]]; then
            docker build -t gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG} -f backend/Dockerfile .
            python3 backend/scripts/runtime_image_contracts.py smoke \
              --dockerfile backend/Dockerfile \
              --image gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG}
          else
            docker build -t gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG} -f backend/pusher/Dockerfile .
            python3 backend/scripts/runtime_image_contracts.py smoke \
              --dockerfile backend/pusher/Dockerfile \
              --image gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG}
          fi
          docker push gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG}

      - name: Resolve immutable development Pusher image
        if: env.SERVICE == 'pusher' && github.event.inputs.environment != 'prod'
        run: |
          set -euo pipefail
          PUSHER_IMAGE_REPOSITORY="gcr.io/${{ vars.GCP_PROJECT_ID }}/pusher"
          PUSHER_IMAGE_DIGEST="$(gcloud container images describe "${PUSHER_IMAGE_REPOSITORY}:${IMAGE_TAG}" --format='value(image_summary.digest)')"
          if [[ ! "$PUSHER_IMAGE_DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
            echo "Pusher image did not resolve to an exact digest after push." >&2
            exit 1
          fi
          {
            echo "PUSHER_IMAGE_REPOSITORY=$PUSHER_IMAGE_REPOSITORY"
            echo "PUSHER_IMAGE_DIGEST=$PUSHER_IMAGE_DIGEST"
            echo "PUSHER_IMAGE_REFERENCE=${PUSHER_IMAGE_REPOSITORY}@${PUSHER_IMAGE_DIGEST}"
          } >> "$GITHUB_ENV"

      - name: Promote qualified Pusher digest into the production registry
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          set -euo pipefail
          test -n "$PUSHER_DEV_IMAGE_REPOSITORY"
          test -n "$PUSHER_IMAGE_DIGEST"
          PUSHER_IMAGE_REPOSITORY="gcr.io/${{ vars.GCP_PROJECT_ID }}/pusher"
          SOURCE_IMAGE="${PUSHER_DEV_IMAGE_REPOSITORY}@${PUSHER_IMAGE_DIGEST}"
          PROMOTION_TAG="promotion-${PUSHER_IMAGE_DIGEST#sha256:}"
          gcloud container images describe "$SOURCE_IMAGE" --format='value(image_summary.digest)' | grep -Fx "$PUSHER_IMAGE_DIGEST"
          gcloud container images add-tag --quiet "$SOURCE_IMAGE" "${PUSHER_IMAGE_REPOSITORY}:${PROMOTION_TAG}"
          PROMOTED_DIGEST="$(gcloud container images describe "${PUSHER_IMAGE_REPOSITORY}:${PROMOTION_TAG}" --format='value(image_summary.digest)')"
          if [[ "$PROMOTED_DIGEST" != "$PUSHER_IMAGE_DIGEST" ]]; then
            echo "Registry promotion did not preserve the development-qualified digest." >&2
            exit 1
          fi
          {
            echo "PUSHER_IMAGE_REPOSITORY=$PUSHER_IMAGE_REPOSITORY"
            echo "PUSHER_IMAGE_REFERENCE=${PUSHER_IMAGE_REPOSITORY}@${PUSHER_IMAGE_DIGEST}"
          } >> "$GITHUB_ENV"

      - name: Verify Pusher static rollout controls
        if: env.SERVICE == 'pusher'
        run: |
          python3 backend/scripts/verify_pusher_rollout_budget.py
          python3 backend/scripts/verify_pusher_rollout_gate.py preflight
          python3 backend/scripts/verify_pusher_cohost_env_diff.py
          python3 backend/scripts/verify_pusher_dev_observability.py

      - name: Get GKE credentials
        uses: google-github-actions/get-gke-credentials@v3
        with:
          cluster_name: ${{ vars.GKE_CLUSTER }}
          location: ${{ env.REGION }}
          project_id: ${{ vars.GCP_PROJECT_ID }}

