Merge branch 'main' into mark/oss-162-a2ui-recovery-client-ux

Author: contextablemark

.github/workflows/showcase_build.yml

@@ -15,6 +15,7 @@ on:
     branches: [main]
     paths:
       - "showcase/**"
+      - "examples/integrations/**"
       - ".github/workflows/showcase_build.yml"
       - ".github/workflows/showcase_build_check.yml"
   workflow_dispatch:
@@ -52,6 +53,22 @@ on:
           - showcase-harness
           - showcase-aimock
           - webhooks
+          # Per-starter image builds (model B, §b stage 1). These map to the
+          # build-starters job below, NOT the showcase `build` job. "all"
+          # builds the full showcase fleet AND all 12 starters; a specific
+          # starter slug narrows to that one starter via STARTER_DISPATCH.
+          - starter-langgraph-python
+          - starter-mastra
+          - starter-langgraph-js
+          - starter-crewai-crews
+          - starter-pydantic-ai
+          - starter-adk
+          - starter-agno
+          - starter-llamaindex
+          - starter-langgraph-fastapi
+          - starter-strands-python
+          - starter-ms-agent-framework-python
+          - starter-ms-agent-framework-dotnet
 
 # No top-level concurrency group. Every build run completes. This is the
 # whole point of the decoupling: rapid pushes to main no longer cancel
@@ -245,10 +262,23 @@ jobs:
           # done — a common "did my dispatch deploy?" footgun. The `all` and
           # empty (push-event) modes legitimately produce [] when there are
           # no changes and must still succeed.
-          if [ "$MATRIX" = "[]" ] && [ -n "$DISPATCH" ] && [ "$DISPATCH" != "all" ]; then
-            echo "::error::workflow_dispatch service='$DISPATCH' did not match any entry in ALL_SERVICES — check the dispatch_name spelling"
-            exit 1
-          fi
+          #
+          # The `starter-*` namespace is OWNED by the detect-starter-changes
+          # job (which scopes its OWN fail-loud to `starter-*`). A
+          # `service=starter-<slug>` dispatch legitimately yields [] here
+          # (no showcase service is named `starter-*`), so it must SKIP — an
+          # empty showcase matrix, NOT a fail-loud exit 1. Mirrors how the
+          # starter job scopes its fail-loud to the `starter-*` namespace.
+          case "$DISPATCH" in
+            starter-*) ;; # starter namespace → empty showcase matrix + skip
+            "" | "all") ;; # push / full-fleet → [] is legitimate
+            *)
+              if [ "$MATRIX" = "[]" ]; then
+                echo "::error::workflow_dispatch service='$DISPATCH' did not match any entry in ALL_SERVICES — check the dispatch_name spelling"
+                exit 1
+              fi
+              ;;
+          esac
 
           echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
           if [ "$MATRIX" = "[]" ]; then
@@ -436,6 +466,180 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # ────────────────────────────────────────────────────────────────────
+  # Per-starter image publish (model B, §b stage 1 / Phase 1).
+  #
+  # Fully decoupled from the showcase `build`→`aggregate`→`redeploy` chain
+  # above: starters are self-contained npm projects (no monorepo-source
+  # build, no shared-module copy) and build from their own root Dockerfile
+  # at examples/integrations/<slug>/Dockerfile (the single-image deployable:
+  # Next.js frontend + agent, EXPOSE 3000, CMD entrypoint.sh — distinct from
+  # the docker/Dockerfile.app + docker/Dockerfile.agent split stack used by
+  # docker-compose.test.yml). Published to ghcr.io/copilotkit/starter-<slug>
+  # (the `starter-` prefix is disjoint from `showcase-*`; S2's harness
+  # discovery filters on namePrefix "starter-"). Railway deploy is the
+  # gated S5 — NOT done here.
+  #
+  # The 12 starter slugs are the matrix source of truth (the smoke matrix in
+  # test_smoke-starter.yml and STARTER_TO_COLUMN in
+  # showcase/harness/src/probes/helpers/starter-mapping.ts). The dashboard
+  # column remap lives in the harness (§a), so this layer uses raw starter
+  # slugs.
+  detect-starter-changes:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.starter-matrix.outputs.matrix }}
+      has_changes: ${{ steps.starter-matrix.outputs.has_changes }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Detect changed starter paths
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: filter
+        with:
+          filters: |
+            workflow_config:
+              - '.github/workflows/showcase_build.yml'
+            langgraph_python:
+              - 'examples/integrations/langgraph-python/**'
+            mastra:
+              - 'examples/integrations/mastra/**'
+            langgraph_js:
+              - 'examples/integrations/langgraph-js/**'
+            crewai_crews:
+              - 'examples/integrations/crewai-crews/**'
+            pydantic_ai:
+              - 'examples/integrations/pydantic-ai/**'
+            adk:
+              - 'examples/integrations/adk/**'
+            agno:
+              - 'examples/integrations/agno/**'
+            llamaindex:
+              - 'examples/integrations/llamaindex/**'
+            langgraph_fastapi:
+              - 'examples/integrations/langgraph-fastapi/**'
+            strands_python:
+              - 'examples/integrations/strands-python/**'
+            ms_agent_framework_python:
+              - 'examples/integrations/ms-agent-framework-python/**'
+            ms_agent_framework_dotnet:
+              - 'examples/integrations/ms-agent-framework-dotnet/**'
+
+      - name: Build starter matrix
+        id: starter-matrix
+        env:
+          DISPATCH_SERVICE: ${{ github.event.inputs.service }}
+          FILTER_CHANGES: ${{ steps.filter.outputs.changes }}
+        run: |
+          set -euo pipefail
+          # One slot per starter. `slug` is the examples/integrations/<slug>
+          # directory name; `image` is the published GHCR repo (starter-<slug>);
+          # `filter_key` matches the paths-filter key above.
+          ALL_STARTERS='[
+            {"slug":"langgraph-python","image":"starter-langgraph-python","filter_key":"langgraph_python"},
+            {"slug":"mastra","image":"starter-mastra","filter_key":"mastra"},
+            {"slug":"langgraph-js","image":"starter-langgraph-js","filter_key":"langgraph_js"},
+            {"slug":"crewai-crews","image":"starter-crewai-crews","filter_key":"crewai_crews"},
+            {"slug":"pydantic-ai","image":"starter-pydantic-ai","filter_key":"pydantic_ai"},
+            {"slug":"adk","image":"starter-adk","filter_key":"adk"},
+            {"slug":"agno","image":"starter-agno","filter_key":"agno"},
+            {"slug":"llamaindex","image":"starter-llamaindex","filter_key":"llamaindex"},
+            {"slug":"langgraph-fastapi","image":"starter-langgraph-fastapi","filter_key":"langgraph_fastapi"},
+            {"slug":"strands-python","image":"starter-strands-python","filter_key":"strands_python"},
+            {"slug":"ms-agent-framework-python","image":"starter-ms-agent-framework-python","filter_key":"ms_agent_framework_python"},
+            {"slug":"ms-agent-framework-dotnet","image":"starter-ms-agent-framework-dotnet","filter_key":"ms_agent_framework_dotnet"}
+          ]'
+
+          # Dispatch modes (mirror the showcase detect-changes job):
+          #   "all"                     → every starter (full-fleet rebuild).
+          #   "starter-<slug>"          → that one starter (strip "starter-" prefix to match .image).
+          #   "<showcase service slug>" → no starters (this is a showcase-only dispatch).
+          #   "" (push event)           → starters whose filter_key appears in CHANGES
+          #                               (or workflow_config touched → rebuild all).
+          DISPATCH="${DISPATCH_SERVICE:-}"
+          CHANGES="${FILTER_CHANGES:-[]}"
+
+          # `.image` is exactly "starter-<slug>", which is also the
+          # workflow_dispatch choice value, so a specific-starter dispatch
+          # matches `$dispatch == .image` directly.
+          MATRIX=$(echo "$ALL_STARTERS" | jq -c --arg dispatch "$DISPATCH" --argjson changes "$CHANGES" '
+            [.[] |
+              (.filter_key as $fk | select(
+              $dispatch == "all" or
+              ($dispatch != "" and $dispatch != "all" and $dispatch == .image) or
+              ($dispatch == "" and (($changes | index("workflow_config") != null) or ($changes | index($fk) != null)))
+            ))]
+          ')
+
+          # Fail loudly on a typo'd starter dispatch (mirrors showcase job).
+          # Only applies to the starter-* dispatch namespace; a showcase
+          # service slug or "all" legitimately yields [] here.
+          case "$DISPATCH" in
+            starter-*)
+              if [ "$MATRIX" = "[]" ]; then
+                echo "::error::workflow_dispatch service='$DISPATCH' did not match any starter — check the slug"
+                exit 1
+              fi
+              ;;
+          esac
+
+          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+          if [ "$MATRIX" = "[]" ]; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  build-starters:
+    needs: [detect-starter-changes]
+    if: needs.detect-starter-changes.outputs.has_changes == 'true'
+    runs-on: depot-ubuntu-24.04-4
+    timeout-minutes: 20
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        starter: ${{ fromJSON(needs.detect-starter-changes.outputs.matrix) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Depot
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1
+
+      - name: Login to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push starter image
+        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
+        with:
+          project: m2kw2wmmcp
+          context: examples/integrations/${{ matrix.starter.slug }}
+          file: examples/integrations/${{ matrix.starter.slug }}/Dockerfile
+          # Pin amd64: Railway and GHCR serve x86 hosts. Depot defaults to
+          # the runner's native arch, so an arm64-only image would crash on
+          # pull with "does not have a linux/amd64 variant available".
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/copilotkit/${{ matrix.starter.image }}:latest
+            ghcr.io/copilotkit/${{ matrix.starter.image }}:${{ github.sha }}
+
   aggregate-build-results:
     name: Aggregate build results
     needs: [detect-changes, build]

.github/workflows/showcase_promote.yml

@@ -17,6 +17,7 @@ name: "Showcase: Promote (staging → prod)"
 #                                     target service(s). Feature-level probes,
 #                                     not naked 200.
 #   4. notify                       → Slack #oss-alerts on any red. Never #engr.
+#                                     success → #team-showcase.
 
 on:
   workflow_dispatch:
@@ -172,6 +173,7 @@ jobs:
       - working-directory: showcase/scripts
         run: npm ci
       - name: Live-probe staging for promote precondition
+        working-directory: showcase/scripts
         env:
           RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
           SERVICES_CSV: ${{ needs.resolve-targets.outputs.services_csv }}
@@ -182,7 +184,9 @@ jobs:
           fi
           # Spec §7.2 P3: the live staging probe at promote time is
           # authoritative. CI verify history is a leading indicator only.
-          npx tsx showcase/scripts/verify-deploy.ts --env staging --services "$SERVICES_CSV"
+          # Run from showcase/scripts (where `npm ci` installed tsx) so npx
+          # uses the local install instead of network-fetching it.
+          npx tsx verify-deploy.ts --env staging --services "$SERVICES_CSV"
 
   promote:
     needs: [resolve-targets, verify-staging-precondition]
@@ -278,6 +282,7 @@ jobs:
       - working-directory: showcase/scripts
         run: npm ci
       - name: Run verify-deploy --env prod
+        working-directory: showcase/scripts
         env:
           RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
           # Scope verification to the services that ACTUALLY promoted (from the
@@ -286,7 +291,12 @@ jobs:
           # guarantee a red verify and mask the health of the ones that did
           # promote.
           SERVICES_CSV: ${{ needs.promote.outputs.succeeded_csv }}
+          # The promote job's result, so the empty-CSV branch can tell a genuine
+          # all-failed run (empty succeeded set is expected) apart from a
+          # contract violation (promote reported success yet emitted no CSV).
+          PROMOTE_RESULT: ${{ needs.promote.result }}
         run: |
+          set -euo pipefail
           if [ -z "$RAILWAY_TOKEN" ]; then
             echo "::error::RAILWAY_TOKEN is not set"
             exit 1
@@ -297,11 +307,22 @@ jobs:
           # --services (which would either error or vacuously pass). The promote
           # job already exited non-zero in that case, so the overall run is red
           # via the notify state machine regardless.
+          #
+          # BUT: an empty succeeded set is only legitimate when promote did NOT
+          # succeed. If promote reported success and STILL emitted no CSV, the
+          # "promote already failed" assumption that justifies the vacuous skip
+          # is violated — fail loud instead of silently exiting 0.
           if [ -z "$SERVICES_CSV" ]; then
+            if [ "$PROMOTE_RESULT" = "success" ]; then
+              echo "::error::promote reported success but succeeded_csv is empty — contract violation"
+              exit 1
+            fi
             echo "::notice::succeeded_csv is empty (no services promoted, or promote did not run); skipping prod verification. The run is red via the promote job result if anything failed."
             exit 0
           fi
-          npx tsx showcase/scripts/verify-deploy.ts --env prod --services "$SERVICES_CSV"
+          # Run from showcase/scripts (where `npm ci` installed tsx) so npx uses
+          # the local install instead of network-fetching it.
+          npx tsx verify-deploy.ts --env prod --services "$SERVICES_CSV"
 
