devspace.yaml

# DevSpace Configuration for Open-SWE
#
# Key Requirements for startContainer to work:
# 1. devImage must be set to trigger pod replacement
# 2. labelSelector targets pods by Kubernetes labels
# 3. Patches must add /.devspace emptyDir volume for restart helper
# 4. startContainer: true delays command until sync completes
#
# The dev pipeline automatically cleans up stale state before starting.

version: v2beta1
name: open-swe

vars:
  IMAGE_REPO: gitea.cnoe.localtest.me:8443/giteaadmin/open-swe
  # Shared devcontainer image for both services
  # This dedicated devcontainer has Node.js 20, yarn, bash, and all development tools
  # Used for BOTH api and web dev containers since they have identical requirements
  DEVCONTAINER_IMAGE: gitea.cnoe.localtest.me:8443/giteaadmin/open-swe-devspace

dev:
  open-swe-api:
    namespace: open-swe
    # Use labelSelector to target the API server deployment
    # The devImage replacement ensures we get the right pod once created
    labelSelector:
      "app.kubernetes.io/component": "open-swe-langgraph-cloud-api-server"
      "app.kubernetes.io/instance": "open-swe"
    container: api-server
    # devImage triggers pod replacement with this image
    devImage: gitea.cnoe.localtest.me:8443/giteaadmin/open-swe-devspace
    workingDir: /tmp/workspace
    # Dev-specific environment overrides
    # Secrets (GITHUB_APP_*, DAYTONA_API_KEY, etc.) come from K8s secrets
    env:
      - name: PUPPETEER_SKIP_DOWNLOAD
        value: "true"
      - name: SSL_CERT_FILE
        value: "/etc/ssl/certs/ca-bundle.crt"
      - name: NODE_EXTRA_CA_CERTS
        value: "/etc/ssl/certs/ca-bundle.crt"
      - name: PORT
        value: "8000"
      # Allow self-signed certs for Keycloak JWKS endpoint in dev
      - name: NODE_TLS_REJECT_UNAUTHORIZED
        value: "0"

    resources:
      requests:
        cpu: "500m"
        memory: "4Gi"
      limits:
        cpu: "4"
        memory: "16Gi"

    patches:
      - op: remove
        path: spec.containers.name=api-server.livenessProbe
      - op: remove
        path: spec.containers.name=api-server.readinessProbe
      - op: remove
        path: spec.containers.name=api-server.startupProbe
      - op: replace
        path: spec.containers.name=api-server.imagePullPolicy
        value: IfNotPresent
      # Pod-level security context for PVC permissions
      - op: add
        path: spec.securityContext
        value:
          runAsUser: 0
          runAsGroup: 0
          fsGroup: 0
      # Container-level security context to ensure root access
      - op: add
        path: spec.containers.name=api-server.securityContext
        value:
          runAsUser: 0
          runAsGroup: 0
          allowPrivilegeEscalation: false
      # CRITICAL: Add /.devspace volume for restart helper and startContainer
      # Without this, "touch /.devspace/start: No such file or directory" occurs
      - op: add
        path: spec.volumes
        value:
          - name: devspace-dir
            emptyDir: {}
      - op: add
        path: spec.containers.name=api-server.volumeMounts
        value:
          - name: devspace-dir
            mountPath: /.devspace

    # NOTE: persistPaths removed - it creates PVCs that cause scheduling issues
    # when stale PVCs exist. Each devspace dev starts fresh without persistence.