      - name: Resolve production pusher runtime targets
        if: env.SERVICE == 'pusher' && vars.ENV == 'prod'
        id: pusher-runtime-targets
        run: |
          set -euo pipefail
          SYNC_SERVICE_URL="$(
            gcloud run services describe backend-sync \
              --region="${{ env.REGION }}" \
              --project="${{ vars.GCP_PROJECT_ID }}" \
              --format='value(status.url)'
          )"
          SYNC_TASKS_INVOKER_SA="$(
            gcloud run services describe backend-sync \
              --region="${{ env.REGION }}" \
              --project="${{ vars.GCP_PROJECT_ID }}" \
              --format=json \
              | jq -r '.spec.template.spec.containers[0].env[]? | select(.name == "SYNC_TASKS_INVOKER_SA") | .value'
          )"
          test -n "$SYNC_SERVICE_URL"
          test -n "$SYNC_TASKS_INVOKER_SA"
          {
            echo "account_deletion_handler_url=${SYNC_SERVICE_URL}/v1/users/account-deletion-wipes/run"
            echo "sync_tasks_handler_url=${SYNC_SERVICE_URL}/v2/sync-jobs/run"
            echo "sync_tasks_invoker_sa=${SYNC_TASKS_INVOKER_SA}"
          } >> "$GITHUB_OUTPUT"

      - name: Preflight existing pusher ConfigMap and Secret references
        if: env.SERVICE == 'pusher'
        run: |
          python3 -m pip install -q pyyaml
          python3 backend/scripts/verify_pusher_config_references.py \
            --environment ${{ vars.ENV }} --namespace ${{ vars.ENV }}-omi-backend --render-only

      - name: Create isolated proposed production Pusher ConfigMap
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        env:
          ACCOUNT_DELETION_HANDLER_URL: ${{ steps.pusher-runtime-targets.outputs.account_deletion_handler_url }}
          CONVERSATION_SUMMARIZED_APP_IDS: ${{ vars.CONVERSATION_SUMMARIZED_APP_IDS }}
          ENVIRONMENT: ${{ vars.ENV }}
          GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
          MCP_AUTHORIZATION_SERVER_URL: ${{ vars.MCP_AUTHORIZATION_SERVER_URL }}
          MCP_OAUTH_CHATGPT_CLIENT_ID: ${{ vars.MCP_OAUTH_CHATGPT_CLIENT_ID }}
          MCP_OAUTH_CHATGPT_REDIRECT_URIS: ${{ vars.MCP_OAUTH_CHATGPT_REDIRECT_URIS }}
          MCP_OAUTH_CLAUDE_CLIENT_ID: ${{ vars.MCP_OAUTH_CLAUDE_CLIENT_ID }}
          MCP_OAUTH_CLAUDE_CLIENT_NAME: ${{ vars.MCP_OAUTH_CLAUDE_CLIENT_NAME }}
          MCP_OAUTH_CLAUDE_REDIRECT_URIS: ${{ vars.MCP_OAUTH_CLAUDE_REDIRECT_URIS }}
          MCP_OAUTH_PUBLIC_CLIENT_ID: ${{ vars.MCP_OAUTH_PUBLIC_CLIENT_ID }}
          MCP_OAUTH_PUBLIC_REDIRECT_URIS: ${{ vars.MCP_OAUTH_PUBLIC_REDIRECT_URIS }}
          MCP_RESOURCE_URL: ${{ vars.MCP_RESOURCE_URL }}
          RAPID_API_HOST: ${{ vars.RAPID_API_HOST }}
          REDIS_DB_HOST: ${{ vars.REDIS_DB_HOST }}
          STT_PRERECORDED_MODEL: parakeet,modulate-velma-2
          STT_SERVICE_MODELS: dg-nova-3,modulate-velma-2,parakeet
          SYNC_TASKS_HANDLER_URL: ${{ steps.pusher-runtime-targets.outputs.sync_tasks_handler_url }}
          SYNC_TASKS_INVOKER_SA: ${{ steps.pusher-runtime-targets.outputs.sync_tasks_invoker_sa }}
          TYPESENSE_HOST: ${{ vars.TYPESENSE_HOST }}
          TWILIO_ACCOUNT_SID: ${{ vars.TWILIO_ACCOUNT_SID }}
          TWILIO_API_KEY_SID: ${{ vars.TWILIO_API_KEY_SID }}
          TWILIO_TWIML_APP_SID: ${{ vars.TWILIO_TWIML_APP_SID }}
          X_OAUTH_CLIENT_ID: ${{ vars.X_OAUTH_CLIENT_ID }}
          X_OAUTH_REDIRECT_URI: ${{ vars.X_OAUTH_REDIRECT_URI }}
        run: |
          set -euo pipefail
          PUSHER_CANARY_CONFIG="prod-omi-backend-config-canary-${GITHUB_RUN_ID}"
          PUSHER_CANARY="prod-omi-pusher-canary-${GITHUB_RUN_ID}"
          LISTENER_CANARY="prod-omi-listener-canary-${GITHUB_RUN_ID}"
          {
            echo "PUSHER_CANARY_CONFIG=$PUSHER_CANARY_CONFIG"
            echo "PUSHER_CANARY=$PUSHER_CANARY"
            echo "LISTENER_CANARY=$LISTENER_CANARY"
          } >> "$GITHUB_ENV"
          CONFIG_MAP_NAME_OVERRIDE="$PUSHER_CANARY_CONFIG" backend/scripts/deploy-backend-config.sh

