ci: allow production image builds without deployment

.github/workflows/deploy.yml

@@ -10,6 +10,11 @@ name: core-deploy
 on:
   workflow_dispatch:
     inputs:
+      build_only:
+        description: Build and push images without changing the production installation
+        required: false
+        default: false
+        type: boolean
       source_branch:
         description: Source branch deployed to the existing production installation
         required: true
@@ -61,7 +66,7 @@ jobs:
             exit 1
           fi
           echo "revision=$revision" >> "$GITHUB_OUTPUT"
-          echo "Deploying $SOURCE_BRANCH at \`$revision\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Selected $SOURCE_BRANCH at \`$revision\`" >> "$GITHUB_STEP_SUMMARY"
 
   build:
     needs: prepare
@@ -175,6 +180,7 @@ jobs:
         run: docker logout "${REGISTRY_HOST%%/*}" || true
 
   deploy:
+    if: ${{ !inputs.build_only }}
     needs: [prepare, build]
     runs-on: ${{ vars.OAC_DEPLOY_RUNNER || 'ubuntu-22.04' }}
     environment: production

deploy/kubernetes/README.md

@@ -32,6 +32,8 @@ Both images always come from one commit, so the console never talks to a Core of
 
 Merge the deployment workflow into `main`. Run **Actions** → **core-deploy** → **Run workflow** from `main` and select `source_branch` (`main` by default or `beta`), then give it a release tag or a full commit SHA already merged into that source branch. Both choices replace the same production Core and Web; `beta` does not create a separate environment. Review the [beta integration ledger](https://github.com/sandbaseai/OpenAgentCore/blob/beta/deploy/kubernetes/BETA_CHANGELOG.md) on the beta branch before selecting a beta revision. Keep the workflow branch set to `main`, including when deploying beta. The run builds both images, pushes them, applies the secrets and the environment, rolls Core out and then Web, and checks that both Services have a ready endpoint. It does not create an Ingress or configure DNS or certificates. Route `/v1` and `/api/v1` to `oac-core:8091`, and all other paths to `oac-web:8080`, in the `openagentcore` namespace. After configuring HTTPS, check `/healthz`, verify that unauthenticated `/v1/agents` returns `401`, and qualify a fresh E2B Session and Turn.
 
+To prepare images before a separately coordinated data transfer, select `build_only`. The workflow still validates the source revision and builds and pushes both images, but skips the entire deployment job, including cluster access, Secret updates and rollout. The default is `false`, which performs the deployment described above. A successful build-only run does not establish that production is running that revision.
+
 **A deployment is an outage.** Core's single replica stops before its replacement starts, and the replacement migrates the schema before it listens, so the Agents API, the machine routes and every running Session are unavailable for the rollout. Deploy in a window you can afford to lose. The Pod that takes over also needs the previous one's leased database connection to be gone; until it is, `AcquireLease` fails and Core exits, and the rollout depends on a restart landing inside the 15-minute deadline.
 
 To roll back within the same compatible installation schema, run the workflow again with the earlier commit. A source rollback does not undo migrations and cannot cross the migration-ledger or folded-baseline boundary. Restore a compatible database and state snapshot through a separately approved recovery procedure when required.