refactor(cli): make deployment cloud-only (#189)

This simplifies Company Brain deployment around the hosted AWS path
only. The CLI no longer exposes local/cloud targets, local Docker setup,
local Nango env/config persistence, or local agent-sync targeting;
installed users get a cloud deployment workflow that provisions AWS,
deploys release artifacts, configures hosted Nango integrations/syncs,
and manages agent-sync against the hosted stack.

The CI side keeps the immutable-image reuse guard, but now builds only
the linux/amd64 images needed by cloud deployment. QEMU and
multi-platform image inputs are removed, so repeated Nango builds can be
skipped when the submodule-based image tag already exists in GHCR, and
local Apple Silicon image support is intentionally out of scope. People
who want to run Company Brain locally should clone the repo and use the
contributor workflow instead of the installed CLI.

Author: massimoalbarello

.github/actions/build-and-push-docker/action.yml

@@ -17,14 +17,9 @@ inputs:
   cache-scope:
     description: GitHub Actions cache scope; keep distinct per image to avoid collisions.
     required: true
-  platforms:
-    description: Comma-separated target platforms.
-    required: false
-    default: linux/amd64,linux/arm64
-
 outputs:
   image-uri:
-    description: The immutable image reference that was pushed.
+    description: The immutable image reference to deploy.
     value: ${{ steps.tags.outputs.immutable }}
 
 runs:
@@ -40,18 +35,29 @@ runs:
         echo "immutable=$IMAGE_REPOSITORY:$IMAGE_TAG" >> "$GITHUB_OUTPUT"
         echo "latest=$IMAGE_REPOSITORY:latest" >> "$GITHUB_OUTPUT"
 
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+    - name: Check for existing image
+      id: existing-image
+      shell: bash
+      env:
+        IMAGE_URI: ${{ steps.tags.outputs.immutable }}
+      run: |
+        if docker manifest inspect "$IMAGE_URI" >/dev/null 2>&1; then
+          echo "exists=true" >> "$GITHUB_OUTPUT"
+          echo "Image $IMAGE_URI already exists; skipping build." >> "$GITHUB_STEP_SUMMARY"
+        else
+          echo "exists=false" >> "$GITHUB_OUTPUT"
+        fi
 
     - name: Set up Docker Buildx
+      if: steps.existing-image.outputs.exists != 'true'
       uses: docker/setup-buildx-action@v3
 
     - name: Build and push image
+      if: steps.existing-image.outputs.exists != 'true'
       shell: bash
       env:
         IMAGE_REPOSITORY: ${{ inputs.image-repository }}
         IMAGE_TAG: ${{ inputs.image-tag }}
-        PLATFORM: ${{ inputs.platforms }}
         BUILD_CONTEXT: ${{ inputs.context }}
         DOCKERFILE: ${{ inputs.dockerfile }}
         CACHE_SCOPE: ${{ inputs.cache-scope }}

.github/workflows/cd.yml

@@ -21,7 +21,6 @@ permissions:
 
 env:
   NO_COLOR: "1"
-  IMAGE_TAG: sha-${{ github.sha }}
 
 jobs:
   deploy-config:
@@ -37,6 +36,9 @@ jobs:
       nango_connect_hostname: ${{ steps.config.outputs.nango_connect_hostname }}
       brain_hostname: ${{ steps.config.outputs.brain_hostname }}
       dozzle_hostname: ${{ steps.config.outputs.dozzle_hostname }}
+      nango_image_uri: ${{ steps.config.outputs.nango_image_uri }}
+      brain_image_uri: ${{ steps.config.outputs.brain_image_uri }}
+      pg_backup_image_uri: ${{ steps.config.outputs.pg_backup_image_uri }}
       image_matrix: ${{ steps.config.outputs.image_matrix }}
     steps:
       - uses: actions/checkout@v6
@@ -71,7 +73,7 @@ jobs:
         uses: ./.github/actions/build-and-push-docker
         with:
           image-repository: ${{ matrix.image.repository }}
-          image-tag: ${{ env.IMAGE_TAG }}
+          image-tag: ${{ matrix.image.image_tag }}
           context: ${{ matrix.image.context }}
           dockerfile: ${{ matrix.image.dockerfile }}
           cache-scope: ${{ matrix.image.cache_scope }}
@@ -174,9 +176,9 @@ jobs:
       - name: Verify images are public
         run: |
           infra/deploy/verify_public_images.sh \
-            ghcr.io/onfabric/company-brain-nango:${{ env.IMAGE_TAG }} \
-            ghcr.io/onfabric/company-brain-brain:${{ env.IMAGE_TAG }} \
-            ghcr.io/onfabric/company-brain-pg-backup:${{ env.IMAGE_TAG }}
+            ${{ needs.deploy-config.outputs.nango_image_uri }} \
+            ${{ needs.deploy-config.outputs.brain_image_uri }} \
+            ${{ needs.deploy-config.outputs.pg_backup_image_uri }}
 
       - name: Configure AWS credentials (OIDC)
         uses: aws-actions/configure-aws-credentials@v6
@@ -192,9 +194,9 @@ jobs:
           DEPLOY_GROUP: ${{ needs.terraform-apply.outputs.deploy_group_tag }}
           DATA_VOLUME_ID: ${{ needs.terraform-apply.outputs.data_volume_id }}
           ARTIFACTS_BUCKET: ${{ needs.terraform-apply.outputs.artifacts_bucket }}
-          NANGO_IMAGE_URI: ghcr.io/onfabric/company-brain-nango:${{ env.IMAGE_TAG }}
-          BRAIN_IMAGE_URI: ghcr.io/onfabric/company-brain-brain:${{ env.IMAGE_TAG }}
-          PG_BACKUP_IMAGE_URI: ghcr.io/onfabric/company-brain-pg-backup:${{ env.IMAGE_TAG }}
+          NANGO_IMAGE_URI: ${{ needs.deploy-config.outputs.nango_image_uri }}
+          BRAIN_IMAGE_URI: ${{ needs.deploy-config.outputs.brain_image_uri }}
+          PG_BACKUP_IMAGE_URI: ${{ needs.deploy-config.outputs.pg_backup_image_uri }}
           ACME_EMAIL: ${{ vars.ACME_EMAIL }}
 
       - name: Deploy on instance via SSM
@@ -249,7 +251,7 @@ jobs:
       - uses: ./.github/actions/prepare
 
       - name: Add Nango integrations
-        run: bun run company-brain --non-interactive add integrations --target cloud --all
+        run: bun run company-brain --non-interactive add integrations --all
 
       - name: Add Nango syncs
-        run: bun run company-brain --non-interactive add syncs --target cloud --all
+        run: bun run company-brain --non-interactive add syncs --all

.github/workflows/release.yml

@@ -22,6 +22,9 @@ jobs:
     outputs:
       version: ${{ steps.meta.outputs.version }}
       image_matrix: ${{ steps.meta.outputs.image_matrix }}
+      nango_image_uri: ${{ steps.meta.outputs.nango_image_uri }}
+      brain_image_uri: ${{ steps.meta.outputs.brain_image_uri }}
+      pg_backup_image_uri: ${{ steps.meta.outputs.pg_backup_image_uri }}
     steps:
       - uses: actions/checkout@v6
 
@@ -31,8 +34,7 @@ jobs:
         run: |
           version="${{ inputs.version || github.ref_name }}"
           echo "version=$version" >> "$GITHUB_OUTPUT"
-          bun cli/src/scripts/github-deploy-plan.ts github-outputs dev \
-            | awk -F= '$1 == "image_matrix" { print "image_matrix=" $2 }' >> "$GITHUB_OUTPUT"
+          bun cli/src/scripts/github-deploy-plan.ts github-outputs dev >> "$GITHUB_OUTPUT"
 
   images:
     needs: config
@@ -58,7 +60,7 @@ jobs:
         uses: ./.github/actions/build-and-push-docker
         with:
           image-repository: ${{ matrix.image.repository }}
-          image-tag: ${{ needs.config.outputs.version }}
+          image-tag: ${{ matrix.image.image_tag }}
           context: ${{ matrix.image.context }}
           dockerfile: ${{ matrix.image.dockerfile }}
           cache-scope: ${{ matrix.image.cache_scope }}
@@ -75,9 +77,9 @@ jobs:
       - name: Verify images are public
         run: |
           infra/deploy/verify_public_images.sh \
-            ghcr.io/onfabric/company-brain-nango:${{ needs.config.outputs.version }} \
-            ghcr.io/onfabric/company-brain-brain:${{ needs.config.outputs.version }} \
-            ghcr.io/onfabric/company-brain-pg-backup:${{ needs.config.outputs.version }}
+            ${{ needs.config.outputs.nango_image_uri }} \
+            ${{ needs.config.outputs.brain_image_uri }} \
+            ${{ needs.config.outputs.pg_backup_image_uri }}
 
       - uses: ./.github/actions/prepare
 
@@ -98,6 +100,9 @@ jobs:
       - name: Build release manifest and checksums
         env:
           VERSION: ${{ needs.config.outputs.version }}
+          NANGO_IMAGE_URI: ${{ needs.config.outputs.nango_image_uri }}
+          BRAIN_IMAGE_URI: ${{ needs.config.outputs.brain_image_uri }}
+          PG_BACKUP_IMAGE_URI: ${{ needs.config.outputs.pg_backup_image_uri }}
         run: |
           runtime_sha=$(shasum -a 256 dist/company-brain-runtime.tar.gz | awk '{print $1}')
           integrations_sha=$(shasum -a 256 dist/company-brain-integrations.tar.gz | awk '{print $1}')
@@ -109,9 +114,9 @@ jobs:
             "gitSha": "${git_sha}",
             "nangoSubmoduleSha": "${nango_sha}",
             "images": {
-              "nango": "ghcr.io/onfabric/company-brain-nango:${VERSION}",
-              "brain": "ghcr.io/onfabric/company-brain-brain:${VERSION}",
-              "pgBackup": "ghcr.io/onfabric/company-brain-pg-backup:${VERSION}"
+              "nango": "${NANGO_IMAGE_URI}",
+              "brain": "${BRAIN_IMAGE_URI}",
+              "pgBackup": "${PG_BACKUP_IMAGE_URI}"
             },
             "assets": {
               "runtime": {

README.md

@@ -4,61 +4,31 @@ Self-hostable Company Brain experiment: Nango collects records from workplace
 tools, the brain service normalizes/searches them, and the dashboard lets you
 inspect what is flowing in.
 
-## Local First
+## Cloud Deployment
 
-Start locally before thinking about AWS, domains, or GitHub Actions.
+The installed CLI provisions and operates a hosted Company Brain stack on AWS:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/onfabric/company-brain/main/scripts/install-company-brain-cli.sh | bash
-company-brain target local
 company-brain setup
 ```
 
-Contributors can still run the CLI from a checkout:
-
-```bash
-git clone --recurse-submodules https://github.com/onfabric/company-brain
-cd company-brain
-bun install
-bun run company-brain target local
-bun run company-brain setup
-```
-
-Local URLs:
-
-- Brain dashboard: http://localhost:3010/
-- Nango dashboard/login and API keys: http://localhost:3003
-
-`setup` with the local target downloads the release assets, generates env
-files, starts Docker Compose by default, waits for the stack to become healthy,
-then asks for the local Nango dev API key at the end. Use
-`company-brain setup --skip-start` if you only want to generate local env files.
-Run `company-brain resume` to restart the local stack or save the Nango API key
-later.
-
-## Cloud
-
-Provision the hosted Company Brain stack on AWS:
-
-```bash
-company-brain target cloud
-company-brain setup
-```
-
-`setup` with the cloud target provisions AWS infrastructure, deploys the
-released containers, verifies DNS/HTTPS, then asks for the hosted Nango dev API
-key at the end. If DNS or certificate setup needs a pause, run this after
-making the requested changes:
+`setup` downloads the release assets, provisions AWS infrastructure, deploys
+the released containers, verifies DNS/HTTPS, then asks for the hosted Nango dev
+API key. If DNS or certificate setup needs a pause, run this after making the
+requested changes:
 
 ```bash
 company-brain resume
 ```
 
-Use `--target local` or `--target cloud` on any target-aware command to override
-the saved target for one run:
+Local deployment is a contributor workflow. Clone the repository if you want to
+run Company Brain locally:
 
 ```bash
-company-brain doctor --target cloud
+git clone --recurse-submodules https://github.com/onfabric/company-brain
+cd company-brain
+bun install
 ```
 
 ## Add Integrations
@@ -67,7 +37,6 @@ Choose and create the Company Brain source integrations you want:
 
 ```bash
 company-brain add integrations
-company-brain add integrations --target cloud
 ```
 
 The CLI prompts for which source integrations to install and for OAuth app
@@ -76,20 +45,18 @@ key directly:
 
 ```bash
 company-brain add integrations --nango-secret-key <dev-api-key>
-company-brain add integrations --target cloud --nango-secret-key <dev-api-key>
 ```
 
-Use this callback URL for local OAuth apps:
+Use this callback URL for hosted OAuth apps:
 
 ```txt
-http://localhost:3003/oauth/callback
+https://<nango-hostname>/oauth/callback
 ```
 
 For non-interactive use, pass the integrations explicitly:
 
 ```bash
 company-brain add integrations --only notion,slack
-company-brain add integrations --target cloud --only notion,slack
 ```
 
 This step only creates the selected source integrations. Syncs are added
@@ -116,14 +83,12 @@ integration you installed:
 
 ```bash
 company-brain add syncs
-company-brain add syncs --target cloud
 ```
 
 For non-interactive use or manual overrides:
 
 ```bash
 company-brain add syncs --only notion,slack
-company-brain add syncs --target cloud --only notion,slack
 ```
 
 `--only` overrides the installed-integration list and accepts numbers such as
@@ -143,19 +108,17 @@ Manual sync integrations are:
 ## Agent Sync
 
 Agent conversations are not installed with the default source integrations. Add
-them after the target Company Brain stack is running:
+them after the hosted Company Brain stack is running:
 
 ```bash
 company-brain agent-sync install
-company-brain agent-sync install --target cloud
 ```
 
-The install command checks that the selected target is healthy, makes sure the
+The install command checks that the hosted deployment is healthy, makes sure the
 Nango dev API key is saved, installs the hidden `agent-conversations`
-integration and `conversations` sync in that target Nango, writes the local
-sync config, then installs a macOS LaunchAgent that runs
-`company-brain agent-sync sync-now --target <target>` on load and on the
-configured interval.
+integration and `conversations` sync in hosted Nango, writes the local sync
+config, then installs a macOS LaunchAgent that runs
+`company-brain agent-sync sync-now` on load and on the configured interval.
 
 Manage the schedule with:
 
@@ -165,30 +128,27 @@ company-brain agent-sync sync-now
 company-brain agent-sync uninstall
 ```
 
-Pass `--target cloud` when agent sync should point at the hosted Company Brain.
-
 ## Check Setup
 
 ```bash
 company-brain doctor
-company-brain doctor --target cloud
 ```
 
-The doctors check service health, saved configuration, Nango API key
-configuration, and selected sync configuration.
+The doctor checks AWS access, Terraform outputs, DNS, HTTPS, remote Docker
+services, and hosted Nango API key configuration.
 
 ## CLI
 
 The primary entrypoint is the installed CLI:
 
 ```bash
 company-brain --help
-company-brain target local
 company-brain setup
 company-brain add integrations
 company-brain add syncs
 company-brain agent-sync install
-company-brain setup --target cloud
+company-brain doctor
+company-brain destroy
 ```
 
 Contributors can use `bun run company-brain ...` from a checkout.
@@ -200,10 +160,10 @@ installer. The installed CLI uses the same release manifest lookup unless
 `COMPANY_BRAIN_RELEASE_VERSION`, `COMPANY_BRAIN_RELEASE_MANIFEST_URL`, or
 `COMPANY_BRAIN_RELEASE_MANIFEST_PATH` is set.
 
-Company Brain release images are published to GHCR for `linux/amd64` and
-`linux/arm64`. The release and dev deploy workflows verify that the image tags
-are anonymously pullable before publishing deployable artifacts, because local
-Docker and EC2 hosts pull them without registry credentials.
+Company Brain release images are published to GHCR for `linux/amd64`. The
+release and dev deploy workflows verify that the image tags are anonymously
+pullable before publishing deployable artifacts, because EC2 hosts pull them
+without registry credentials.
 
 ## Contributing