add deployment related files (DO NOT MERGE)

.dockerignore

@@ -0,0 +1,26 @@
+# Dependencies and build output
+**/node_modules
+**/dist
+**/.venv-tools
+
+# Environment and secrets
+**/.env
+**/.env.local
+**/.env.*.local
+
+# Git and editor
+.git
+.gitignore
+**/.DS_Store
+**/*.log
+
+# Test coverage report output (do not use **/coverage — it excludes source under
+# service/src/dispatch/coverage and coverage-service/lib/src/coverage)
+/coverage
+**/.vitest
+
+# Docker (avoid recursive context)
+deployment/coverage-api.env
+deployment/coverage-worker.env
+deployment/openreview-api.env
+deployment/openreview-worker.env

.gitignore

@@ -7,6 +7,10 @@ dist/
 # Environment
 .env
 .env.local
+deployment/coverage-api.env
+deployment/coverage-worker.env
+deployment/openreview-api.env
+deployment/openreview-worker.env
 
 # Trace files
 *.json.trace

coverage-service/.env.example

@@ -5,7 +5,7 @@ DATABASE_URL=postgresql://prcoverage:prcoverage@localhost:5432/prcoverage?schema
 REDIS_URL=redis://localhost:6379
 
 # API
-API_PORT=3000
+API_PORT=3010
 WEBHOOK_SECRET=change-me-to-a-random-secret
 
 # GitHub (choose one auth method)

deployment/coverage-api.env.example

@@ -0,0 +1,11 @@
+DATABASE_URL=postgresql://prcoverage:prcoverage@postgres:5432/prcoverage?schema=public
+REDIS_URL=redis://redis:6379
+GITHUB_AUTH_MODE=pat
+GITHUB_PAT=
+LLM_PROVIDER=openai
+OPENAI_API_KEY=
+TEST_GENERATION_MODEL=gpt-4o
+NODE_ENV=production
+OPENAI_MODEL=gpt-4o-mini
+ANTHROPIC_API_KEY=
+ANTHROPIC_MODEL=claude-3-5-sonnet-20241022

coverage-service/api/Dockerfile → deployment/coverage-api/Dockerfile

@@ -1,4 +1,11 @@
-FROM node:20-slim AS builder
+# syntax=docker/dockerfile:1.7
+
+FROM node:24-slim AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openssl \
+    ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
 
 RUN corepack enable && corepack prepare pnpm@10.28.0 --activate
 
@@ -7,8 +14,12 @@ WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY coverage-service/lib/package.json ./coverage-service/lib/
 COPY coverage-service/api/package.json ./coverage-service/api/
+COPY coverage-service/api/prisma ./coverage-service/api/prisma
+COPY coverage-service/api/scripts ./coverage-service/api/scripts
 
-RUN pnpm install --frozen-lockfile --filter @openreview/coverage-lib --filter @openreview/coverage-api
+RUN pnpm install --frozen-lockfile --ignore-scripts \
+    --filter @openreview/coverage-lib \
+    --filter @openreview/coverage-api
 
 COPY coverage-service/lib ./coverage-service/lib
 COPY coverage-service/api ./coverage-service/api
@@ -17,7 +28,12 @@ RUN pnpm --filter @openreview/coverage-lib build
 RUN pnpm --filter @openreview/coverage-api exec prisma generate
 RUN pnpm --filter @openreview/coverage-api build
 
-FROM node:20-slim
+FROM node:24-slim AS runtime
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openssl \
+    ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
 
 RUN corepack enable && corepack prepare pnpm@10.28.0 --activate
 
@@ -26,17 +42,23 @@ WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY coverage-service/lib/package.json ./coverage-service/lib/
 COPY coverage-service/api/package.json ./coverage-service/api/
+COPY coverage-service/api/prisma ./coverage-service/api/prisma
+COPY coverage-service/api/scripts ./coverage-service/api/scripts
 
-RUN pnpm install --frozen-lockfile --prod --filter @openreview/coverage-lib --filter @openreview/coverage-api
+RUN pnpm install --frozen-lockfile --ignore-scripts \
+    --filter @openreview/coverage-lib \
+    --filter @openreview/coverage-api
 
