deploy: wire processgit-updater sidecar into docker-compose

[rg4444]

deploy: wire the processgit-updater sidecar into docker-compose

Adds the deployment-side integration for the in-product self-update story. After this PR + PR #128 + the workflow extension, docker compose up -d brings up both the main app AND the updater sidecar.

Changes to deploy/docker-compose.yml

1. Image variable substitution. The three existing services (processgit, processgit-init-perms, processgit-bootstrap) now reference ghcr.io/algomation-ai/processgit:${PROCESSGIT_VERSION:-latest}. The build: directive is preserved, so source builds still work; production deployments use docker compose pull && docker compose up -d.

2. New processgit-updater service. Image ghcr.io/algomation-ai/processgit-updater:${PROCESSGIT_VERSION:-latest} (built by the sibling workflow PR). Mounts /var/run/docker.sock, a state volume for the job log, and the deploy/ directory RW so the updater can:

   • drive docker compose up --no-deps processgit to recreate the app container
   • persist the new PROCESSGIT_VERSION to deploy/.env so it survives a host restart

3. PROCESSGIT_UPDATER_TOKEN is now mandatory at compose-up time: ${PROCESSGIT_UPDATER_TOKEN:?...}. Compose fails fast if it's unset, with a message pointing to deploy/.env.example.

New file: deploy/.env.example

The template operators copy to deploy/.env. Documents:

Var	Required	Default	Purpose
PROCESSGIT_UPDATER_TOKEN	✅	—	Shared bearer token; openssl rand -hex 32
PROCESSGIT_VERSION	—	latest	Image pin; rewritten by updater on commit
PROCESSGIT_UPDATER_REPO	—	Algomation-AI/ProcessGit	Which repo to poll for releases
PROCESSGIT_UPDATER_STUB	—	true	Stub mode default; flip to false once Slice 3B lands

Env file convention

The deployment now uses two .env files, with distinct purposes:

File	Owned by	Purpose
../.env	Operator	App config (existing; passed via env_file: to the main container). Unchanged.
deploy/.env	Operator + Updater	Bearer token + PROCESSGIT_VERSION pin. Compose interpolation reads it automatically (it lives next to docker-compose.yml).

deploy/.env is what the updater writes to on commit, so the user's app-config ../.env stays untouched by automated updates.

First-deploy quickstart (post-merge)

git clone https://github.com/Algomation-AI/ProcessGit.git
cd ProcessGit/deploy
cp .env.example .env
echo "PROCESSGIT_UPDATER_TOKEN=$(openssl rand -hex 32)" >> .env
docker compose -f docker-compose.yml up -d

Sequencing

This PR can land before or after the workflow PR (ci: build & sign processgit-updater image …). Until the workflow PR lands and v0.1.1+ ships, docker compose pull for ghcr.io/algomation-ai/processgit-updater will fail because no image exists yet. Operators can either:

• Wait for both PRs + a tag → clean docker compose pull && up -d
• Or run docker compose up --build -d to build locally from source in the meantime

Validation

• compose YAML syntax validated (python3 -c 'yaml.safe_load')
• Diff is purely additive on services + variable substitution on existing services
• No changes to data volumes, ports, healthchecks, or restart policies on existing services

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: daa711f9dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add local build config for updater sidecar

This service is image-only, so docker compose up --build cannot build it from source. Docker’s Compose docs state that automatic builds apply to services that define a build section; services without build are still pulled by image tag. That makes the file header’s "build locally" path misleading for processgit-updater, and fresh deployments will fail whenever ghcr.io/algomation-ai/processgit-updater:${PROCESSGIT_VERSION} is missing or not yet published.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Point updater env template at the file the sidecar mutates

This template instructs operators to copy values into ../.env, but the updater is configured to persist version pins to /deploy/.env (PROCESSGIT_UPDATER_ENV_FILE). With the documented root-level invocation (docker compose -f deploy/docker-compose.yml ...), Compose resolves variables from a PWD .env first, so a root ../.env can override and effectively ignore updater-written deploy/.env values; the next restart may reuse a stale PROCESSGIT_VERSION instead of the committed update.

Useful? React with 👍 / 👎.