# Deploy from CI

Run source deployments without giving CI sandbox infrastructure credentials.

CI should upload agent source to Salambo. It should not build the hosted sandbox image or receive platform registry and sandbox credentials.

## Required CI authority

CI needs:

* the Salambo application URL;
* a scoped Salambo API key;
* secret environment variables referenced by `salambo.yaml`.

Store these in the organization or repository secret manager.

## Example workflow

```bash
export SALAMBO_API_KEY="$CI_SALAMBO_API_KEY"
export OPENAI_API_KEY="$CI_OPENAI_API_KEY"

salambo auth set \
  --api-url "$SALAMBO_BASE_URL" \
  --key "$SALAMBO_API_KEY" \
  --profile ci

salambo doctor --profile ci
salambo manifest --path . --json
salambo deploy --profile ci
salambo smoke "CI deployment smoke test" --profile ci
```

`salambo doctor` checks the same hosted source-deployment contract used by `manifest` and `deploy`. It does not require Docker, Compose, or sandbox infrastructure credentials.

## Responsibility split

| CI                               | Hosted deployment worker           |
| -------------------------------- | ---------------------------------- |
| Validate source and config       | Resolve the managed base release   |
| Compile the manifest             | Generate the managed build context |
| Upload the source archive        | Build the sandbox image            |
| Create the deployment            | Prepare the managed runtime        |
| Supply declared provider secrets | Activate the immutable deployment  |

## Recommended gates

1. Run project tests.
2. Run `salambo doctor` with the deployment credentials and declared secrets.
3. Compile the manifest.
4. Deploy from a clean commit.
5. Wait for the deployment to become ready.
6. Run one bounded hosted smoke test.
7. Keep the previous deployment available for rollback.

Do not use personal keys for shared CI. Use organization-owned authority with only the required scopes.