auto-deploy

name	auto-deploy
description	Deploy Lambda code for AI automation agents (wi-router and/or pr-router). Packages agent steps + shared libs into a zip and uploads to AWS Lambda. Safe to re-run after code changes. Reads function names from .ai/automation/infra.json.
when_to_use	Use when deploying Lambda code changes for wi-router or pr-router, when the user says 'deploy automation', 'update Lambda', 'push Lambda changes', or after modifying agent prompts or shared libs.
argument-hint	[wi-router|pr-router|all]

You deploy Lambda function code for the 2 AI automation agents (wi-router, pr-router). Wraps lambda/deploy.sh with audit logging. Safe to re-run at any time after code changes.

0. Prerequisites

Read .ai/automation/infra.json. Check automationProfile:

• If consumer (or legacy pr-only/pr-delegation): "This repo uses the consumer profile — Lambda functions are managed by the hub project. Do NOT deploy Lambda from this repo." STOP.

source .ai/lib/audit.sh
export AUDIT_LOG_PREFIX=infra

Extract Lambda function names and region from infra.json.

Verify: zip is installed (which zip). If missing: "Install zip: brew install zip (macOS) or apt install zip (Linux)". STOP.

1. Parse Target

Default target: all. If user passed an argument (wi-router, pr-router), use that.

2. Deploy

cd .ai/automation
bash lambda/deploy.sh <target>

The deploy script reads function names and files from infra.json, packages each Lambda + shared libs into a zip, and calls aws_lambda_deploy (audit-wrapped).

Report output from the script.

What ships with the Lambda

The Lambda zip contains only the webhook router code (wi-router.mjs / pr-router.mjs) and shared libs (dedupe.js, dlq.js, rate-limiter.js, aws-sig.js, retry.js). The Lambda's job is to route webhook events to ADO pipelines — it does not run agents.

Agent code, MCP config, and pipeline YAML are not in the Lambda zip. They live in the dx-aem-flow plugin repo and are pulled by each pipeline at runtime:

Asset	Location	Distributed via
Agent skills (/dx-simple, /dx-pr-review, …)	plugins/dx-*/skills/	Marketplace clone in pipeline YAML (git clone dx-aem-flow.git)
Pipeline YAML (ado-cli-simple.yml, …)	plugins/dx-automation/data/pipelines/cli/	Imported into ADO once via /auto-pipelines
Pipeline MCP overrides (simple-mcp.json, …)	plugins/dx-automation/data/mcp/	Marketplace clone — pipeline copies into .mcp.json at runtime

So data/mcp/simple-mcp.json does NOT need to be bundled into the Lambda zip — the pipeline (ado-cli-simple.yml) already copies it from the plugin clone ($(Pipeline.Workspace)/dx-aem-flow/plugins/dx-automation/data/mcp/simple-mcp.json → $(Build.SourcesDirectory)/.mcp.json) on every pipeline run. Adding new MCP overrides under data/mcp/ and committing/pushing to the plugin repo is sufficient — no re-deploy of Lambda is required.

3. Verify Deployment

After deploy, check the last modified timestamp for each deployed function:

REGION=$(python3 -c "import json; print(json.load(open('.ai/automation/infra.json'))['region'])")

for FUNC in $(python3 -c "
import json
d = json.load(open('.ai/automation/infra.json'))
targets = ['wi-router', 'pr-router'] if '<target>' == 'all' else ['<target>']
for t in targets: print(d['lambdas'][t]['functionName'])
"); do
  aws lambda get-function --function-name "$FUNC" --region "$REGION" \
    --query 'Configuration.[FunctionName,LastModified,CodeSize]' --output table
done

4. Summary Report

## Lambda Deploy Complete

| Function | Last Modified | Code Size |
|----------|--------------|-----------|
| <PREFIX>-WI-Router | <timestamp> | <bytes> |
| <PREFIX>-PR-Router | <timestamp> | <bytes> |

**Audit log:** `.ai/logs/infra.<week>.jsonl`

### Next step
`/auto-lambda-env` — Set Lambda environment variables

Success Criteria

• Lambda function code updated — LastModified timestamp is recent (within last 60 seconds)
• Function exists and is in Active state after deployment
• Zip package was built from the correct source directory

Examples

1. /auto-deploy — Packages agent step handlers and shared libs into zip files, then deploys both WI-Router and PR-Router Lambda functions. Reports deployment timestamps and package sizes. Both functions updated successfully.

2. /auto-deploy wi-router — Deploys only the WI-Router Lambda function (skips PR-Router). Useful after modifying only work-item-triggered agent steps. Reports the function name, timestamp, and package size.

3. /auto-deploy (after code changes) — Re-deploys both Lambdas with updated agent step code. The deploy.sh script packages fresh zips and uploads via aws_lambda_deploy. Reports successful deployment with new timestamps.

Troubleshooting

• "Function not found" error during deploy Cause: The Lambda function hasn't been provisioned yet in AWS. Fix: Run /auto-provision first to create the Lambda functions, then re-run /auto-deploy.

• Deploy succeeds but agent behavior doesn't change Cause: Lambda may be using a cached version, or the environment variables reference old configuration. Fix: Check the Lambda's last modified timestamp in the deploy output. If it's current, the code is deployed — check environment variables with /auto-lambda-env or run /auto-test --dryRun to verify behavior.

• "audit.sh not found" or audit wrapper errors Cause: The audit helper script is missing or not sourced before deployment. Fix: Ensure .ai/lib/audit.sh exists (created by /dx-init). The deploy script sources it automatically — if the file is missing, re-run /dx-init.

Rules

• Always source audit.sh first — deploy.sh uses aws_lambda_deploy wrapper
• Derive function names from infra.json — never hardcode
• Report actual deploy output — show what the script printed