      - name: Create isolated production Pusher and listener canary
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          set -euo pipefail
          python3 -m pip install -q pyyaml websockets==12.0
          test -n "$PUSHER_CANARY" -a -n "$LISTENER_CANARY" -a -n "$PUSHER_CANARY_CONFIG"
          helm -n prod-omi-backend upgrade --install "$PUSHER_CANARY" ./backend/charts/pusher \
            -f ./backend/charts/pusher/prod_omi_pusher_values.yaml \
            --set-string "fullnameOverride=$PUSHER_CANARY" \
            --set autoscaling.enabled=false \
            --set replicaCount=1 \
            --set ingress.enabled=false \
            --set-json podDisruptionBudget=null \
            --set-string "service.backendConfig=$PUSHER_CANARY-backend-config" \
            --set-json 'service.annotations={}' \
            --set-string "runtimeConfigMapName=$PUSHER_CANARY_CONFIG" \
            --set-string "image.repository=$PUSHER_IMAGE_REPOSITORY" \
            --set-string "image.digest=$PUSHER_IMAGE_DIGEST" \
            --set-string image.tag= \
            --set-string image.pullPolicy=IfNotPresent
          # The isolated canary is exactly one replica with HPA disabled; this
          # covers the committed per-pod startup budget without inheriting the
          # fourteen-wave timeout required by the shared 40-pod release.
          kubectl -n prod-omi-backend rollout status "deployment/$PUSHER_CANARY" --timeout=900s
          python3 backend/scripts/pusher_release_receipt.py record-live \
            --environment prod \
            --namespace prod-omi-backend \
            --repository "$PUSHER_IMAGE_REPOSITORY" \
            --digest "$PUSHER_IMAGE_DIGEST" \
            --source-sha "$CHECKED_OUT_SHA" \
            --run-id "$GITHUB_RUN_ID" \
            --release-name "$PUSHER_CANARY" \
            --isolated-canary \
            --config-map-name "$PUSHER_CANARY_CONFIG" \
            --output pusher-prod-canary-deployment-receipt.json
          python3 backend/scripts/pusher_prod_canary.py create-listener \
            --namespace prod-omi-backend \
            --source-deployment prod-omi-backend-listen \
            --source-service prod-omi-backend-listen \
            --name "$LISTENER_CANARY" \
            --pusher-url "http://$PUSHER_CANARY.prod-omi-backend.svc.cluster.local:8080" \
            --output pusher-prod-canary-listener-receipt.json

