{
  "ok": true,
  "tool": "deployments.github_actions_setup",
  "generatedAt": "2026-05-21T10:07:39.029Z",
  "status": "blocked-project-link",
  "setupPackHash": "sha256:b340d913feccdc5aee7326074f6e3f47bab4c90192012969a95f60302dca7ba9",
  "repo": "kfubtik/trust402",
  "baseUrl": "https://trust402.aztecbeacon.uk",
  "workflow": {
    "path": ".github/workflows/vercel-production-deploy.yml",
    "file": "vercel-production-deploy.yml",
    "present": true,
    "expectedTrigger": "manual workflow_dispatch only",
    "productionAlias": "https://trust402.aztecbeacon.uk"
  },
  "vercelProject": {
    "projectName": "trust402",
    "projectIdConfigured": false,
    "orgIdConfigured": false,
    "projectId": null,
    "orgId": null,
    "source": "input-or-local-cli"
  },
  "githubActions": {
    "requiredSecretNames": [
      "VERCEL_TOKEN",
      "VERCEL_ORG_ID",
      "VERCEL_PROJECT_ID"
    ],
    "deploymentEvidenceArtifact": {
      "name": "trust402-deployment-evidence",
      "files": [
        "deployment-url.txt",
        "deployment-evidence.json"
      ],
      "schema": "trust402.github_actions_deploy_evidence.v1",
      "requiredFields": [
        "schema",
        "runUrl",
        "headSha",
        "deploymentUrl",
        "productionAlias"
      ],
      "evidenceEnvMapping": {
        "TRUST402_GIT_AUTO_DEPLOY_VERIFIED": "true after the workflow completes and production smoke passes",
        "TRUST402_GIT_AUTO_DEPLOY_EVIDENCE_URL": "deployment-evidence.json runUrl",
        "TRUST402_GIT_AUTO_DEPLOY_COMMIT_SHA": "deployment-evidence.json headSha"
      }
    },
    "secretValuePolicy": {
      "VERCEL_TOKEN": "never print; paste locally into GitHub secret storage",
      "VERCEL_ORG_ID": "non-secret project link id from .vercel/project.json",
      "VERCEL_PROJECT_ID": "non-secret project link id from .vercel/project.json"
    },
    "commandPlan": {
      "setupSecrets": [
        "gh secret set VERCEL_ORG_ID --repo kfubtik/trust402 --body \"<org-id-from-.vercel/project.json>\"",
        "gh secret set VERCEL_PROJECT_ID --repo kfubtik/trust402 --body \"<project-id-from-.vercel/project.json>\"",
        "gh secret set VERCEL_TOKEN --repo kfubtik/trust402 --body \"<paste-vercel-token-locally>\""
      ],
      "triggerAndVerify": [
        "gh workflow run vercel-production-deploy.yml --repo kfubtik/trust402 --ref main",
        "gh run list --repo kfubtik/trust402 --workflow vercel-production-deploy.yml --limit 5",
        "npm run deployment:preflight -- https://trust402.aztecbeacon.uk --probe-github-cli --probe-vercel-api",
        "npm run smoke -- https://trust402.aztecbeacon.uk",
        "npm run smoke:x402 -- https://trust402.aztecbeacon.uk",
        "npm run launch:monitor -- https://trust402.aztecbeacon.uk --timeout-ms=10000 --skip-directories --strict"
      ],
      "evidenceCapture": [
        "gh run list --repo kfubtik/trust402 --workflow vercel-production-deploy.yml --limit 1 --json url,headSha,status,conclusion,event",
        "gh run download --repo kfubtik/trust402 --name trust402-deployment-evidence --dir .local/github-actions-evidence",
        "npm run deployment:preflight -- https://trust402.aztecbeacon.uk --probe-github-cli --probe-vercel-api"
      ]
    },
    "operatorWarning": "The commands are instructions only. This API/CLI does not run gh, mutate GitHub, mutate Vercel, or read secret values."
  },
  "evidenceEnv": {
    "TRUST402_GIT_AUTO_DEPLOY_VERIFIED": "true",
    "TRUST402_GIT_AUTO_DEPLOY_EVIDENCE_URL": "<GitHub Actions run URL or Git-backed Vercel deployment URL>",
    "TRUST402_GIT_AUTO_DEPLOY_COMMIT_SHA": "<commit sha from the successful deployment run>"
  },
  "blockers": [
    {
      "id": "vercel_project_ids_missing",
      "message": "VERCEL_ORG_ID and VERCEL_PROJECT_ID are required from .vercel/project.json."
    }
  ],
  "nextAction": "Link the project with Vercel first or pass vercelProject.projectId and vercelProject.orgId from .vercel/project.json.",
  "safety": {
    "readOnly": true,
    "mutatesGitHub": false,
    "mutatesVercel": false,
    "readsSecretValues": false,
    "printsSecretValues": false,
    "includesSecretValues": false,
    "sendsPaymentHeaders": false,
    "mutatesWallet": false
  }
}