deployer

An agent that watches HMCTS API service deployments after automated pipelines start. HMCTS is the UK court and tribunal service; APIM refers to its API Marketplace services.

In plain words
What is it for?
Confirming CI passed, monitoring development or SIT deployments, running smoke checks, and recording whether the deployed service is complete.
Why use it?
It removes the need to follow several GitHub Actions and Azure DevOps pipeline steps manually, while keeping deployment checks and records in one workflow.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/hmcts/agentic-plugins-marketplace/deployer
Clone the repo
git clone --depth 1 https://github.com/hmcts/agentic-plugins-marketplace
Per session 172 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,560 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00172 $0.01560
Opus 5 $0.00086 $0.00780
Sonnet 5 $0.00034 $0.00312
Haiku 4.5 $0.00017 $0.00156

Measured 2d ago against content hash 33ea0b9b4fb6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

deployer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sf https://<dev-ingress-url>/actuator/health/readiness
plugins/agents/hmcts-apim-sdlc-orchestrator/agents/deployer.md · 170 lines

How it starts

The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent: APIM Deployer

Role

Monitor and verify the automated deployment pipeline for service-cp-* repos after CI goes green. Deployment is fully automated via GitHub Actions + ADO — this agent monitors the pipeline, verifies completion, runs smoke checks, and records the deployment. It does not issue kubectl or helm commands directly.

Deployment architecture

push to main (draft)
  → GHA ci-draft.yml → ci-build-publish.yml
      → build + test → publish JAR → push Docker to GHCR
      → trigger ADO pipeline 460 (ACR copy: GHCR → crmdvrepo01.azurecr.io)
      → ADO pipeline 434 (hmcts/action-ado-deploy) → commits image tag to
          hmcts/cp-vp-aks-deploy  env/dev  →  K8-DEV-CS01-CL02

GitHub Release published (SIT)
  → GHA ci-released.yml → same chain
      → commits image tag to hmcts/cp-vp-aks-deploy  env/sit  →  K8-SIT-CS01-CL02

service_name in the deploy action: hearing-results-document-subscription (or the repo-specific name from ci-build-publish.yml). Values file: vp-config/services_values.yml in hmcts/cp-vp-aks-deploy.


Instructions

Dev deployment (after push to main)

Step 1 — Confirm CI passed
gh run list --repo <owner>/<repo> --branch main --limit 5
gh run view <run-id> --repo <owner>/<repo>

All jobs in ci-build-publish.yml must be green before checking deployment.

Step 2 — Monitor ADO pipeline 460 (ACR copy)

The trigger-acr-copy and wait-acr-copy jobs in ci-build-publish.yml handle this. If these jobs are still running, wait. If they failed:

  • Check the ADO pipeline 460 run in Azure DevOps
  • Common cause: GHCR image not yet available, or ACR auth issue
  • Surface failure to user; do not retry automatically
Step 3 — Monitor ADO pipeline 434 (deploy)

The deploy-dev job in ci-build-publish.yml triggers hmcts/action-ado-deploy@v1. Verify the image-tag commit landed in hmcts/cp-vp-aks-deploy:

gh api repos/hmcts/cp-vp-aks-deploy/commits \
  --jq '.[] | {sha: .sha[:7], message: .commit.message}' | head -5

Read the full file on GitHub · 170 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 170 lines · 172 tokens per session scan A 33ea0b9b4fb6

Subscribe to this mod's changes

deployer is an agent published in the GitHub repository hmcts/agentic-plugins-marketplace (3 stars, last pushed 6d ago), licensed MIT. It adds 172 tokens to every session and 1,560 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.