private-deployment.yml

name: Coordinated Mentra Private Deployment

# Each coordinated prerelease deploys its channel's Acme demo stack: dev releases
# demo-dev.acmeworkspace.com and staging (beta) releases demo.acmeworkspace.com.
# Signing keys, the Graph client secret and the admin key live in the stack's
# Key Vault, so this workflow takes no secrets.
on:
  workflow_call:
    inputs:
      source_commit:
        required: true
        type: string
      release_plan_artifact:
        required: true
        type: string
      runtime_image_artifact:
        required: true
        type: string
      dry_run:
        required: false
        default: false
        type: boolean
    outputs:
      result_artifact:
        value: ${{ jobs.deploy.outputs.result_artifact }}
      workspace_origin:
        value: ${{ jobs.deploy.outputs.workspace_origin }}
permissions:
  actions: read
  contents: read
  id-token: write
  packages: read

jobs:
  deploy:
    name: Import and deploy Azure Private Deployment
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 60
    concurrency:
      # Preserve deployment order if coordinated runs overlap. The calling
      # branch selects the stack, so each stack has its own queue.
      group: coordinated-private-deployment-${{ github.ref_name }}
      cancel-in-progress: false
    outputs:
      result_artifact: ${{ steps.artifact.outputs.name }}
      workspace_origin: ${{ steps.verify.outputs.workspace_origin }}
    env:
      # Both stacks share the Acme demo tenant, its Entra apps and the Teams
      # Graph app; the Graph client secret is in each stack's Key Vault.
      ENTRA_TENANT_ID: 2e7662c0-e826-4928-95b2-60bdd48d5d95
      ENTRA_CORE_CLIENT_ID: 20424d9e-4b99-44e8-82c9-0ad06f08a8db
      ENTRA_MOBILE_CLIENT_ID: 95ad08c2-7837-4ddf-933c-1fce3d6d2799
      # redis:7-alpine, the sidecar behind the demo's speech and photos.
      REDIS_DIGEST: sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.source_commit }}

      - uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.release_plan_artifact }}
          path: release-input/plan

      - uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.runtime_image_artifact }}
          path: release-input/runtime-image

      - uses: actions/setup-node@v4
        with:
          node-version: "24"