      - name: Exercise isolated production Pusher finalization semantics
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          set -euo pipefail
          umask 077
          token_file="$(mktemp "$RUNNER_TEMP/omi-pusher-prod-canary-token.XXXXXX")"
          port_forward_log="$(mktemp "$RUNNER_TEMP/omi-pusher-prod-canary-forward.XXXXXX")"
          cleanup_probe() {
            rm -f "$token_file" "$port_forward_log"
            if [[ -n "${port_forward_pid:-}" ]]; then kill "$port_forward_pid" 2>/dev/null || true; fi
          }
          trap cleanup_probe EXIT
          python3 backend/scripts/firebase_release_probe_token.py \
            --secret-project "${{ vars.GCP_PROJECT_ID }}" \
            --firebase-project based-hardware \
            --token-output "$token_file"
          kubectl -n prod-omi-backend port-forward "service/$LISTENER_CANARY" 18080:8080 \
            >"$port_forward_log" 2>&1 &
          port_forward_pid=$!
          ready=false
          for _ in $(seq 1 30); do
            if curl --fail --silent --max-time 2 http://127.0.0.1:18080/health >/dev/null; then
              ready=true
              break
            fi
            if ! kill -0 "$port_forward_pid" 2>/dev/null; then break; fi
            sleep 1
          done
          if [[ "$ready" != true ]]; then
            echo "Isolated listener port-forward did not become healthy." >&2
            exit 1
          fi
          python3 backend/scripts/pusher_semantic_probe.py \
            --api-url http://127.0.0.1:18080 \
            --allow-local-http \
            --bearer-token-file "$token_file" \
            --deployment-receipt pusher-prod-canary-deployment-receipt.json \
            --project "${{ vars.GCP_PROJECT_ID }}" \
            --namespace prod-omi-backend \
            --run-id "$GITHUB_RUN_ID" \
            --output pusher-prod-canary-semantic-probe.json
          python3 backend/scripts/pusher_prod_canary.py record-canary \
            --semantic-evidence pusher-prod-canary-semantic-probe.json \
            --pusher-receipt pusher-prod-canary-deployment-receipt.json \
            --listener-receipt pusher-prod-canary-listener-receipt.json \
            --qualification-deployment-receipt "$PUSHER_QUALIFICATION_DEPLOYMENT_RECEIPT" \
            --source-sha "$CHECKED_OUT_SHA" \
            --digest "$PUSHER_IMAGE_DIGEST" \
            --run-id "$GITHUB_RUN_ID" \
            --output pusher-prod-canary-evidence.json
          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > pusher-prod-canary-run.json
          EXPECTED_CANARY_WORKFLOW_ID="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/gcp_backend_pusher.yml" --jq .id)"
          python3 backend/scripts/verify_pusher_promotion_evidence.py \
            --phase canary \
            --evidence "$PUSHER_QUALIFICATION_EVIDENCE" \
            --deployment-receipt "$PUSHER_QUALIFICATION_DEPLOYMENT_RECEIPT" \
            --canary-evidence pusher-prod-canary-evidence.json \
            --canary-deployment-receipt pusher-prod-canary-deployment-receipt.json \
            --canary-semantic-evidence pusher-prod-canary-semantic-probe.json \
            --canary-run-json pusher-prod-canary-run.json \
            --run-json "$PUSHER_QUALIFICATION_RUN_JSON" \
            --expected-digest "$PUSHER_IMAGE_DIGEST" \
            --expected-repository "$PUSHER_DEV_IMAGE_REPOSITORY" \
            --expected-workflow-id "$PUSHER_QUALIFICATION_WORKFLOW_ID" \
            --expected-run-id "$PUSHER_QUALIFICATION_RUN_ID" \
            --expected-canary-workflow-id "$EXPECTED_CANARY_WORKFLOW_ID" \
            --expected-canary-run-id "$GITHUB_RUN_ID"

      - name: Upload protected production Pusher canary evidence
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        uses: actions/upload-artifact@v7
        with:
          name: pusher-prod-canary-evidence
          path: |
            pusher-prod-canary-evidence.json
            pusher-prod-canary-deployment-receipt.json
            pusher-prod-canary-listener-receipt.json
            pusher-prod-canary-semantic-probe.json
          if-no-files-found: error
          retention-days: 90

      - name: Remove isolated production Pusher canary
        if: always() && env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          set +e
          cleanup_failed=0
          if [[ ! "${LISTENER_CANARY:-}" =~ ^prod-omi-listener-canary-[1-9][0-9]*$ ]] || \
             [[ ! "${PUSHER_CANARY:-}" =~ ^prod-omi-pusher-canary-[1-9][0-9]*$ ]] || \
             [[ ! "${PUSHER_CANARY_CONFIG:-}" =~ ^prod-omi-backend-config-canary-[1-9][0-9]*$ ]]; then
            echo "Canary names were not initialized to this workflow run; refusing broad cleanup." >&2
            exit 1
          fi
          kubectl -n prod-omi-backend delete service "$LISTENER_CANARY" --ignore-not-found=true --wait=true || cleanup_failed=1
          kubectl -n prod-omi-backend delete deployment "$LISTENER_CANARY" --ignore-not-found=true --wait=true || cleanup_failed=1
          helm -n prod-omi-backend uninstall "$PUSHER_CANARY" --wait || cleanup_failed=1
          kubectl -n prod-omi-backend delete configmap "$PUSHER_CANARY_CONFIG" --ignore-not-found=true --wait=true || cleanup_failed=1
          exit "$cleanup_failed"