    sync:
      - path: .:/tmp/workspace
        startContainer: true
        initialSync: mirrorLocal
        printLogs: true
        excludePaths:
          # Package manager artifacts (CRITICAL - node_modules can be large)
          - node_modules/
          - "**/node_modules/"
          - .yarn/cache/
          - .yarn/install-state.gz
          - .yarn-local/cache/
          # Version control
          - .git/
          # Build outputs and caches
          - .turbo/
          - .next/
          - dist/
          - "**/dist/"
          # LangGraph runtime artifacts (generates frequent file changes)
          - .langgraph_api/
          - "**/.langgraph_api/"
          # Dev environment artifacts
          - .devspace/
          - .devenv/
          - .direnv/
          # Editor/IDE files
          - .DS_Store
          - "*.swp"
          - "*.swo"
        # Handle file uploads - restart behavior based on file type
        onUpload:
          exec:
            # 1. Reinstall dependencies when lockfile changes (run first)
            #    REASON: New dependencies need to be installed on the pod
            - name: yarn-install
              command: |
                cd /tmp/workspace && yarn install --immutable || yarn install
              onChange: ["yarn.lock"]
              failOnError: false
            # 2. Rebuild shared package when its source files change
            #    REASON: dist/ is excluded from sync, so compiled files must be
            #    generated on the pod. This handles new files, renames, and edits.
            #    Skip if node_modules doesn't exist (initial sync before yarn install)
            - name: rebuild-shared
              command: |
                cd /tmp/workspace
                if [ -d "node_modules" ]; then
                  yarn workspace @openswe/shared build
                else
                  echo "Skipping rebuild-shared: node_modules not installed yet"
                fi
              onChange: ["packages/shared/src/**/*.ts"]
              failOnError: false
            # 3. Signal tsx to reload for API source changes
            - name: trigger-tsx-reload
              command: |
                touch /tmp/workspace/.langgraph-reload-trigger 2>/dev/null || true
              onChange: ["apps/open-swe/src/**/*.ts"]
          # Restart container when package.json changes (structural dependency changes)
          restartContainer: true

    # Inject restart helper for container restart capability
    restartHelper:
      inject: true

    command:
      - bash
      - -c
      - |
        set -euo pipefail
        # Ensure workspace directory exists
        mkdir -p /tmp/workspace
        cd /tmp/workspace
        export PUPPETEER_SKIP_DOWNLOAD=true
        yarn config set enableStrictSsl false
        yarn install --immutable || yarn install
        export PUPPETEER_SKIP_DOWNLOAD=true
        exec /tmp/workspace/node_modules/.bin/langgraphjs dev --no-browser --config /tmp/workspace/langgraph.json --host 0.0.0.0 --port 8000

    ports:
      # LangGraph API server runs on port 8000 internally
      - port: "2024:8000"
      - port: "7007:7007"

    # Terminal is disabled during pipeline - use 'devspace enter open-swe-api' to connect
    terminal:
      enabled: false
      command: /bin/bash
      workDir: /tmp/workspace

    ssh:
      enabled: true
      localPort: 2222

  open-swe-web:
    namespace: open-swe
    # Use more specific labels to match the web deployment
    # Matching the API pattern with app.kubernetes.io labels
    labelSelector:
      app: open-swe-web
    container: web
    # devImage triggers pod replacement with this image
    devImage: gitea.cnoe.localtest.me:8443/giteaadmin/open-swe-devspace
    workingDir: /tmp/workspace

    patches:
      - op: remove
        path: spec.containers.name=web.livenessProbe
      - op: remove
        path: spec.containers.name=web.readinessProbe
      # Pod-level security context for permissions (same as API)
      - op: add
        path: spec.securityContext
        value:
          runAsUser: 0
          runAsGroup: 0
          fsGroup: 0
      # Container-level security context to ensure root access
      - op: add
        path: spec.containers.name=web.securityContext
        value:
          runAsUser: 0
          runAsGroup: 0
          allowPrivilegeEscalation: false
      # CRITICAL: Add /.devspace volume for restart helper and startContainer
      - op: add
        path: spec.volumes
        value:
          - name: devspace-dir
            emptyDir: {}
      - op: add
        path: spec.containers.name=web.volumeMounts
        value:
          - name: devspace-dir
            mountPath: /.devspace

    # Resource limits to prevent OOMKilled (same as API)
    resources:
      requests:
        cpu: "500m"
        memory: "4Gi"
      limits:
        cpu: "4"
        memory: "16Gi"

