Orchestrator & Strategies

The orchestrator (the ops repo's orchestrator/deploy.py) is the single deploy brain. It reads the central manifest, looks up one service, and dispatches on its deploy.strategy. It uses only the Python standard library plus the tofu, aws, and shell tools available on the runner.

Invocation

python3 orchestrator/deploy.py deploy \
  --service web --env prod \
  --manifest ops/platform.json \
  --repo-root caller [--auto-approve]

The reusable workflow supplies these arguments — see the thin-caller & reusable workflow.

What each strategy does

Strategy	Behavior
`static`	Smart IaC → build → S3 sync → CloudFront invalidate
`service`	Containerized build/push → ECS Fargate rollout
`desktop`	Signed desktop installers + an updater manifest
`game-publisher`	Game build / publish pipeline
`none`	No-op — logs that there is nothing to deploy and returns

The static path

Smart IaC. tofu init, then tofu plan -detailed-exitcode: exit 0 = no changes (skip apply), exit 2 = changes (apply the saved plan), exit 1 = error (fail). It then reads the bucket and distribution id from the stack's OpenTofu outputs.
Build. Runs the service's buildCommand from the caller repo root, with deploy.iac.buildEnv merged into the environment.
Publish. aws s3 sync <distDir> s3://<bucket> --delete then a CloudFront invalidation of /*.

Approval

The reusable workflow passes --auto-approve, so the orchestrator never blocks on a prompt. Manual approval for an environment is enforced by the GitHub Environment's required reviewers, driven by autoApprove — not by the script.