Establish agent-first, free-tier build and release flow by support371 · Pull Request #148 · support371/gem-enterprise

support371 · 2026-07-09T18:58:41Z

Objective

Establish a deterministic, low-billing development workflow that allows AI coding agents and limited-availability personnel to build GEM Enterprise safely through issues, branches, automated verification, preview deployments, and reviewed pull requests.

Related implementation backlog: #147

Changes

Adds docs/AGENT_BUILD_FLOW.md with work queues, definitions of ready/done, a standard delegation prompt, agent roles, free-tier safeguards, and manual approval gates.
Rewrites AGENTS.md to reflect the current production architecture and controlled-launch restrictions.
Adds structured AI-agent issue and pull-request templates.
Pins pnpm to 10.28.0 and adds typecheck, verify:preview, and verify commands.
Makes canonical Vercel preview builds run Prisma generation, lint, TypeScript checking, Vitest, and the Next.js production build.
Keeps GitHub build verification and CodeQL available through manual dispatch while hosted-runner access is constrained.
Removes the duplicate GitHub Actions Vercel production deployment; Vercel Git integration remains the only production deployment path.
Adds a fail-closed Vercel project guard so only the canonical project may consume builds.
Records the canonical project and disconnected duplicates.

Verification completed

Canonical project: support371-gem-enterprise (prj_VDGqnA7wZt2E65LLvT94ZOpnYc2Z).
Disconnected duplicates created no deployments for the verification commit:
- gem-enterprise (prj_iT8bNqbTiePiM2SZiWTkOUJXy3o0)
- project-dtrl6 (prj_TUZk9mqccnIGSsSpsti7jwg9D3W2)
Canonical preview deployment dpl_7zyuXQAuMaVE1ywj6eo4HRoyS2C6 reached READY.
Prisma generation passed.
ESLint passed.
TypeScript checking passed.
Vitest passed: 14 files and 164 tests.
Next.js 16 production compilation and preview deployment passed.
Later commits affect documentation only and are excluded from the deployment bundle by .vercelignore.

Trust, security, privacy, and billing review

No secrets or real sensitive documents are included.
No paid service was activated.
Sensitive capabilities remain fail closed.
Duplicate production deployment workflow was removed.
Provider, billing, legal, identity, and production-secret actions remain owner-only.
No database schema or production data changes.

Manual actions remaining

GitHub hosted-runner access may be restored later if desired; manual verification and CodeQL workflows are prepared.
No manual action is required before merging this pull request.

Rollback

Revert this pull request to restore the prior workflow files. Production application data is unaffected.

vercel · 2026-07-09T18:58:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
support371-gem-enterprise	Ready	Preview, Comment, Open in v0	Jul 9, 2026 7:51pm

8 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
gem-enterprise	Ignored	Preview	Jul 9, 2026 7:51pm
gem-enterprise-jx	Ignored	Preview	Jul 9, 2026 7:51pm
project-dtrl6	Ignored	Preview	Jul 9, 2026 7:51pm
v0-continue-conversation	Ignored	Preview	Jul 9, 2026 7:51pm
v0-continue-conversation-3875	Ignored	Preview	Jul 9, 2026 7:51pm
v0-deployment-alignment-task	Ignored	Preview	Jul 9, 2026 7:51pm
v0-my-website	Ignored	Preview	Jul 9, 2026 7:51pm
v0-v0-geraldhoeven-4141-ff89f7f-5	Ignored	Preview	Jul 9, 2026 7:51pm

sourcery-ai · 2026-07-09T18:58:47Z

Reviewer's Guide

Documents an agent-first development and release process and consolidates CI into a single deterministic build-verification gate, with supporting issue/PR templates and pnpm tooling updates aligned to a controlled, free-tier production workflow.

