Wire content-creator into build-push and staging/prod deploy image flow

[Copilot]

CD — Deploy to Staging failed because content-creator was still treated as a local build image (curvit/content-creator:local) and never produced/tagged in GHCR. This PR aligns content-creator with the existing deployable service pattern so staging/prod resolve and retag a real ghcr.io/nickletts2/curvit image.

• Build/push workflow integration (.github/workflows/build-push.yml)

  • Added content-creator to dorny/paths-filter with the same shared dependency paths used by other Python services.
  • Added matrix-builder needs_build entry for services/content-creator/Dockerfile -> curvit-content-creator.
  • Added curvit-content-creator to retag-unchanged ALL_TAGS so unchanged commits still get sha-* tags via -dev.

• Staging alias tagging (.github/workflows/cd-staging.yml)

  • Added curvit-content-creator to the staging alias SERVICES list so :curvit-content-creator-staging is refreshed per deploy.

• Compose deployment overlays

  • Added content-creator overrides in:
    • docker-compose.staging.yml
    • docker-compose.prod.yml
  • Both now use:
    • image: ghcr.io/nickletts2/curvit:curvit-content-creator-${IMAGE_TAG}
    • build: !reset null, pull_policy: always
    • environment parity for auth/internal key/CMS URL/content-creator AI vars
    • depends_on health conditions for postgres and cms-service
    • internal-only networking (backend + egress), with no Traefik labels.

Example (new build matrix entry):

if needs_build "${{ steps.filter.outputs.content-creator }}" "curvit-content-creator-dev"; then
  add_item '{"tag":"curvit-content-creator","context":".","dockerfile":"services/content-creator/Dockerfile","build_args":"","trivyignores":".trivyignore"}'
  TAGS+=(curvit-content-creator)
fi

Original prompt

Problem

The Deploy to staging job in the CD — Deploy to Staging workflow (.github/workflows/cd-staging.yml) is failing during docker compose pull with:

WARNING: Some service image(s) must be built from source by running:
    docker compose build content-creator
Error response from daemon: pull access denied for curvit/content-creator,
repository does not exist or may require 'docker login'
ERROR: docker compose pull failed after 3 attempts

Failing run: https://github.com/NickLetts2/Curvit/actions/runs/26679614172/job/78637564834

Root cause

The content-creator service exists fully under services/content-creator/ (Dockerfile, FastAPI app under app/, requirements.txt, tests/, docs at docs/content-creator.md) and is referenced in docker-compose.yml, but it was never wired into the CI/CD pipeline. Concretely, in contrast to the other 15 services (core-api, cms-service, messaging-service, billing-service, etc.), content-creator is missing from:

1. .github/workflows/build-push.yml — no paths-filter, no needs_build/add_item block in the matrix builder, and not in the ALL_TAGS re-tag list. So no ghcr.io/nickletts2/curvit:curvit-content-creator-<sha> image is ever produced.
2. docker-compose.staging.yml and docker-compose.prod.yml — no override that switches the service to the GHCR image. The base docker-compose.yml references image: curvit/content-creator:local with build:, so on staging Docker tries to pull from Docker Hub and fails.
3. .github/workflows/cd-staging.yml — curvit-content-creator is missing from the SERVICES=( ... ) array (lines 241–257) used to update the -staging alias tag.

We're going with Option A: promote content-creator to a fully CI-built service deployed to staging (and prepare the same wiring for prod, mirroring how every other backend service is set up).

Required Changes

Please make the following changes consistently with how the existing Python services (e.g. messaging-service, cms-service, billing-service) are configured. Match their patterns exactly — do not invent new conventions.

1. .github/workflows/build-push.yml

• In the dorny/paths-filter filters: block, add a content-creator filter mirroring messaging-service:

  content-creator:
    - 'services/content-creator/**'
    - 'shared/*.py'
    - 'shared/contracts/**'
    - 'shared/schemas/**'
    - 'shared/telemetry/**'
    - '.github/workflows/build-push.yml'

• In the Build matrix and tag list step, add a needs_build block for content-creator (mirror messaging-service):

  if needs_build "${{ steps.filter.outputs.content-creator }}" "curvit-content-creator-dev"; then
    add_item '{"tag":"curvit-content-creator","context":".","dockerfile":"services/content-creator/Dockerfile","build_args":"","trivyignores":".trivyignore"}'
    TAGS+=(curvit-content-creator)
  fi

• In the retag-unchanged job, add curvit-content-creator to the ALL_TAGS=( ... ) array.

2. .github/workflows/cd-staging.yml

• In the Tag staging alias in GitHub Container Registry step, add curvit-content-creator to the SERVICES=( ... ) array so the -staging alias is updated on every deploy.

3. docker-compose.staging.yml

Add a content-creator service override following the exact same shape as the existing messaging-service override in this file (the snippet shown around lines 540–608 of docker-compose.staging.yml). Specifically:

• image: ghcr.io/nickletts2/curvit:curvit-content-creator-${IMAGE_TAG}
• build: !reset null
• pull_policy: always
• restart: unless-stopped
• env_file: ${STAGING_ENV_FILE:-/opt/curvit/environments/staging/.env}
• ports: !reset []
• environment: set APP_ENV: staging, LOG_LEVEL: "warning", AUTH_ISSUER: https://app.staging.curvit.co.uk, AUTH_AUDIENCE: curvit-api, INTERNAL_API_KEY: ${INTERNAL_API_KEY:?INTERNAL_API_KEY must be set}, CMS_SERVICE_URL: "http://cms-service:8000", CONTENT_CREATOR_AI_API_KEY: ${CONTENT_CREATOR_AI_API_KEY:-}, CONTENT_CREATOR_AI_MODEL: ${CONTENT_CREATOR_AI_MODEL:-claude-haiku-4-5-20251001}, PROMPT_VERSION: ${CONTENT_CREATOR_PROMPT_VERSION:-v1.0}.
• depends_on: !reset with postgres: { condition: service_healthy } and cms-service: { condition: service_healthy } (mirroring the base compose).
• Modest deploy.resources.limits similar to messaging-service (e.g. cpus: "0.25", memory: 256M).
• Same logging block as the other services in this file.
• No Traefik labels — the base docker-compose.yml comments confirm content-creator has no public ingress. Do not attach it to curvit-staging-proxy.
• Networks: backend only (and egress if you can confirm it's needed for the Anthropic API call — yes, it calls anthropic/Claude, so include egress as billing-service does for Stripe).

4. docker-compose.prod.yml

Add an equivalent content-creator override mirroring its `messaging-serv...

This pull request was created from Copilot chat.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.