    # NOTE: No persistPaths - starts fresh each time

    sync:
      - path: .:/tmp/workspace
        # startContainer delays command until initial sync completes
        # Requires /.devspace volume (added via patches above)
        startContainer: true
        initialSync: mirrorLocal
        printLogs: true
        excludePaths:
          # Package manager artifacts (CRITICAL - node_modules can be large)
          - node_modules/
          - "**/node_modules/"
          - .yarn/cache/
          - .yarn/install-state.gz
          - .yarn-local/cache/
          # Version control
          - .git/
          # Build outputs and caches
          - .turbo/
          - .next/
          - dist/
          - "**/dist/"
          # LangGraph runtime artifacts (generates frequent file changes)
          - .langgraph_api/
          - "**/.langgraph_api/"
          # Dev environment artifacts
          - .devspace/
          - .devenv/
          - .direnv/
          # Editor/IDE files
          - .DS_Store
          - "*.swp"
          - "*.swo"
        # Handle file uploads - rebuild shared package and install dependencies
        onUpload:
          exec:
            # 1. Reinstall dependencies when lockfile changes (run first)
            #    REASON: New dependencies need to be installed on the pod
            - name: yarn-install
              command: |
                cd /tmp/workspace && yarn install --immutable || yarn install
              onChange: ["yarn.lock"]
              failOnError: false
            # 2. Rebuild shared package when its source files change
            #    REASON: dist/ is excluded from sync, so compiled files must be
            #    generated on the pod. This handles new files, renames, and edits.
            #    Skip if node_modules doesn't exist (initial sync before yarn install)
            - name: rebuild-shared
              command: |
                cd /tmp/workspace
                if [ -d "node_modules" ]; then
                  yarn workspace @openswe/shared build
                else
                  echo "Skipping rebuild-shared: node_modules not installed yet"
                fi
              onChange: ["packages/shared/src/**/*.ts"]
              failOnError: false

    # Dev-specific environment overrides
    # Secrets and config come from K8s deployment
    env:
      - name: NODE_ENV
        value: "development"
      - name: PUPPETEER_SKIP_DOWNLOAD
        value: "true"
      - name: SSL_CERT_FILE
        value: "/etc/ssl/certs/ca-bundle.crt"
      - name: NODE_EXTRA_CA_CERTS
        value: "/etc/ssl/certs/ca-bundle.crt"

    command:
      - bash
      - -c
      - |
        set -euo pipefail
        # startContainer: true ensures sync completes before this runs
        mkdir -p /tmp/workspace
        cd /tmp/workspace
        export PUPPETEER_SKIP_DOWNLOAD=true
        yarn config set enableStrictSsl false
        yarn install --immutable || yarn install
        export PUPPETEER_SKIP_DOWNLOAD=true
        exec yarn workspace @openswe/web dev --hostname 0.0.0.0 --port 3000

    ports:
      - port: "3000:3000"

    # Terminal is disabled during pipeline - use 'devspace enter open-swe-web' to connect
    terminal:
      enabled: false
      command: /bin/bash
      workDir: /tmp/workspace

pipelines:
  dev:
    run: |
      echo "Cleaning up stale DevSpace state..."
      # Reset any existing devspace pods first
      devspace reset pods -n open-swe 2>/dev/null || true
      # Delete any stale devspace replacement deployments
      kubectl delete deployment -l devspace.sh/replaced=true -n open-swe 2>/dev/null || true
      # Scale DOWN original deployments - DevSpace will create replacements with devImage
      # This prevents the original pods from interfering with labelSelector matching
      echo "Scaling down original deployments..."
      kubectl scale deployment open-swe-web -n open-swe --replicas=0 2>/dev/null || true
      kubectl scale deployment open-swe-langgraph-cloud-api-server -n open-swe --replicas=0 2>/dev/null || true
      echo "Starting Open-SWE development mode..."
      # Start both dev modes - DevSpace creates replacement pods with devImage
      start_dev open-swe-api
      echo "API server dev started, now starting web..."
      start_dev open-swe-web
      echo "Both dev modes started. Access:"
      echo "  - Web UI: https://open-swe-ui.cnoe.localtest.me:8443"
      echo "  - API: http://localhost:2024"
      echo "  - Terminal: 'devspace enter open-swe-api' or 'devspace enter open-swe-web'"

  deploy:
    run: |
      echo "Building and deploying Open-SWE..."
      build_images --all
      create_deployments --all