Enable auth-service/api-gateway on production, build their images in CI

.github/workflows/build-practice-images.yml

@@ -18,6 +18,8 @@ on:
     paths:
       - apps/ai-service/**
       - apps/web/**
+      - apps/auth-service/**
+      - apps/api-gateway/**
       - packages/**
       - ingestion/data/verified/drug_entities.json
       - .github/workflows/build-practice-images.yml
@@ -66,6 +68,33 @@ jobs:
           cache-from: type=gha,scope=practice-web
           cache-to: type=gha,mode=max,scope=practice-web
 
+      - name: Build and push auth-service
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/auth-service/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-auth-service:${{ github.sha }}
+          cache-from: type=gha,scope=practice-auth-service
+          cache-to: type=gha,mode=max,scope=practice-auth-service
+
+      - name: Build and push api-gateway
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/api-gateway/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-api-gateway:${{ github.sha }}
+          cache-from: type=gha,scope=practice-api-gateway
+          cache-to: type=gha,mode=max,scope=practice-api-gateway
+
+      # auth-service/api-gateway are NOT in sync_practice_argocd.py's IMAGES
+      # tuple yet — that script fails the whole run if a tag it expects to
+      # rewrite isn't already present inline on the Application, so extending
+      # it must wait until someone has added `authService.image` /
+      # `apiGateway.image` blocks to the live Application by hand (see
+      # infra/helm/medical-chatbot/values-production.yaml). Until then, these
+      # two images are pushed here but must be repointed manually.
       - name: Point the practice ArgoCD Application at the new images
         env:
           ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}

.github/workflows/ci.yml

@@ -102,3 +102,28 @@ jobs:
 
       - name: Build
         run: pnpm --filter @duoc-thu/web build
+
+  auth-and-gateway:
+    name: auth-service + api-gateway — lint + build + test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Enable pnpm
+        run: corepack enable
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm --filter @duoc-thu/auth-service --filter @duoc-thu/api-gateway lint
+
+      - name: Build
+        run: pnpm --filter @duoc-thu/auth-service --filter @duoc-thu/api-gateway build
+
+      - name: Test
+        run: pnpm --filter @duoc-thu/auth-service --filter @duoc-thu/api-gateway test

.github/workflows/rollback-k3s.yml

@@ -0,0 +1,85 @@
+name: Rollback k3s production
+
+# One-command escape hatch for medical-chatbot-app (ArgoCD, k3s) — the
+# Application build-practice-images.yml normally advances, and the same one
+# serving realvuxbaro.me since the 2026-08-17 cutover. This workflow does not
+# build anything: it only repoints the Application at an OLDER image tag that
+# a previous build-practice-images.yml run already pushed to GHCR, using the
+# exact same sync_practice_argocd.py logic that workflow uses to move
+# forward — a rollback is just that script pointed backward.
+#
+# Does not touch the Compose EC2 (stopped 2026-08-18, no CI/CD path left —
+# see docs/operations.md).
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_sha:
+        description: >-
+          Commit SHA to roll back to. Must have a successful "Build and sync
+          k3s images" run (check: gh run list --workflow=build-practice-images.yml).
+        required: true
+
+concurrency:
+  # Same group as build-practice-images.yml: a rollback and a forward deploy
+  # must never race to repoint the same Application at the same time.
+  group: practice-images
+  cancel-in-progress: false
+
+jobs:
+  rollback:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Fails fast and clearly on the most likely operator mistake: a typo'd
+      # or never-built SHA, rather than that surfacing later as a confusing
+      # ArgoCD/pod-level image pull failure.
+      - name: Confirm images exist for target_sha
+        run: |
+          set -eu
+          docker buildx imagetools inspect "ghcr.io/baovu2k4/vsf-duocthu-ai-service:${{ inputs.target_sha }}" > /dev/null
+          docker buildx imagetools inspect "ghcr.io/baovu2k4/vsf-duocthu-web:${{ inputs.target_sha }}" > /dev/null
+
+      - name: Point medical-chatbot-app at target_sha
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+          IMAGE_TAG: ${{ inputs.target_sha }}
+        run: python3 .github/scripts/sync_practice_argocd.py
+
+      # Blocks until the rollout has actually landed, not just until the sync
+      # call returned — sync_practice_argocd.py deliberately doesn't wait
+      # (see its own comment on the selfHeal race), so a rollback specifically
+      # needs this extra confirmation before it can claim success.
+      - name: Wait for the Application to be Synced, Healthy, and on target_sha
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+          EXPECT_TAG: ${{ inputs.target_sha }}
+        run: python3 .github/scripts/wait_for_argocd_sync.py
+
+      - name: Confirm realvuxbaro.me is serving the rolled-back build
+        run: |
+          for attempt in $(seq 1 18); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' \
+              "https://realvuxbaro.me/api/history?conversation_id=rollback-smoke-${{ inputs.target_sha }}")
+            if [ "$code" = "200" ]; then
+              echo "realvuxbaro.me is live on ${{ inputs.target_sha }}"
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "realvuxbaro.me did not respond healthy within 3 minutes after rollback"
+          exit 1