      # Keep these names in step with TARGETS in
      # .github/scripts/coordinated-private-deployment-records.mjs. Each stack
      # has its own deployer, Contributor on that stack's resource group only.
      # Its Key Vault, identities and grants were created once with Owner
      # rights by bootstrap.bicep and access.bicep.
      - name: Select the release channel's demo stack
        env:
          DEMO_AZURE_CLIENT_ID: ${{ vars.ENTERPRISE_DEMO_AZURE_CLIENT_ID }}
          DEMO_DEV_AZURE_CLIENT_ID: ${{ vars.ENTERPRISE_DEMO_DEV_AZURE_CLIENT_ID }}
        run: |
          set -euo pipefail
          channel=$(jq -er .channel release-input/plan/release-plan.json)
          case "$channel" in
            dev)
              # For testing dev releases; never frozen.
              azure_client_id="$DEMO_DEV_AZURE_CLIENT_ID"
              cat >> "$GITHUB_ENV" <<'EOF'
          AZURE_RESOURCE_GROUP=rg-mentra-enterprise-demo-dev
          AZURE_REGISTRY=mentraenterprisedemodev
          AZURE_KEY_VAULT=kv-mentra-ent-demo-dev
          AZURE_COMMUNICATION_SERVICE=mentra-enterprise-demo-dev
          AZURE_ENVIRONMENT=cae-mentra-ent-demo-dev
          AZURE_CONTAINER_APP=ca-mentra-ent-demo-dev
          AZURE_CORE_CONTAINER_APP=ca-mentra-ent-demo-dev-core
          AZURE_CORE_IDENTITY=id-mentra-ent-demo-dev-core
          AZURE_RUNTIME_IDENTITY=id-mentra-ent-demo-dev-runtime
          DEPLOYMENT_ID=mentra-enterprise-demo-dev
          DISPLAY_NAME=Acme Industries (dev)
          WORKSPACE_HOSTNAME=demo-dev.acmeworkspace.com
          WORKSPACE_CERTIFICATE=ca-mentra-ent-demo-dev-workspace
          WORKSPACE_ALIASES=[]
          CORE_ADMIN_EMAILS=operator@private-cloud.local
          EOF
              ;;
            beta)
              # The sales demo. Earlier addresses stay bound as aliases for
              # phones that enrolled with them.
              azure_client_id="$DEMO_AZURE_CLIENT_ID"
              cat >> "$GITHUB_ENV" <<'EOF'
          AZURE_RESOURCE_GROUP=rg-mentra-enterprise-reference
          AZURE_REGISTRY=mentraenterpriseref
          AZURE_KEY_VAULT=kv-mentra-enterprise-ref
          AZURE_COMMUNICATION_SERVICE=mentra-enterprise-reference
          AZURE_ENVIRONMENT=cae-mentra-enterprise-reference
          AZURE_CONTAINER_APP=ca-mentra-enterprise-reference
          AZURE_CORE_CONTAINER_APP=ca-mentra-ent-ref-core
          AZURE_CORE_IDENTITY=id-mentra-enterprise-reference-core
          AZURE_RUNTIME_IDENTITY=id-mentra-enterprise-reference-runtime
          DEPLOYMENT_ID=mentra-enterprise-reference
          DISPLAY_NAME=Acme Industries
          WORKSPACE_HOSTNAME=demo.acmeworkspace.com
          WORKSPACE_CERTIFICATE=ca-mentra-enterprise-reference-acme-demo
          WORKSPACE_ALIASES=[{"hostname":"mentra.acmeworkspace.com","certificateName":"ca-mentra-enterprise-reference-acme-workspace"},{"hostname":"enterprisedev.mentraglass.com","certificateName":"ca-mentra-enterprise-reference-workspace"}]
          CORE_ADMIN_EMAILS=api-key@01M35AKTFB5SWCXM35KYEH61VF.local
          EOF
              ;;
            *)
              echo "No demo stack deploys $channel releases." >&2
              exit 1
              ;;
          esac
          [[ "$azure_client_id" =~ ^[0-9a-f-]{36}$ ]]
          echo "AZURE_CLIENT_ID=$azure_client_id" >> "$GITHUB_ENV"

      - name: Resolve and verify exact source
        id: source
        run: |
          set -euo pipefail
          source_commit=$(git rev-parse HEAD)
          [[ "$source_commit" =~ ^[0-9a-f]{40}$ ]]
          [[ "$source_commit" == "${{ inputs.source_commit }}" ]]
          [[ "$(jq -er .sourceCommit release-input/plan/release-plan.json)" == "$source_commit" ]]
          node .github/scripts/coordinated-runtime-image-records.mjs validate \
            --plan release-input/plan/release-plan.json \
            --record release-input/runtime-image/runtime-image-publication.json \
            --allow-validated true
          echo "commit=$source_commit" >> "$GITHUB_OUTPUT"
          if [[ "${{ inputs.dry_run }}" != "true" ]]; then
            source_image=$(jq -er .image release-input/runtime-image/runtime-image-publication.json)
            source_digest=$(jq -er .digest release-input/runtime-image/runtime-image-publication.json)
            [[ "$source_image" == "ghcr.io/mentra-community/mentra-cloud" ]]
            [[ "$source_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
            {
              echo "source_image=$source_image"
              echo "source_digest=$source_digest"
              echo "source_reference=$source_image@$source_digest"
              echo "acr_tag=mentra-cloud-enterprise:$source_commit"
              echo "image=$AZURE_REGISTRY.azurecr.io/mentra-cloud-enterprise@$source_digest"
            } >> "$GITHUB_OUTPUT"
          fi