 COPY --from=builder /app/coverage-service/lib/dist ./coverage-service/lib/dist
 COPY --from=builder /app/coverage-service/api/dist ./coverage-service/api/dist
-COPY --from=builder /app/coverage-service/api/prisma ./coverage-service/api/prisma
-COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
-COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
+
+ENV CI=true
+RUN pnpm --filter @openreview/coverage-api exec prisma generate
 
 WORKDIR /app/coverage-service/api
 
+ENV NODE_ENV=production
+
 EXPOSE 3000
 
 CMD ["sh", "-c", "pnpm exec prisma migrate deploy && node dist/main.js"]

deployment/coverage-worker.env.example

@@ -0,0 +1,24 @@
+DATABASE_URL=postgresql://prcoverage:prcoverage@postgres:5432/prcoverage?schema=public
+REDIS_URL=redis://redis:6379
+GITHUB_AUTH_MODE=pat
+GITHUB_PAT=
+LLM_PROVIDER=openai
+OPENAI_API_KEY=
+TEST_GENERATION_MODEL=gpt-4o
+NODE_ENV=production
+WORKER_CONCURRENCY=2
+WORK_DIR=/tmp/pr-coverage-runs
+EXECUTION_TIMEOUT_MS=3600000
+JOB_LOCK_DURATION_MS=3600000
+JOB_STALLED_INTERVAL_MS=120000
+JOB_MAX_STALLED_COUNT=5
+WORKER_FORCE_SHUTDOWN=false
+DIFF_COVER_BIN=diff-cover
+PYTHON_BIN=python3
+TEST_THRESHOLD=80
+MAX_GENERATION_ATTEMPTS=3
+OPENAI_MODEL=gpt-4o-mini
+ANTHROPIC_API_KEY=
+ANTHROPIC_MODEL=claude-3-5-sonnet-20241022
+MAX_MEMORY_MB=2048
+MAX_CPU_CORES=2

coverage-service/worker/Dockerfile → deployment/coverage-worker/Dockerfile

@@ -1,4 +1,11 @@
-FROM node:20-slim AS builder
+# syntax=docker/dockerfile:1.7
+
+FROM node:24-slim AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openssl \
+    ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
 
 RUN corepack enable && corepack prepare pnpm@10.28.0 --activate
 
@@ -7,23 +14,30 @@ WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY coverage-service/lib/package.json ./coverage-service/lib/
 COPY coverage-service/worker/package.json ./coverage-service/worker/
+COPY coverage-service/api/package.json ./coverage-service/api/
 COPY coverage-service/api/prisma ./coverage-service/api/prisma
+COPY coverage-service/api/scripts ./coverage-service/api/scripts
 
-RUN pnpm install --frozen-lockfile --filter @openreview/coverage-lib --filter @openreview/coverage-worker
+RUN pnpm install --frozen-lockfile --ignore-scripts \
+    --filter @openreview/coverage-lib \
+    --filter @openreview/coverage-worker \
+    --filter @openreview/coverage-api
 
 COPY coverage-service/lib ./coverage-service/lib
 COPY coverage-service/worker ./coverage-service/worker
 
 RUN pnpm --filter @openreview/coverage-lib build
-RUN pnpm --filter @openreview/coverage-worker exec prisma generate --schema=../api/prisma/schema.prisma
+# Generate from @openreview/coverage-api — it owns the schema and prisma CLI.
+RUN pnpm --filter @openreview/coverage-api exec prisma generate
 RUN pnpm --filter @openreview/coverage-worker build
 
-FROM node:20-slim
+FROM node:24-slim AS runtime
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     python3 \
     python3-pip \
+    openssl \
     ca-certificates \
   && pip3 install --break-system-packages diff-cover \
   && rm -rf /var/lib/apt/lists/*
@@ -35,19 +49,27 @@ WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY coverage-service/lib/package.json ./coverage-service/lib/
 COPY coverage-service/worker/package.json ./coverage-service/worker/
+COPY coverage-service/api/package.json ./coverage-service/api/
+COPY coverage-service/api/prisma ./coverage-service/api/prisma
+COPY coverage-service/api/scripts ./coverage-service/api/scripts
 
-RUN pnpm install --frozen-lockfile --prod --filter @openreview/coverage-lib --filter @openreview/coverage-worker
+RUN pnpm install --frozen-lockfile --ignore-scripts \
+    --filter @openreview/coverage-lib \
+    --filter @openreview/coverage-worker \
+    --filter @openreview/coverage-api
 