Sequence diagram for the new build verification and deployment flow

sequenceDiagram
  actor Developer
  participant GitHub as GitHub
  participant BuildVerification as Build_Verification_workflow
  participant Vercel as Vercel_Git_integration

  Developer->>GitHub: open_pull_request_to_main
  GitHub->>BuildVerification: trigger_workflow_on_pull_request
  BuildVerification->>BuildVerification: pnpm_run_db_generate
  BuildVerification->>BuildVerification: pnpm_run_lint
  BuildVerification->>BuildVerification: pnpm_run_typecheck
  BuildVerification->>BuildVerification: pnpm_run_test
  BuildVerification->>BuildVerification: pnpm_run_build
  BuildVerification-->>GitHub: checks_pass
  Developer->>GitHub: merge_pull_request_to_main
  GitHub->>BuildVerification: trigger_workflow_on_push_to_main
  BuildVerification->>BuildVerification: pnpm_run_verify
  BuildVerification-->>GitHub: checks_pass
  GitHub->>Vercel: update_main_branch
  Vercel-->>Vercel: deploy_main_via_git_integration

  Developer->>Vercel: inspect_preview_and_production_logs

File-Level Changes

Change	Details	Files
Update agent instructions to reflect current controlled production architecture, safety constraints, and the new agent delivery flow.	Refresh project overview with current domains, deployment method, and controlled-launch mode. Replace former tech stack and architecture rules with updated non-negotiable safety, trust, and architectural guidelines. Define an agent delivery flow including issue-driven work, branches, verification commands, and merge/deploy expectations. Document free-tier development policy, sensitive feature gates, and commit/PR standards aligned with owner-only approvals.	`AGENTS.md`
Introduce a detailed agent-first build and release operating procedure for limited personnel and billing-safe development.	Define roles (business owner, lead development agent, review agent) and responsibilities in the workflow. Describe canonical end-to-end flow from owner objectives through issue, branch, verification, review, and production deployment. Establish work queues, ready/done definitions, standard delegation prompt, free-tier safeguards, and manual approval gates. Outline recommended agent allocation across tools and the initial "GEM Verify Core" implementation program.	`docs/AGENT_BUILD_FLOW.md`
Add structured templates so AI agents work through bounded, well-specified issues and pull requests with explicit safety and verification sections.	Create an agent-task issue template that captures objective, acceptance criteria, scope, exclusions, data/billing classification, required verification, rollback, and guardrails. Add a pull-request template that standardizes sections for objective, changes, affected files/data, trust/privacy/billing checks, verification evidence, manual actions, rollback, and agent declarations.	`.github/ISSUE_TEMPLATE/agent-task.yml` `.github/pull_request_template.md`
Consolidate CI into a single deterministic build verification workflow with concurrency control and explicit test/build gates for main and PRs.	Rename CI workflow to "Build Verification" and trigger it on pull requests to main, pushes to main, and manual dispatch. Replace separate lint/test/build jobs with a single `verify` job that runs lint, typecheck, tests, and production build in sequence. Add concurrency settings to cancel superseded runs per ref and set minimal permissions for the workflow. Standardize env configuration for CI, including JWT, database URLs, public app settings, AI disclosure text, SMTP defaults, and cron secret, while removing production deployment steps and external secret dependencies. Remove redundant main-branch deployment workflow so Vercel Git integration is the sole production deployment mechanism.	`.github/workflows/ci.yml` `.github/workflows/main.yml`
Tighten local tooling by pinning pnpm and adding a unified verification script to match the CI gate.	Pin the project package manager version via `packageManager: pnpm@10.28.0`. Add a `typecheck` script using `tsc --noEmit` to enforce TypeScript correctness. Introduce a `verify` script that runs Prisma generation, lint, typecheck, tests, and the existing production build in one command, used both locally and in CI.	`package.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

chatgpt-codex-connector · 2026-07-09T18:58:49Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

sourcery-ai

Hey - I've left some high level feedback:

The Build Verification workflow hardcodes NEXT_PUBLIC_APP_URL and other public-facing env values; consider aligning these with a dedicated CI/preprod configuration or deriving them from repository/branch context to avoid accidental drift from the actual production/preview domains.
The verify script runs Prisma generation, lint, typecheck, tests, and a full production build in one command; you might want separate granular scripts (e.g., verify:fast, verify:build) so agents and reviewers can iterate quickly without always paying the full build/test cost while still keeping the canonical gate in CI.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `Build Verification` workflow hardcodes `NEXT_PUBLIC_APP_URL` and other public-facing env values; consider aligning these with a dedicated CI/preprod configuration or deriving them from repository/branch context to avoid accidental drift from the actual production/preview domains.
- The `verify` script runs Prisma generation, lint, typecheck, tests, and a full production build in one command; you might want separate granular scripts (e.g., `verify:fast`, `verify:build`) so agents and reviewers can iterate quickly without always paying the full build/test cost while still keeping the canonical gate in CI.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

vercel · 2026-07-09T19:01:31Z