      - name: Validate the enterprise deployment source
        run: |
          set -euo pipefail
          test -s cloud-v2/docker/Dockerfile
          az bicep build \
            --file cloud-v2/deploy/azure/enterprise-reference/main.bicep \
            --outfile "$RUNNER_TEMP/enterprise-reference.json"

      - name: Sign in to Azure with GitHub OIDC
        if: inputs.dry_run != true
        # Pinned to the reviewed v2.3.1 commit; this step mints an OIDC token for
        # an Azure Contributor identity, so the mutable tag is not acceptable.
        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
        with:
          client-id: ${{ env.AZURE_CLIENT_ID }}
          tenant-id: ${{ env.ENTRA_TENANT_ID }}
          subscription-id: ${{ vars.ENTERPRISE_DEMO_AZURE_SUBSCRIPTION_ID }}

      - name: Import the canonical Mentra Cloud digest into Azure
        if: inputs.dry_run != true
        env:
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          existing_digest=$(az acr manifest show-metadata \
            --registry "$AZURE_REGISTRY" \
            --name "${{ steps.source.outputs.acr_tag }}" \
            --query digest \
            --output tsv 2>/dev/null || true)
          if [[ -n "$existing_digest" ]]; then
            [[ "$existing_digest" == "${{ steps.source.outputs.source_digest }}" ]]
          else
            az acr import \
              --name "$AZURE_REGISTRY" \
              --source "${{ steps.source.outputs.source_reference }}" \
              --image "${{ steps.source.outputs.acr_tag }}" \
              --username "$GHCR_USERNAME" \
              --password "$GHCR_TOKEN"
          fi
          imported_digest=$(az acr manifest show-metadata \
            --registry "$AZURE_REGISTRY" \
            --name "${{ steps.source.outputs.acr_tag }}" \
            --query digest \
            --output tsv)
          [[ "$imported_digest" == "${{ steps.source.outputs.source_digest }}" ]]

      - name: Import the Redis sidecar image into Azure
        if: inputs.dry_run != true
        run: |
          set -euo pipefail
          if ! az acr manifest show-metadata --registry "$AZURE_REGISTRY" --name "redis@$REDIS_DIGEST" >/dev/null 2>&1; then
            az acr import \
              --name "$AZURE_REGISTRY" \
              --source "docker.io/library/redis@$REDIS_DIGEST" \
              --image "redis:7-alpine-${REDIS_DIGEST:7:12}"
          fi
          az acr manifest show-metadata --registry "$AZURE_REGISTRY" --name "redis@$REDIS_DIGEST" >/dev/null

      # Azure issues a managed certificate only for a hostname already on an app
      # in the environment, so a new workspace hostname is attached first. The
      # deployment then creates its certificate and binds it.
      - name: Attach the workspace hostname to Runtime
        if: inputs.dry_run != true
        run: |
          set -euo pipefail
          attached=$(az containerapp hostname list \
            --name "$AZURE_CONTAINER_APP" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query "[?name=='$WORKSPACE_HOSTNAME'].name" \
            --output tsv)
          if [[ -z "$attached" ]]; then
            az containerapp hostname add \
              --hostname "$WORKSPACE_HOSTNAME" \
              --name "$AZURE_CONTAINER_APP" \
              --resource-group "$AZURE_RESOURCE_GROUP" \
              --output none
          fi