      - name: Apply non-secret pusher runtime config
        if: env.SERVICE == 'pusher'
        env:
          ACCOUNT_DELETION_HANDLER_URL: ${{ steps.pusher-runtime-targets.outputs.account_deletion_handler_url }}
          CONVERSATION_SUMMARIZED_APP_IDS: ${{ vars.CONVERSATION_SUMMARIZED_APP_IDS }}
          ENVIRONMENT: ${{ vars.ENV }}
          GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
          MCP_AUTHORIZATION_SERVER_URL: ${{ vars.MCP_AUTHORIZATION_SERVER_URL }}
          MCP_OAUTH_CHATGPT_CLIENT_ID: ${{ vars.MCP_OAUTH_CHATGPT_CLIENT_ID }}
          MCP_OAUTH_CHATGPT_REDIRECT_URIS: ${{ vars.MCP_OAUTH_CHATGPT_REDIRECT_URIS }}
          MCP_OAUTH_CLAUDE_CLIENT_ID: ${{ vars.MCP_OAUTH_CLAUDE_CLIENT_ID }}
          MCP_OAUTH_CLAUDE_CLIENT_NAME: ${{ vars.MCP_OAUTH_CLAUDE_CLIENT_NAME }}
          MCP_OAUTH_CLAUDE_REDIRECT_URIS: ${{ vars.MCP_OAUTH_CLAUDE_REDIRECT_URIS }}
          MCP_OAUTH_PUBLIC_CLIENT_ID: ${{ vars.MCP_OAUTH_PUBLIC_CLIENT_ID }}
          MCP_OAUTH_PUBLIC_REDIRECT_URIS: ${{ vars.MCP_OAUTH_PUBLIC_REDIRECT_URIS }}
          MCP_RESOURCE_URL: ${{ vars.MCP_RESOURCE_URL }}
          RAPID_API_HOST: ${{ vars.RAPID_API_HOST }}
          REDIS_DB_HOST: ${{ vars.REDIS_DB_HOST }}
          STT_PRERECORDED_MODEL: parakeet,modulate-velma-2
          STT_SERVICE_MODELS: modulate-velma-2,soniox,dg-nova-3,parakeet
          SYNC_TASKS_HANDLER_URL: ${{ steps.pusher-runtime-targets.outputs.sync_tasks_handler_url }}
          SYNC_TASKS_INVOKER_SA: ${{ steps.pusher-runtime-targets.outputs.sync_tasks_invoker_sa }}
          TYPESENSE_HOST: ${{ vars.TYPESENSE_HOST }}
          TWILIO_ACCOUNT_SID: ${{ vars.TWILIO_ACCOUNT_SID }}
          TWILIO_API_KEY_SID: ${{ vars.TWILIO_API_KEY_SID }}
          TWILIO_TWIML_APP_SID: ${{ vars.TWILIO_TWIML_APP_SID }}
          X_OAUTH_CLIENT_ID: ${{ vars.X_OAUTH_CLIENT_ID }}
          X_OAUTH_REDIRECT_URI: ${{ vars.X_OAUTH_REDIRECT_URI }}
        run: backend/scripts/deploy-backend-config.sh

      - name: Verify reconciled pusher ConfigMap and Secret references
        if: env.SERVICE == 'pusher'
        run: |
          python3 -m pip install -q pyyaml
          python3 backend/scripts/verify_pusher_config_references.py \
            --environment ${{ vars.ENV }} --namespace ${{ vars.ENV }}-omi-backend

      - name: Verify live Pusher surge capacity and digest render
        if: env.SERVICE == 'pusher' && github.event.inputs.skip_live_capacity_gate != 'true'
        run: |
          python3 backend/scripts/verify_pusher_live_deployment_gate.py \
            --environment ${{ vars.ENV }} \
            --namespace ${{ vars.ENV }}-omi-backend \
            --image "$PUSHER_IMAGE_REFERENCE"

