refactor: use git-controlled dev ci runner

scripts/src/deploy.ts

@@ -131,8 +131,8 @@ const nativeK3sInstallVersion = "v1.34.1+k3s1";
 const nativeK3sImage = "rancher/k3s:v1.34.1-k3s1";
 const nativeK3sCtrAddress = "/run/k3s/containerd/containerd.sock";
 const unideskRepoUrl = "https://github.com/pikasTech/unidesk";
-const d601MaintenanceDeployAllowedServiceIds = new Set(["devops"]);
-const devApplySupportedServiceIds = d601MaintenanceDeployAllowedServiceIds;
+const d601MaintenanceDeployAllowedServiceIds = new Set<string>();
+const devApplySupportedServiceIds = new Set<string>();
 const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironmentTarget> = {
   dev: {
     environment: "dev",
@@ -195,7 +195,7 @@ function deployHelp(action: string | undefined = undefined): Record<string, unkn
     },
     options: [
       { name: "--file <path>", default: defaultDeployFile, description: "Desired-state manifest path relative to the repo root. JSON and ESM JS manifests are supported, for example deploy.json or develop.js." },
-      { name: "--env <dev|prod>", description: "Read the named environment from origin/master:deploy.json. Direct D601 apply is enabled only for DevOps bootstrap/repair." },
+      { name: "--env <dev|prod>", description: "Read the named environment from origin/master:deploy.json. Direct D601 service apply is disabled in the current CI-only phase." },
       { name: "--service <id>", description: "Limit reconcile to one service from the manifest." },
       { name: "--dry-run", description: "Prepare and validate without mutating the target service." },
       { name: "--force", description: "Redeploy even when the live commit appears up to date." },
@@ -665,20 +665,6 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
       allowedMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"],
       allowedPathPrefixes: ["/", "/api/", "/logs"],
     },
-    devops: {
-      name: "UniDesk DevOps Control",
-      description: "D601 k3s-managed DevOps control plane for normal CI trigger/status/log paths.",
-      dockerfile: "src/components/microservices/devops/Dockerfile",
-      composeFile: "src/components/microservices/k3sctl-adapter/k3s/devops.k3s.json",
-      composeService: "devops",
-      containerName: "k3s:devops",
-      nodeBaseUrl: "k3s://devops",
-      nodePort: 4286,
-      healthPath: "/health",
-      route: "/devops",
-      allowedMethods: ["GET", "HEAD", "POST"],
-      allowedPathPrefixes: ["/health", "/live", "/logs", "/api/"],
-    },
   };
   const spec = specs[id];
   if (spec === undefined) return undefined;
@@ -697,9 +683,9 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
     },
     backend: {
       nodeBaseUrl: spec.nodeBaseUrl,
-      nodeBindHost: `k3s://${id === "devops" ? "unidesk-ci" : "unidesk-dev"}/${spec.composeService}`,
+      nodeBindHost: `k3s://unidesk-dev/${spec.composeService}`,
       nodePort: spec.nodePort,
-      proxyMode: id === "devops" ? "k3sctl-adapter-http" : "dev-k3s-direct",
+      proxyMode: "dev-k3s-direct",
       frontendOnly: true,
       public: false,
       allowedMethods: spec.allowedMethods,
@@ -711,16 +697,14 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
       mode: "k3sctl-managed",
       adapterServiceId: "k3sctl-adapter",
       k3sServiceId: spec.composeService,
-      namespace: id === "devops" ? "unidesk-ci" : "unidesk-dev",
+      namespace: "unidesk-dev",
       expectedNodeIds: ["D601"],
       activeNodeId: "D601",
     },
     development: {
       providerId: "D601",
       sshPassthrough: true,
-      worktreePath: id === "devops"
-        ? "/home/ubuntu/.unidesk/devops-deploy"
-        : id === "code-queue"
+      worktreePath: id === "code-queue"
         ? "/home/ubuntu/unidesk-dev-code-queue-deploy/code-queue"
         : `/home/ubuntu/unidesk-dev-core-deploy/${id}`,
     },
@@ -767,7 +751,7 @@ function selectServices(config: UniDeskConfig, manifest: DeployManifest, service
     if (manifest.environment === "dev") {
       const service = devK3sDeployService(desired.id);
       if (service === undefined) {
-        throw new Error(`deploy --env dev service ${desired.id} is not enabled in this executor yet; currently supported: ${[...devApplySupportedServiceIds].join(", ")}`);
+        throw new Error(`deploy --env dev service ${desired.id} is not enabled for direct rollout in the current CI-only phase`);
       }
       return { desired, config: service };
     }
@@ -1021,7 +1005,6 @@ function dockerBuildTimeoutMs(service: UniDeskMicroserviceConfig, options: Deplo
 