      # The demo also runs speech-to-text, text-to-speech and photos for the
      # Enterprise demo miniapp. Their keys are the stack's soniox-api-key and
      # elevenlabs-api-key Key Vault secrets.
      - name: Deploy Core and Runtime
        if: inputs.dry_run != true
        env:
          TEAMS_GRAPH_CLIENT_ID: ${{ vars.ENTERPRISE_DEMO_TEAMS_GRAPH_CLIENT_ID }}
          TEAMS_GRAPH_ORGANIZER_ID: ${{ vars.ENTERPRISE_DEMO_TEAMS_GRAPH_ORGANIZER_ID }}
        run: |
          set -euo pipefail
          parameters="$RUNNER_TEMP/private-deployment.parameters.json"
          trap 'rm -f "$parameters"' EXIT
          umask 077
          # Managed bundles are served by each stack's own Runtime, so they are
          # passed as paths on its workspace origin.
          jq -n \
            --arg cloudImage "${{ steps.source.outputs.image }}" \
            --arg redisImage "$AZURE_REGISTRY.azurecr.io/redis@$REDIS_DIGEST" \
            --arg registryName "$AZURE_REGISTRY" \
            --arg keyVaultName "$AZURE_KEY_VAULT" \
            --arg communicationName "$AZURE_COMMUNICATION_SERVICE" \
            --arg environmentName "$AZURE_ENVIRONMENT" \
            --arg runtimeName "$AZURE_CONTAINER_APP" \
            --arg coreName "$AZURE_CORE_CONTAINER_APP" \
            --arg coreIdentityName "$AZURE_CORE_IDENTITY" \
            --arg runtimeIdentityName "$AZURE_RUNTIME_IDENTITY" \
            --arg deploymentId "$DEPLOYMENT_ID" \
            --arg displayName "$DISPLAY_NAME" \
            --arg tenantId "$ENTRA_TENANT_ID" \
            --arg coreApiClientId "$ENTRA_CORE_CLIENT_ID" \
            --arg mobileClientId "$ENTRA_MOBILE_CLIENT_ID" \
            --arg workspaceHostname "$WORKSPACE_HOSTNAME" \
            --arg workspaceCertificateName "$WORKSPACE_CERTIFICATE" \
            --argjson additionalWorkspaceDomains "$WORKSPACE_ALIASES" \
            --slurpfile reference cloud-v2/deploy/azure/enterprise-reference/mentra-deployment.json \
            --slurpfile demo cloud-v2/deploy/azure/enterprise-reference/demo-miniapps.json \
            '{
              "$schema":"https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
              contentVersion:"1.0.0.0",
              parameters:{
                cloudImage:{value:$cloudImage},
                registryName:{value:$registryName},
                keyVaultName:{value:$keyVaultName},
                communicationName:{value:$communicationName},
                environmentName:{value:$environmentName},
                runtimeName:{value:$runtimeName},
                coreName:{value:$coreName},
                coreIdentityName:{value:$coreIdentityName},
                runtimeIdentityName:{value:$runtimeIdentityName},
                deploymentId:{value:$deploymentId},
                displayName:{value:$displayName},
                tenantId:{value:$tenantId},
                coreApiClientId:{value:$coreApiClientId},
                mobileClientId:{value:$mobileClientId},
                coreAdminEmails:{value:env.CORE_ADMIN_EMAILS},
                workspaceHostname:{value:$workspaceHostname},
                workspaceCertificateName:{value:$workspaceCertificateName},
                additionalWorkspaceDomains:{value:$additionalWorkspaceDomains},
                approvedSystemMiniapps:{value:$reference[0].systemMiniapps.approvedPackageNamesOverride},
                teamsGraphClientId:{value:env.TEAMS_GRAPH_CLIENT_ID},
                teamsGraphOrganizerId:{value:env.TEAMS_GRAPH_ORGANIZER_ID},
                managedMiniapps:{value:(($reference[0].miniapps.managed + $demo[0])
                  | map(del(.bundleUrl) + {bundlePath:(.bundleUrl | sub("^https://[^/]+"; ""))}))},
                cloudSpeechAndPhotos:{value:true},
                redisImage:{value:$redisImage}
              }
            }' > "$parameters"
          az deployment group create \
            --name private-deployment \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --template-file cloud-v2/deploy/azure/enterprise-reference/main.bicep \
            --parameters "@$parameters" \
            --query properties.provisioningState \
            --output tsv \
            | grep --fixed-strings --line-regexp Succeeded