      - name: Deploy Pusher to GKE cluster using Helm
        env:
          LLM_GATEWAY_GSA: ${{ vars.LLM_GATEWAY_GSA }}
          ENVIRONMENT: ${{ vars.ENV }}
          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
          GKE_CLUSTER: ${{ vars.GKE_CLUSTER }}
          REGION: ${{ env.REGION }}
        run: |
          if [[ "${{ env.SERVICE }}" == "llm-gateway" ]]; then
            test -n "$LLM_GATEWAY_GSA"
            python3 -m pip install -q pyyaml
            python3 backend/scripts/validate-llm-gateway-env.py \
              backend/charts/backend-listen/${{ vars.ENV }}_omi_backend_listen_values.yaml \
              backend/charts/llm-gateway/${{ vars.ENV }}_omi_llm_gateway_values.yaml
            if ! IMAGE_TAG="${IMAGE_TAG}" backend/scripts/deploy-llm-gateway.sh; then
              python3 backend/scripts/deploy_status_report.py --env ${{ vars.ENV }} --include-gke --gke-service llm-gateway || true
              echo "=== llm-gateway deployment ==="
              kubectl -n ${{ vars.ENV }}-omi-backend describe deploy/${{ vars.ENV }}-omi-llm-gateway || true
              echo "=== llm-gateway pods ==="
              kubectl -n ${{ vars.ENV }}-omi-backend get pods -l app.kubernetes.io/instance=${{ vars.ENV }}-omi-llm-gateway -o wide || true
              kubectl -n ${{ vars.ENV }}-omi-backend describe pods -l app.kubernetes.io/instance=${{ vars.ENV }}-omi-llm-gateway || true
              # NOTE: raw `kubectl logs` is intentionally omitted here because the gateway is an
              # OpenAI-compatible service that processes chat content and service tokens — its
              # runtime logs may leak sensitive payloads into CI output. Use `gcloud compute ssh`,
              # `kubectl logs` interactively from an authenticated operator shell, or structured
              # error reporting instead of dumping raw logs in CI.
              echo "=== backend ExternalSecret status ==="
              kubectl -n ${{ vars.ENV }}-omi-backend describe externalsecret/${{ vars.ENV }}-omi-backend-external-secret || true
              echo "=== backend secret key presence ==="
              kubectl -n ${{ vars.ENV }}-omi-backend get secret ${{ vars.ENV }}-omi-backend-secrets -o jsonpath='{.data}' | python -c 'import json,sys; print("\\n".join(sorted(json.load(sys.stdin).keys())))' || true
              exit 1
            fi
            python3 backend/scripts/deploy_status_report.py --env ${{ vars.ENV }} --include-gke --gke-service llm-gateway
          else
            helm -n ${{ vars.ENV }}-omi-backend upgrade --install ${{ vars.ENV }}-omi-pusher ./backend/charts/pusher -f ./backend/charts/pusher/${{ vars.ENV }}_omi_pusher_values.yaml --set-string "image.repository=${PUSHER_IMAGE_REPOSITORY}" --set-string "image.digest=${PUSHER_IMAGE_DIGEST}" --set-string image.tag= --set-string image.pullPolicy=IfNotPresent
            # Must cover the chart-derived Pusher rollout budget (fourteen
            # availability waves at the current production HPA ceiling).
            if ! kubectl -n ${{ vars.ENV }}-omi-backend rollout status deploy/${{ vars.ENV }}-omi-pusher --timeout=9600s; then
              python3 backend/scripts/deploy_status_report.py --env ${{ vars.ENV }} --include-gke --gke-service pusher || true
              exit 1
            fi
            python3 backend/scripts/deploy_status_report.py --env ${{ vars.ENV }} --include-gke --gke-service pusher
          fi

      - name: Record exact live production Pusher deployment receipt
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          python3 backend/scripts/pusher_release_receipt.py record-live \
            --environment "${{ vars.ENV }}" \
            --namespace "${{ vars.ENV }}-omi-backend" \
            --repository "$PUSHER_IMAGE_REPOSITORY" \
            --digest "$PUSHER_IMAGE_DIGEST" \
            --source-sha "$CHECKED_OUT_SHA" \
            --run-id "$GITHUB_RUN_ID" \
            --output pusher-prod-deployment-receipt.json

