chore: sync workspace — configs, docs, scripts, CI, pnpm, submodules

- Submodule pins: dbis_core, cross-chain-pmm-lps, mcp-proxmox (local, push may be pending), metamask-integration, smom-dbis-138
- Atomic swap + cross-chain-pmm-lops-publish, deploy-portal workflow, phoenix deploy-targets, routing/aggregator matrices
- Docs, token-lists, forge proxy, phoenix API, runbooks, verify scripts

Made-with: Cursor

scripts/dev-vm/add-gitea-webhook-phoenix.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Add Gitea webhook for Phoenix deploy to a repository.
 # Usage: GITEA_TOKEN=xxx PHOENIX_WEBHOOK_URL=https://host:4001/webhook/gitea bash add-gitea-webhook-phoenix.sh [owner/repo]
-# Example: GITEA_TOKEN=xxx PHOENIX_WEBHOOK_URL=http://192.168.11.59:4001/webhook/gitea bash add-gitea-webhook-phoenix.sh d-bis/proxmox
+# Example: GITEA_TOKEN=xxx PHOENIX_WEBHOOK_URL=http://192.168.11.59:4001/webhook/gitea PHOENIX_DEPLOY_SECRET=shared-secret bash add-gitea-webhook-phoenix.sh d-bis/proxmox
 
 set -euo pipefail
 
@@ -12,6 +12,7 @@ PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
 GITEA_TOKEN="${GITEA_TOKEN:-}"
 PHOENIX_WEBHOOK_URL="${PHOENIX_WEBHOOK_URL:-}"
+PHOENIX_DEPLOY_SECRET="${PHOENIX_DEPLOY_SECRET:-}"
 REPO="${1:-d-bis/proxmox}"
 
 if [ -z "$GITEA_TOKEN" ]; then
@@ -23,6 +24,10 @@ if [ -z "$PHOENIX_WEBHOOK_URL" ]; then
   exit 1
 fi
 
+echo "WARNING: Only add the webhook deploy path for repos that are not already deploying via Gitea Actions."
+echo "         If both Actions and webhook deploys are enabled for the same repo, pushes can trigger duplicate deploys."
+echo ""
+
 API="${GITEA_URL%/}/api/v1"
 OWNER="${REPO%%/*}"
 REPO_NAME="${REPO#*/}"
@@ -37,11 +42,13 @@ fi
 # Create webhook
 BODY=$(jq -n \
   --arg url "$PHOENIX_WEBHOOK_URL" \
+  --arg secret "$PHOENIX_DEPLOY_SECRET" \
   '{
     type: "gitea",
     config: {
       url: $url,
-      content_type: "json"
+      content_type: "json",
+      secret: $secret
     },
     events: ["push", "create"],
     active: true