      - name: Verify the live enterprise contract
        id: verify
        if: inputs.dry_run != true
        run: |
          set -euo pipefail
          workspace_origin=$(az deployment group show \
            --name private-deployment \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query properties.outputs.workspaceOrigin.value \
            --output tsv)
          [[ "$workspace_origin" == https://* ]]
          core_origin=$(az deployment group show \
            --name private-deployment \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query properties.outputs.coreOrigin.value \
            --output tsv)
          [[ "$core_origin" == https://* ]]
          core_hostname=$(az deployment group show \
            --name private-deployment \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query properties.outputs.generatedCoreHostname.value \
            --output tsv)
          [[ "$core_hostname" == "$AZURE_CORE_CONTAINER_APP".*.azurecontainerapps.io ]]
          [[ "$core_origin" == "https://$core_hostname" ]]

          image_digest=$(az acr manifest show-metadata \
            --registry "$AZURE_REGISTRY" \
            --name "${{ steps.source.outputs.acr_tag }}" \
            --query digest \
            --output tsv)
          [[ "$image_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
          [[ "$image_digest" == "${{ steps.source.outputs.source_digest }}" ]]
          # The ready revisions must run exactly the digest-pinned image this
          # run imported; otherwise the evidence would describe another build.
          expected_image="${{ steps.source.outputs.image }}"

          # `az deployment group create` returns once ARM accepts the update,
          # not once Container Apps has finished rolling the new revision out,
          # so latestReadyRevisionName can still name the previous revision.
          # Wait before any HTTP probes: the previous revision can return a
          # healthy 200 while still serving the previous manifest and Call ZIP.
          # Only verify the contract after both services run this run's image.
          source .github/scripts/azure-readiness-diagnostics.sh
          ready_revision_for_image() {
            local app="$1" attempt revision image latest
            for attempt in $(seq 1 30); do
              revision=$(az containerapp show \
                --name "$app" \
                --resource-group "$AZURE_RESOURCE_GROUP" \
                --query properties.latestReadyRevisionName \
                --output tsv)
              latest=$(az containerapp show --name "$app" --resource-group "$AZURE_RESOURCE_GROUP" \
                --query properties.latestRevisionName --output tsv)
              if [[ -n "$revision" && "$revision" == "$latest" ]]; then
                image=$(az containerapp revision show \
                  --name "$app" \
                  --revision "$revision" \
                  --resource-group "$AZURE_RESOURCE_GROUP" \
                  --query 'properties.template.containers[0].image' \
                  --output tsv)
                if [[ "$image" == "$expected_image" ]]; then
                  echo "$revision"
                  return 0
                fi
              fi
              sleep 10
            done
            echo "$app has no ready revision running $expected_image" >&2
            readiness_diagnostics "$app" "$latest" "$revision"
            return 1
          }

          revision=$(ready_revision_for_image "$AZURE_CONTAINER_APP")
          test -n "$revision"
          core_revision=$(ready_revision_for_image "$AZURE_CORE_CONTAINER_APP")
          test -n "$core_revision"

          curl_status() {
            curl \
              --fail \
              --silent \
              --show-error \
              --location \
              --retry 12 \
              --retry-delay 10 \
              --retry-all-errors \
              --output "$2" \
              --write-out '%{http_code}' \
              "$1"
          }

          : > private-deployment-checks.ndjson
          for probe in healthz ready; do
            url="$workspace_origin/$probe"
            body="$RUNNER_TEMP/$probe.json"
            status=$(curl_status "$url" "$body")
            jq -nc --arg url "$url" --argjson statusCode "$status" \
              '{url: $url, ready: true, statusCode: $statusCode}' >> private-deployment-checks.ndjson
          done
          for probe in healthz ready; do
            url="$core_origin/$probe"
            body="$RUNNER_TEMP/core-$probe.json"
            status=$(curl_status "$url" "$body")
            jq -nc --arg url "$url" --argjson statusCode "$status" \
              '{url: $url, ready: true, statusCode: $statusCode}' >> private-deployment-checks.ndjson
          done
          jq -e '.status == "ok" and .package == "runtime" and .services == ["realtime-audio", "camera", "tts", "meetings"]' \
            "$RUNNER_TEMP/healthz.json"
          jq -e '.status == "ok" and .package == "core"' "$RUNNER_TEMP/core-healthz.json"
          jq -e '.keys | length >= 2' < <(curl --fail --silent --show-error "$core_origin/.well-known/jwks.json")