 COPY --from=builder /app/coverage-service/lib/dist ./coverage-service/lib/dist
 COPY --from=builder /app/coverage-service/worker/dist ./coverage-service/worker/dist
 COPY --from=builder /app/coverage-service/api/prisma ./coverage-service/api/prisma
-COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
-COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
+
+ENV CI=true
+RUN pnpm --filter @openreview/coverage-api exec prisma generate
 
 WORKDIR /app/coverage-service/worker
 
+ENV NODE_ENV=production
 ENV WORK_DIR=/tmp/pr-coverage-runs
-ENV EXECUTION_TIMEOUT_MS=600000
+ENV EXECUTION_TIMEOUT_MS=3600000
 
 USER node
 

coverage-service/docker-compose.yml → deployment/docker-compose.coverage.yaml

@@ -1,3 +1,5 @@
+name: coverage
+
 services:
   postgres:
     image: postgres:16-alpine
@@ -6,7 +8,7 @@ services:
       POSTGRES_PASSWORD: prcoverage
       POSTGRES_DB: prcoverage
     ports:
-      - '5432:5432'
+      - '5433:5432'
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -18,7 +20,7 @@ services:
   redis:
     image: redis:7-alpine
     ports:
-      - '6379:6379'
+      - '6381:6379'
     healthcheck:
       test: ['CMD', 'redis-cli', 'ping']
       interval: 5s
@@ -27,38 +29,40 @@ services:
 
   api:
     build:
-      context: ../..
-      dockerfile: coverage-service/api/Dockerfile
+      context: ..
+      dockerfile: deployment/coverage-api/Dockerfile
     ports:
-      - '3000:3000'
-    env_file: .env
-    environment:
-      DATABASE_URL: postgresql://prcoverage:prcoverage@postgres:5432/prcoverage?schema=public
-      REDIS_URL: redis://redis:6379
-      API_PORT: 3000
+      - '3010:3000'
+    env_file: coverage-api.env
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
+    healthcheck:
+      test:
+        [
+          'CMD-SHELL',
+          "node -e \"fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
     restart: unless-stopped
 
   worker:
     build:
-      context: ../..
-      dockerfile: coverage-service/worker/Dockerfile
-    env_file: .env
-    environment:
-      DATABASE_URL: postgresql://prcoverage:prcoverage@postgres:5432/prcoverage?schema=public
-      REDIS_URL: redis://redis:6379
-      WORK_DIR: /tmp/pr-coverage-runs
+      context: ..
+      dockerfile: deployment/coverage-worker/Dockerfile
+    env_file: coverage-worker.env
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
       api:
-        condition: service_started
+        condition: service_healthy
     deploy:
       resources:
         limits:

deployment/docker-compose.openreview.yaml

@@ -0,0 +1,49 @@
+name: openreview
+
+services:
+  redis:
+    image: redis:7-alpine
+    ports:
+      - '6380:6379'
+    healthcheck:
+      test: ['CMD', 'redis-cli', 'ping']
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  web:
+    build:
+      context: ..
+      dockerfile: deployment/openreview-service/Dockerfile
+    ports:
+      - '3003:3000'
+    env_file: openreview-api.env
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    depends_on:
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test:
+        [
+          'CMD-SHELL',
+          "node -e \"fetch('http://127.0.0.1:3000/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    restart: unless-stopped
+
+  worker:
+    build:
+      context: ..
+      dockerfile: deployment/openreview-service/Dockerfile
+    command: ['node', 'dist/worker.mjs']
+    env_file: openreview-worker.env
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    depends_on:
+      redis:
+        condition: service_healthy
+    restart: unless-stopped

deployment/openreview-api.env.example

@@ -0,0 +1,12 @@
+GITHUB_WEBHOOK_SECRET=
+GITHUB_PAT=
+REDIS_URL=redis://redis:6379
+HOST=0.0.0.0
+NODE_ENV=production
+LOG_LEVEL=info
+MAX_PAYLOAD_BYTES=26214400
+COVERAGE_SERVICE_ENABLED=true
+COVERAGE_SERVICE_URL=http://ec2-15-206-186-202.ap-south-1.compute.amazonaws.com:3010
+COVERAGE_SERVICE_BRANCH_PREFIX=openreview/tests
+COVERAGE_SERVICE_POLL_INTERVAL_MS=5000
+COVERAGE_SERVICE_POLL_TIMEOUT_MS=1800000