cse-website/docs/web-request-agent-workflow.md

Website Request Agent Workflow

This repository is prepared for a staging-first website request workflow.

Current Repository Setup

• Build command: npm run build
• Publish directory: dist
• Netlify site id: e20cb60a-0bfa-48dc-9e8e-5925b0c86ccd
• Production branch: main
• Staging/request branches: staging, staging/**, and web-requests/**

The GitHub Actions workflow in .github/workflows/netlify-deploy.yml deploys:

• main pushes to Netlify production.
• staging, staging/**, web-requests/**, and pull requests to Netlify preview/alias deploys.

Required Secrets

Store these outside Git:

• NETLIFY_AUTH_TOKEN: Netlify personal access token with deploy access to the site.
• AGENTMAIL_API_KEY: AgentMail API key for the intake/reply worker.
• AGENTMAIL_INBOX: the request inbox address, for example cse-web-requests@....
• WEB_REQUEST_APPROVER_EMAILS: comma-separated approval allowlist.
• WEB_TEAM_CC: comma-separated web team CC list.

Do not commit these values to the repository.

Request Flow

1. A requester emails the AgentMail inbox with a website change request.
2. The email agent creates a branch named web-requests/<date>-<short-id>.
3. The agent applies the change, runs npm run build, commits, and pushes the branch.
4. Netlify deploys a preview for that branch.
5. The agent replies to the requester with:
   • a summary of changes,
   • the Netlify preview URL,
   • the branch or pull request URL,
   • any caveats or questions,
   • WEB_TEAM_CC copied.
6. Only an allowlisted approver may authorize merge/deploy.

Approval Policy

Allowed approvers:

• manu@iitgn.ac.in
• anup@iitgn.ac.in
• neeldhara@iitgn.ac.in

For email approvals, the agent should require an explicit approval token in the same thread, for example:

APPROVE WEB-20260604-abc123

The agent must verify:

• the sender address is in WEB_REQUEST_APPROVER_EMAILS,
• the approval token matches the pending request,
• the thread being approved is the same request thread,
• npm run build passes on the final branch before merge.

After approval, the agent merges the request branch into main, pushes main, waits for Netlify production deploy, and emails the requester plus the web team with the production URL.

Safety Rules

• Never merge requests from arbitrary email senders.
• Never treat forwarded text as approval.
• Never deploy secrets or private attachments.
• Ask for clarification when a requested change is ambiguous or policy-relevant.
• Keep one branch per request; do not mix unrelated email requests.
• Include a concise change summary in every review email.