          version_policy=$(curl --fail --silent --show-error --location \
            "$workspace_origin/api/client/min-version")
          jq -e \
            '.success == true and (.data.required | type == "string") and (.data.recommended | type == "string")' \
            <<< "$version_policy"

          manifest=$(curl --fail --silent --show-error --location \
            "$workspace_origin/.well-known/mentra-deployment.json")
          jq -e \
            --arg origin "$workspace_origin" \
            --arg core "$core_origin" \
            --arg tenant "$ENTRA_TENANT_ID" \
            --arg mobile "$ENTRA_MOBILE_CLIENT_ID" \
            --arg coreClient "$ENTRA_CORE_CLIENT_ID" \
            --arg deploymentId "$DEPLOYMENT_ID" \
            --arg displayName "$DISPLAY_NAME" \
            --slurpfile reference cloud-v2/deploy/azure/enterprise-reference/mentra-deployment.json \
            --slurpfile demo cloud-v2/deploy/azure/enterprise-reference/demo-miniapps.json \
            '(($reference[0].miniapps.managed + $demo[0])
               | map(.bundleUrl = $origin + (.bundleUrl | sub("^https://[^/]+"; "")))) as $managed
             | .schemaVersion == 1
             and .deploymentId == $deploymentId
             and .displayName == $displayName
             and (has("releaseIdentity") | not)
             and .services.coreUrl == $core
             and .services.runtimeUrl == $origin
             and .branding.logoUrls.light == ($origin + "/branding/logo-light.png")
             and .branding.logoUrls.dark == ($origin + "/branding/logo-dark.png")
             and .auth.mode == "microsoft-entra"
             and .auth.authorityUrl == ("https://login.microsoftonline.com/" + $tenant)
             and .auth.clientId == $mobile
             and .auth.sessionScopes == [("api://" + $coreClient + "/mentra.session")]
             and .features.runtimeRealtimeSession == true
             and .features.managedStreams == true
             and .features.nativeMeetings == true
             and .features.cloudSpeech == true
             and .systemMiniapps == $reference[0].systemMiniapps
             and .miniapps.managed == $managed
             and any(.miniapps.managed[]; .packageName == "com.mentra.call")
             and .telemetry == false' \
            <<< "$manifest"

          while read -r bundle_url bundle_sha; do
            curl --fail --silent --show-error "$bundle_url" --output "$RUNNER_TEMP/managed-miniapp.zip"
            echo "$bundle_sha  $RUNNER_TEMP/managed-miniapp.zip" | sha256sum --check
          done < <(jq -er '.miniapps.managed[] | "\(.bundleUrl) \(.sha256)"' <<< "$manifest")

          # Answers audio/mpeg only when Runtime has the ElevenLabs key; it calls no provider.
          tts_type=$(curl --fail --silent --show-error --head --output /dev/null \
            --write-out '%{content_type}' "$workspace_origin/api/tts/speak?text=ok")
          [[ "$tts_type" == audio/* ]]

          curl --fail --silent --show-error --location "$workspace_origin/legal/privacy" >/dev/null
          curl --fail --silent --show-error --location "$workspace_origin/legal/terms" >/dev/null
          for logo in logo-light.png logo-dark.png; do
            curl --fail --silent --show-error --location \
              "$workspace_origin/branding/$logo" \
              --output "$RUNNER_TEMP/$logo"
            [[ "$(file --brief --mime-type "$RUNNER_TEMP/$logo")" == "image/png" ]]
          done
          unauthenticated_status=$(curl \
            --silent \
            --show-error \
            --output /dev/null \
            --write-out '%{http_code}' \
            --request POST \
            "$workspace_origin/api/meetings/acs/token")
          [[ "$unauthenticated_status" == "401" ]]