      - name: Reverify live finalization alert route after production rollout
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        env:
          MONITOR_GRAFANA_TOKEN: ${{ secrets.MONITOR_GRAFANA_TOKEN }}
        run: |
          set -euo pipefail
          umask 077
          token_file="$(mktemp "$RUNNER_TEMP/omi-grafana-final-token.XXXXXX")"
          cleanup() { rm -f "$token_file"; unset MONITOR_GRAFANA_TOKEN; }
          trap cleanup EXIT
          test -n "$MONITOR_GRAFANA_TOKEN"
          printf '%s' "$MONITOR_GRAFANA_TOKEN" > "$token_file"
          python3 backend/scripts/verify_pusher_live_alert_route.py \
            --grafana-url https://monitor.omi.me \
            --token-file "$token_file" \
            --phase postrollout \
            --attempts 12

      - name: Verify final production Pusher matches the canary-qualified candidate
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        run: |
          EXPECTED_CANARY_WORKFLOW_ID="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/gcp_backend_pusher.yml" --jq .id)"
          python3 backend/scripts/verify_pusher_promotion_evidence.py \
            --phase final \
            --evidence "$PUSHER_QUALIFICATION_EVIDENCE" \
            --deployment-receipt "$PUSHER_QUALIFICATION_DEPLOYMENT_RECEIPT" \
            --canary-evidence pusher-prod-canary-evidence.json \
            --canary-deployment-receipt pusher-prod-canary-deployment-receipt.json \
            --canary-semantic-evidence pusher-prod-canary-semantic-probe.json \
            --canary-run-json pusher-prod-canary-run.json \
            --final-deployment-receipt pusher-prod-deployment-receipt.json \
            --expected-final-repository "$PUSHER_IMAGE_REPOSITORY" \
            --run-json "$PUSHER_QUALIFICATION_RUN_JSON" \
            --expected-digest "$PUSHER_IMAGE_DIGEST" \
            --expected-repository "$PUSHER_DEV_IMAGE_REPOSITORY" \
            --expected-workflow-id "$PUSHER_QUALIFICATION_WORKFLOW_ID" \
            --expected-run-id "$PUSHER_QUALIFICATION_RUN_ID" \
            --expected-canary-workflow-id "$EXPECTED_CANARY_WORKFLOW_ID" \
            --expected-canary-run-id "$GITHUB_RUN_ID"

      - name: Upload exact live production Pusher deployment receipt
        if: env.SERVICE == 'pusher' && github.event.inputs.environment == 'prod'
        uses: actions/upload-artifact@v7
        with:
          name: pusher-prod-deployment-receipt
          path: pusher-prod-deployment-receipt.json
          if-no-files-found: error
          retention-days: 90

      - name: Verify LLM Gateway serving data plane
        if: env.SERVICE == 'llm-gateway'
        id: gateway-serving
        run: |
          python3 backend/scripts/verify-llm-gateway-serving.py \
            --environment="${{ vars.ENV }}" \
            --project="${{ vars.GCP_PROJECT_ID }}" \
            --region="${{ env.REGION }}" \
            --github-output "$GITHUB_OUTPUT"

      - name: Probe LLM Gateway from the Cloud Run VPC
        if: env.SERVICE == 'llm-gateway'
        run: |
          bash backend/scripts/probe-llm-gateway-from-cloud-run.sh \
            --project "${{ vars.GCP_PROJECT_ID }}" \
            --region "${{ env.REGION }}" \
            --image "gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG}" \
            --gateway-url "${{ steps.gateway-serving.outputs.gateway_url }}" \
            --network "${{ vars.CLOUD_RUN_VPC_NETWORK }}" \
            --subnet "${{ vars.CLOUD_RUN_VPC_SUBNET }}" \
            --vpc-egress private-ranges-only \
            --name-suffix "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

      - name: Smoke LLM Gateway
        if: env.SERVICE == 'llm-gateway'
        run: |
          SMOKE_POD="llm-gateway-smoke-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}"
          cleanup() {
            kubectl -n ${{ vars.ENV }}-omi-backend delete pod "$SMOKE_POD" --ignore-not-found=true
          }
          trap cleanup EXIT

