Deployment

Secret values stay out of git — use .env.dev / .env.prod and pnpm secret:load:*.

Two pipelines

Component	Platform	Trigger
API + Lambda + SQS + S3	AWS · SST v4	CI or pnpm deploy:*
Web SPA	Cloudflare Workers	Git push / web deploy:dev · deploy:prod

Pre-deploy

pnpm verify
pnpm sst install    # once
pnpm diff:dev       # or diff:prod
pnpm secret:load:dev   # or secret:load:prod

Local SST: AWS_PROFILE=cleverhire. CI also runs Gitleaks, audit, infra:typecheck.

AWS deploy

Stage	Command	Branch (auto)
dev	pnpm deploy:dev	develop after green CI
production	pnpm deploy:prod	main after green CI

Manual: Actions → Deploy → Run workflow.

sequenceDiagram
  GH->>CI: push
  CI-->>GH: verify
  GH->>Dep: Deploy on success
  Dep->>AWS: build functions + sst deploy

• APP_VERSION = commit SHA in CI · dev smoke via scripts/smoke.sh · manual: pnpm smoke
• API DNS: Cloudflare CNAME to ALB (DNS-only) · Atlas allowlist 0.0.0.0/0

Web (Cloudflare)

pnpm turbo run build --filter=@sophia/web...
pnpm --filter @sophia/web deploy:dev   # or deploy:prod

apps/web/wrangler.jsonc · no secrets in VITE_*

Rollback

Redeploy good SHA (workflow or pnpm deploy:*). Production protect + queue retain. Fix infra/* and redeploy; replay DLQ manually after fixes.

Node 22 · pnpm 10.6.2 · SST ^4.17.1