   notify:
     # Slack #oss-alerts only. Never #engr (engr is sacred — release alerts only).
@@ -314,6 +335,7 @@ jobs:
       actions: read
     env:
       SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
+      SLACK_WEBHOOK_TS: ${{ secrets.SLACK_WEBHOOK_TEAM_SHOWCASE }}
     steps:
       # Best-effort promote invariant (do NOT reintroduce a PRE gate below):
       #   resolve-targets              = HARD precondition (must succeed).
@@ -372,10 +394,15 @@ jobs:
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
           webhook-type: incoming-webhook
+          # Newlines are injected via fromJSON('"\n"') (a real LF char), NOT a
+          # literal '\n' in the template: GitHub Actions expression string
+          # literals do not interpret backslash escapes, so a literal '\n' would
+          # survive toJSON as the two chars \\n and Slack would render it
+          # verbatim as "\n" instead of a line break.
           payload: |
             {
               "text": ${{ toJSON(format(
-                '{0} *Showcase Promote Failed*\nServices: `{1}`\nresolve-targets={2} pre-staging={3} promote={4} verify-prod={5}\n<{6}/{7}/actions/runs/{8}|View run>',
+                '{0} *Showcase Promote Failed*{9}Services: `{1}`{9}resolve-targets={2} pre-staging={3} promote={4} verify-prod={5}{9}<{6}/{7}/actions/runs/{8}|View run>',
                 steps.state.outputs.icon,
                 steps.state.outputs.csv,
                 needs.resolve-targets.result,
@@ -384,7 +411,28 @@ jobs:
                 needs.verify-prod.result,
                 github.server_url,
                 github.repository,
-                github.run_id
+                github.run_id,
+                fromJSON('"\n"')
+              )) }}
+            }
+      - name: Post to #team-showcase
+        if: steps.state.outputs.state == 'success' && inputs.service != '__select_a_service__' && env.SLACK_WEBHOOK_TS != ''
+        uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0
+        with:
+          webhook: ${{ secrets.SLACK_WEBHOOK_TEAM_SHOWCASE }}
+          webhook-type: incoming-webhook
+          # Newlines via fromJSON('"\n"') (real LF), not a literal '\n' — see the
+          # #oss-alerts step above for why a literal '\n' renders verbatim.
+          payload: |
+            {
+              "text": ${{ toJSON(format(
+                '{0} *Showcase Promoted to Prod*{5}Services: `{1}`{5}<{2}/{3}/actions/runs/{4}|View run>',
+                steps.state.outputs.icon,
+                steps.state.outputs.csv,
+                github.server_url,
+                github.repository,
+                github.run_id,
+                fromJSON('"\n"')
               )) }}
             }
       - name: Log (no Slack — webhook unset)
@@ -393,3 +441,10 @@ jobs:
           CSV: ${{ steps.state.outputs.csv }}
         run: |
           echo "::warning::Showcase promote failed for '$CSV' but SLACK_WEBHOOK_OSS_ALERTS is not set; no Slack notification sent."
+      - name: Log (no Slack — team-showcase webhook unset)
+        if: steps.state.outputs.state == 'success' && inputs.service != '__select_a_service__' && env.SLACK_WEBHOOK_TS == ''
+        env:
+          CSV: ${{ steps.state.outputs.csv }}
+          ICON: ${{ steps.state.outputs.icon }}
+        run: |
+          echo "::notice::$ICON Showcase promoted to prod for '$CSV' but SLACK_WEBHOOK_TEAM_SHOWCASE is not set; no #team-showcase notification sent."