          cat <<EOF | kubectl -n ${{ vars.ENV }}-omi-backend apply -f -
          apiVersion: v1
          kind: Pod
          metadata:
            name: $SMOKE_POD
          spec:
            restartPolicy: Never
            containers:
              - name: smoke
                image: gcr.io/${{ vars.GCP_PROJECT_ID }}/${{ env.SERVICE }}:${IMAGE_TAG}
                command: ["sh", "-c", "python scripts/smoke-llm-gateway.py --url \"\$SMOKE_URL\" --token \"\$SMOKE_TOKEN\" --check-metrics --metrics-token \"\$METRICS_SECRET\""]
                env:
                  - name: SMOKE_URL
                    value: http://${{ vars.ENV }}-omi-llm-gateway.${{ vars.ENV }}-omi-backend.svc.cluster.local:8080
                  - name: SMOKE_TOKEN
                    valueFrom:
                      secretKeyRef:
                        name: ${{ vars.ENV }}-omi-backend-secrets
                        key: OMI_LLM_GATEWAY_SERVICE_TOKEN
                  - name: METRICS_SECRET
                    valueFrom:
                      secretKeyRef:
                        name: ${{ vars.ENV }}-omi-backend-secrets
                        key: METRICS_SECRET
          EOF

          for _ in {1..120}; do
            PHASE="$(kubectl -n ${{ vars.ENV }}-omi-backend get pod "$SMOKE_POD" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
            if [[ "$PHASE" == "Succeeded" ]]; then
              echo "=== llm-gateway smoke pod ==="
              kubectl -n ${{ vars.ENV }}-omi-backend get pod "$SMOKE_POD" -o wide || true
              kubectl -n ${{ vars.ENV }}-omi-backend get pod "$SMOKE_POD" -o jsonpath='{.status.phase}{"\n"}{range .status.containerStatuses[*]}{.name}{" ready="}{.ready}{" state="}{.state.terminated.reason}{" exit="}{.state.terminated.exitCode}{"\n"}{end}' || true
              echo "=== llm-gateway smoke logs ==="
              kubectl -n ${{ vars.ENV }}-omi-backend logs "$SMOKE_POD" || true
              exit 0
            fi
            if [[ "$PHASE" == "Failed" ]]; then
              break
            fi
            sleep 1
          done

          echo "=== llm-gateway smoke pod ==="
          kubectl -n ${{ vars.ENV }}-omi-backend get pod "$SMOKE_POD" -o wide || true
          kubectl -n ${{ vars.ENV }}-omi-backend get pod "$SMOKE_POD" -o jsonpath='{.status.phase}{"\n"}{range .status.containerStatuses[*]}{.name}{" ready="}{.ready}{" state="}{.state.terminated.reason}{" exit="}{.state.terminated.exitCode}{"\n"}{end}' || true
          echo "=== llm-gateway smoke logs ==="
          kubectl -n ${{ vars.ENV }}-omi-backend logs "$SMOKE_POD" || true
          exit 1

      # If required, use the Cloud Run url output in later steps
      - name: Show Output
        run: echo "${{ env.SERVICE }} deployed to ${{ github.event.inputs.environment }}"

      - name: Record live-capacity-gate break-glass use
        if: always() && env.SERVICE == 'pusher' && github.event.inputs.skip_live_capacity_gate == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          # Match the repo's break-glass audit convention from gcp_backend.yml.
          # The gate being unusable is the defect; this issue tracks fixing it.
          gh issue create --repo "$GITHUB_REPOSITORY" \
            --title "Pusher live capacity gate bypassed for ${CHECKED_OUT_SHA:0:10} (${{ github.event.inputs.environment }})" \
            --body "$(printf '%s\n' \
              "Pusher deploy ran without the live surge-capacity gate." \
              "" \
              "- SHA: \`${CHECKED_OUT_SHA}\` (verified ancestor of main)" \
              "- Environment: ${{ github.event.inputs.environment }}" \
              "- Operator: @${GITHUB_ACTOR}" \
              "- Reason: ${{ github.event.inputs.break_glass_reason }}" \
              "- Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
              "" \
              "The gate being unusable is the defect. Fix the gate, then close this.")" || true

      - name: Generate deployment summary
        if: always() && github.event.inputs.environment == 'prod'
        uses: ./.github/actions/deployment-summary
        with:
          environment: ${{ github.event.inputs.environment }}
          release_version: ${{ github.event.inputs.release_version }}
          status: ${{ job.status }}
          service: ${{ env.SERVICE }}

      - name: Notify deployment status on Telegram
        if: always() && github.event.inputs.environment == 'prod'
        uses: ./.github/actions/deployment-notifier
        with:
          environment: ${{ github.event.inputs.environment }}
          release_version: ${{ github.event.inputs.release_version }}
          status: ${{ job.status }}
          telegram_bot_token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          telegram_chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}