          jq -s . private-deployment-checks.ndjson > private-deployment-checks.json

          # The stack's operator key, readable by this stack's deployer only.
          admin_token=$(az keyvault secret show --vault-name "$AZURE_KEY_VAULT" --name mentra-admin-key \
            --query value --output tsv)
          echo "::add-mask::$admin_token"
          curl --fail --silent --show-error --retry 12 --retry-delay 10 --retry-all-errors \
            -H "Authorization: Bearer $admin_token" \
            "$core_origin/api/admin/reports?limit=1" | jq -e '.reports | type == "array"' >/dev/null
          az containerapp revision show --name "$AZURE_CORE_CONTAINER_APP" --revision "$core_revision" \
            --resource-group "$AZURE_RESOURCE_GROUP" \
            --query properties.template --output json | jq -e '
              any(.volumes[]; .name == "core-attachments" and .storageType == "AzureFile") and
              any(.containers[].volumeMounts[]; .mountPath == "/mnt/core-attachments")
            ' >/dev/null

          {
            echo "workspace_origin=$workspace_origin"
            echo "image_digest=$image_digest"
            echo "revision=$revision"
            echo "core_hostname=$core_hostname"
            echo "core_origin=$core_origin"
            echo "core_revision=$core_revision"
          } >> "$GITHUB_OUTPUT"

      - name: Record validation-only evidence
        if: inputs.dry_run
        run: >-
          node .github/scripts/coordinated-private-deployment-records.mjs create
          --plan release-input/plan/release-plan.json
          --source-commit "${{ steps.source.outputs.commit }}"
          --requested-tag "${{ steps.source.outputs.commit }}"
          --status validated
          --completed-at "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)"
          --provenance-url "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          --output private-deployment.json

      - name: Record observed deployment evidence
        if: inputs.dry_run != true
        run: >-
          node .github/scripts/coordinated-private-deployment-records.mjs create
          --plan release-input/plan/release-plan.json
          --source-commit "${{ steps.source.outputs.commit }}"
          --requested-tag "${{ steps.source.outputs.commit }}"
          --status deployed
          --source-image "${{ steps.source.outputs.source_image }}"
          --source-image-digest "${{ steps.source.outputs.source_digest }}"
          --image "${{ steps.source.outputs.image }}"
          --image-digest "${{ steps.verify.outputs.image_digest }}"
          --revision "${{ steps.verify.outputs.revision }}"
          --core-revision "${{ steps.verify.outputs.core_revision }}"
          --workspace-origin "${{ steps.verify.outputs.workspace_origin }}"
          --core-hostname "${{ steps.verify.outputs.core_hostname }}"
          --core-origin "${{ steps.verify.outputs.core_origin }}"
          --checks private-deployment-checks.json
          --completed-at "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)"
          --provenance-url "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          --output private-deployment.json

      - name: Name coordinated result artifact
        id: artifact
        run: |
          set -euo pipefail
          release_set_id=$(jq -er .releaseSetId release-input/plan/release-plan.json)
          echo "name=coordinated-private-deployment-$release_set_id" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact.outputs.name }}
          path: private-deployment.json
          if-no-files-found: error
          retention-days: 90

      - name: Summarize deployment
        run: |
          {
            echo "## Mentra Private Deployment ${WORKSPACE_HOSTNAME:-}"
            echo
            echo "- Source: \`${{ steps.source.outputs.commit }}\`"
            echo "- Canonical image: \`${{ steps.source.outputs.source_reference || 'validation only' }}\`"
            echo "- Azure mirror: \`${{ steps.source.outputs.image || 'validation only' }}\`"
            echo "- Workspace: ${{ steps.verify.outputs.workspace_origin || 'validation only' }}"
            echo "- Core: ${{ steps.verify.outputs.core_origin || 'validation only' }}"
            echo "- Services: \`realtime-audio,camera,tts,meetings\`"
            echo "- Provider: \`acs-teams\`"
            echo "- Coordinated release: \`true\`"
          } >> "$GITHUB_STEP_SUMMARY"