docs/cicd.md (1)

83-87: ⚡ Quick win

Clarify why discord-bot-universe and bot-server-universe are excluded from the deployment contract.

This section defines the production contract but omits two images that are explicitly built earlier (Line 53-55). Add a short note that they are intentionally non-production here, or include them if they are part of the Universe runtime set.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/cicd.md` around lines 83 - 87, The docs list production images
(play-universe, back-universe, map-storage-universe, uploader-universe) but
omits discord-bot-universe and bot-server-universe; update the cicd.md section
around the image list to either include those two images if they belong in the
production Universe runtime, or add a concise clarifying sentence stating that
discord-bot-universe and bot-server-universe are intentionally excluded from the
production contract (they are built earlier but are
non-production/runtime-only). Reference the image names (discord-bot-universe,
bot-server-universe, play-universe, back-universe, map-storage-universe,
uploader-universe) so the change is clear.

.github/workflows/test-universe-images.yml (2)

189-193: ⚡ Quick win

Consider gating the deploy on a GitHub Environment and a concurrency group.

Two operational nits for a production handoff job:

1. environment: production — promotes this from a free-running job to one that can carry environment-scoped secrets (so UNIVERSE_DEPLOY_WEBHOOK doesn't have to be repo-wide), optional required reviewers, and surfaces a deployment URL on the run summary. Especially useful given workflow_dispatch can be invoked from any branch.
2. concurrency: { group: deploy-universe, cancel-in-progress: false } — serializes overlapping deploys when several universe pushes land close together, so the webhook receiver isn't asked to interleave deployments.

♻️ Sketch

   deploy-universe:
     name: "Deploy Universe"
     needs: test-universe-images
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch' }}
+    environment: production
+    concurrency:
+      group: deploy-universe
+      cancel-in-progress: false
     steps:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-universe-images.yml around lines 189 - 193, The
deploy-universe job is missing environment and concurrency controls; update the
deploy-universe job definition to add an environment (e.g., environment:
production) so it can use environment-scoped secrets and required reviewers, and
add a concurrency block (e.g., concurrency: { group: "deploy-universe",
cancel-in-progress: false }) to serialize overlapping runs; locate the job named
deploy-universe in the workflow and insert those two fields at the job level.

---

189-205: ⚡ Quick win

Harden the webhook call: add a timeout (and consider retry/observability).

The deploy handoff is the single externally-visible action in this pipeline and has no timeout. If UNIVERSE_DEPLOY_WEBHOOK is slow, returns no response, or stalls TCP, the runner sits idle up to the default 360-minute job timeout, blocking subsequent deploys from being queued cleanly. Adding --max-time (and ideally a bounded retry with backoff) keeps the handoff predictable.

Also consider --silent --show-error so success runs stay quiet but a failure surfaces the response body with status — --fail-with-body already gives non‑zero on 4xx/5xx, but pairing it with -S keeps stderr useful on actual failures.

♻️ Suggested hardening for the curl call

-          curl --fail-with-body --request POST "$UNIVERSE_DEPLOY_WEBHOOK"
+          curl \
+            --fail-with-body \
+            --silent --show-error \
+            --request POST \
+            --max-time 30 \
+            --retry 3 --retry-delay 5 --retry-connrefused \
+            "$UNIVERSE_DEPLOY_WEBHOOK"

Tune --max-time/--retry* to match your production webhook's expected SLA (and ensure the receiver is idempotent if retries are enabled).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-universe-images.yml around lines 189 - 205, The
deploy-universe job's curl invocation lacks timeouts and observability; update
the curl command that posts to the UNIVERSE_DEPLOY_WEBHOOK (the line containing
curl --fail-with-body --request POST "$UNIVERSE_DEPLOY_WEBHOOK") to include a
total timeout (e.g. --max-time 30), make failures visible but keep successful
runs quiet (e.g. --silent --show-error / -sS), and add a bounded retry policy
(e.g. --retry 2 --retry-delay 5 --retry-connrefused) so the job won't hang
indefinitely and transient errors are retried in a controlled way.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes