ci(deploy): annotate production deploys in Axiom

[jeanduplessis]

Summary

Adds a best-effort Axiom annotation step to the shared Vercel promote workflow so production deploys of kilocode-app show up alongside metrics and traces.

Why this change is needed

Production incidents and metric anomalies are hard to correlate with deploys without a shared timeline marker in Axiom. There was previously no automated link between a Vercel production promotion and Axiom's observability data.

How this is addressed

• Adds an opt-in axiom_annotation_dataset input to the reusable promote-vercel-deployment.yml workflow; only wired up for deploy-production.yml and redeploy-web.yml's app promotion job (not global-app).
• Before annotating, verifies the promoted deployment matches the expected project, production target, and READY state, retrying briefly to absorb Vercel API propagation lag after vercel promote.
• Posts an annotation to Axiom with the deploy time, commit SHA/message/branch/author, and a link back to the Vercel deployment.
• The step is continue-on-error: true and treats missing tokens or an unexpected deployment as warnings, not failures — so a flaky Axiom/Vercel call or eventual-consistency lag never fails a promotion that already succeeded.
• Added axiom_expected_project input (default kilocode-app) instead of hardcoding the project name, so the reusable workflow stays generic for future callers.

Human Verification

• Reviewed the workflow YAML by hand for correct GitHub Actions expression syntax and step wiring; no CI run has exercised this yet since it only executes during a real production promotion.

Reviewer Notes

Human Reviewer Flags

• This step runs with secrets: inherit and reads AXIOM_ANNOTATION_TOKEN/VERCEL_TOKEN from the production environment; confirm AXIOM_ANNOTATION_TOKEN is configured there (or annotation is skipped with a warning).
• promote-global-app intentionally does not pass axiom_annotation_dataset, so no annotation happens for that promotion path — confirm that scoping is correct.

Code Reviewer Agent

Code Reviewer Notes

• Retry loop (5 attempts, 5s apart) polls vercel inspect/vercel api until readyState == READY before validating project/target.
• Failure paths log ::warning:: with the raw API response instead of silently swallowing stderr, to keep debugging tractable.
• Axiom payload is built with jq -n --arg (not string interpolation) to avoid injection via commit metadata.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Both previously flagged issues (hardcoded kilocode-app in the deployment link/title/type, and the unnecessary trailing sleep 5) are fixed in the latest commit; the incremental diff only changes YAML quote style plus these two logic fixes, and introduces no new issues.

Files Reviewed (2 files)

• .github/workflows/deploy-production.yml
• .github/workflows/promote-vercel-deployment.yml

Previous Review Summary (commit 4cf9a82)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 4cf9a82)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

The new Axiom annotation step hardcodes kilocode-app in the deployment link/title/type, undermining the workflow's new generic axiom_expected_project input.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
.github/workflows/promote-vercel-deployment.yml	95	Deployment link (and title/type) hardcode kilocode-app despite the generic axiom_expected_project input

SUGGESTION

File	Line	Issue
.github/workflows/promote-vercel-deployment.yml	77	Unnecessary sleep 5 after the final retry attempt

Files Reviewed (3 files)

• .github/workflows/deploy-production.yml - 0 issues
• .github/workflows/promote-vercel-deployment.yml - 2 issues
• .github/workflows/redeploy-web.yml - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 28 · Output: 3.1K · Cached: 765.3K}

_{Review guidance: REVIEW.md from base branch main}