scripts/dev-vm/bootstrap-phoenix-cicd.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Bootstrap the Phoenix deploy CI/CD path for this repo.
+#
+# Steps:
+#   1. Run repo validation
+#   2. Deploy phoenix-deploy-api to dev VM
+#   3. Smoke-check /health and /api/deploy-targets
+#   4. Optionally add a Gitea webhook for a repo that does not already deploy via Actions
+#
+# Usage:
+#   bash scripts/dev-vm/bootstrap-phoenix-cicd.sh
+#   bash scripts/dev-vm/bootstrap-phoenix-cicd.sh --repo d-bis/proxmox
+#   bash scripts/dev-vm/bootstrap-phoenix-cicd.sh --repo some/repo --add-webhook
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+[[ -f "${PROJECT_ROOT}/.env" ]] && set -a && source "${PROJECT_ROOT}/.env" && set +a
+
+REPO="${PHOENIX_CICD_REPO:-d-bis/proxmox}"
+ADD_WEBHOOK=0
+DRY_RUN=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --repo)
+      REPO="${2:?--repo requires owner/repo}"
+      shift 2
+      ;;
+    --add-webhook)
+      ADD_WEBHOOK=1
+      shift
+      ;;
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+DEPLOY_HEALTH_URL="${PHOENIX_CICD_HEALTH_URL:-http://192.168.11.59:4001/health}"
+DEPLOY_TARGETS_URL="${PHOENIX_CICD_TARGETS_URL:-http://192.168.11.59:4001/api/deploy-targets}"
+
+echo "=== Phoenix CI/CD bootstrap ==="
+echo "Repo:        ${REPO}"
+echo "Health URL:  ${DEPLOY_HEALTH_URL}"
+echo "Targets URL: ${DEPLOY_TARGETS_URL}"
+echo "Add webhook: ${ADD_WEBHOOK}"
+echo "Dry-run:     ${DRY_RUN}"
+echo ""
+
+if [[ "${DRY_RUN}" -eq 1 ]]; then
+  echo "[DRY-RUN] bash scripts/verify/run-all-validation.sh --skip-genesis"
+  echo "[DRY-RUN] bash scripts/deployment/deploy-phoenix-deploy-api-to-dev-vm.sh --apply --start-ct"
+  echo "[DRY-RUN] curl -sS ${DEPLOY_HEALTH_URL}"
+  echo "[DRY-RUN] curl -sS ${DEPLOY_TARGETS_URL}"
+  if [[ "${ADD_WEBHOOK}" -eq 1 ]]; then
+    echo "[DRY-RUN] bash scripts/dev-vm/add-gitea-webhook-phoenix.sh ${REPO}"
+  fi
+  exit 0
+fi
+
+echo "[1/4] Validation gate..."
+bash "${PROJECT_ROOT}/scripts/verify/run-all-validation.sh" --skip-genesis
+
+echo ""
+echo "[2/4] Deploy phoenix-deploy-api..."
+bash "${PROJECT_ROOT}/scripts/deployment/deploy-phoenix-deploy-api-to-dev-vm.sh" --apply --start-ct
+
+echo ""
+echo "[3/4] Smoke checks..."
+curl -sSf "${DEPLOY_HEALTH_URL}" | jq .
+curl -sSf "${DEPLOY_TARGETS_URL}" | jq .
+
+if [[ "${ADD_WEBHOOK}" -eq 1 ]]; then
+  echo ""
+  echo "[4/4] Add Gitea webhook (only for repos not already deploying via Actions)..."
+  bash "${PROJECT_ROOT}/scripts/dev-vm/add-gitea-webhook-phoenix.sh" "${REPO}"
+else
+  echo ""
+  echo "[4/4] Webhook step skipped. Re-run with --add-webhook only for repos that are not already deploying via Gitea Actions."
+fi
+
+echo ""
+echo "Done."

scripts/dev-vm/trigger-phoenix-deploy.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Trigger phoenix-deploy-api directly for smoke tests or manual promotion.
+#
+# Usage:
+#   bash scripts/dev-vm/trigger-phoenix-deploy.sh
+#   bash scripts/dev-vm/trigger-phoenix-deploy.sh d-bis/proxmox main default
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+[[ -f "${PROJECT_ROOT}/.env" ]] && set -a && source "${PROJECT_ROOT}/.env" && set +a
+
+REPO="${1:-d-bis/proxmox}"
+BRANCH="${2:-main}"
+TARGET="${3:-default}"
+SHA="${4:-manual-$(date +%Y%m%d%H%M%S)}"
+
+DEPLOY_URL="${PHOENIX_DEPLOY_URL:-http://192.168.11.59:4001/api/deploy}"
+DEPLOY_TOKEN="${PHOENIX_DEPLOY_TOKEN:-${PHOENIX_DEPLOY_SECRET:-}}"
+
+if [[ -z "${DEPLOY_TOKEN}" ]]; then
+  echo "ERROR: set PHOENIX_DEPLOY_TOKEN or PHOENIX_DEPLOY_SECRET in root .env" >&2
+  exit 1
+fi
+
+echo "Triggering deploy:"
+echo "  URL:    ${DEPLOY_URL}"
+echo "  Repo:   ${REPO}"
+echo "  Branch: ${BRANCH}"
+echo "  Target: ${TARGET}"
+echo "  SHA:    ${SHA}"
+
+curl -sSf -X POST "${DEPLOY_URL}" \
+  -H "Authorization: Bearer ${DEPLOY_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "{\"repo\":\"${REPO}\",\"branch\":\"${BRANCH}\",\"target\":\"${TARGET}\",\"sha\":\"${SHA}\"}" | jq .