 function devK3sPrepullImages(service: UniDeskMicroserviceConfig): string[] {
   if (!isDevK3sDeployService(service)) return [];
-  if (service.id === "devops") return ["golang:1.23-bookworm", "debian:bookworm-slim"];
   return ["oven/bun:1-alpine"];
 }
 
@@ -2186,7 +2169,7 @@ async function applyOneService(config: UniDeskConfig, service: UniDeskMicroservi
       ok: false,
       serviceId: service.id,
       skipped: true,
-      reason: `D601 maintenance-channel direct deployment is allowed only for ${[...d601MaintenanceDeployAllowedServiceIds].join(", ")} bootstrap/repair. Deploy ${service.id} through the DevOps control plane instead.`,
+      reason: `D601 maintenance-channel direct deployment is disabled for ${service.id}. Current dev automation is CI-only; use ci run-dev-e2e for the temporary namespace smoke runner.`,
       steps,
     };
   }
@@ -2361,7 +2344,7 @@ function blockedD601MaintenanceDeployServices(config: UniDeskConfig, manifest: D
 }
 
 function d601MaintenanceDeployBlockMessage(blocked: string[]): string {
-  return `D601 maintenance-channel direct deployment is allowed only for ${[...d601MaintenanceDeployAllowedServiceIds].join(", ")} bootstrap/repair; blocked services: ${blocked.join(", ")}. Use the DevOps control plane for other direct/managed microservices.`;
+  return `D601 maintenance-channel direct deployment is disabled for direct/managed services in the current CI-only phase; blocked services: ${blocked.join(", ")}. Use ci run-dev-e2e for dev smoke verification.`;
 }
 
 async function runApplyNow(config: UniDeskConfig, manifest: DeployManifest, options: DeployOptions): Promise<Record<string, unknown>> {
@@ -2413,7 +2396,7 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
     if (options.environment !== "dev") throw new Error("deploy apply --env prod is not enabled yet");
     const unsupported = unsupportedDevApplyServices(manifest, options.serviceId);
     if (unsupported.length > 0) {
-      throw new Error(`deploy apply --env dev currently supports only ${[...devApplySupportedServiceIds].join(", ")}; unsupported selected services: ${unsupported.join(", ")}`);
+      throw new Error(`deploy apply --env dev is disabled for direct service rollout in the current CI-only phase; unsupported selected services: ${unsupported.join(", ")}. Use ci run-dev-e2e for dev smoke verification.`);
     }
     if (config === null) throw new Error("deploy apply --env dev requires config.json");
     if (!options.dryRun) {
@@ -2438,5 +2421,5 @@ export async function runCodeQueueDeployCompatCommand(_config: UniDeskConfig, ar
   if (args.includes("--skip-build")) throw new Error("codex deploy is disabled; --skip-build is not supported");
   const providerId = optionValue(args, ["--provider-id", "--provider"]) ?? "D601";
   if (providerId !== "D601") throw new Error(`codex deploy compatibility path only supports D601; got ${providerId}`);
-  throw new Error("codex deploy is disabled because D601 maintenance-channel direct deployment is now reserved for DevOps bootstrap/repair. Use the DevOps control plane for Code Queue deployment.");
+  throw new Error("codex deploy is disabled because D601 maintenance-channel direct deployment must not deploy Code Queue. Current dev automation is CI-only; use ci run-dev-e2e for dev smoke verification.");
 }