fix(deploy): hand the process CODEFLY_GRPC_PORT in the deployment (#124)

A deployed FastAPI service with grpc-server on got the gRPC containerPort
and Service port from the kustomize template, but its container env carried
only CODEFLY_CONNECT_PORT. Locally the runtime hands the process
CODEFLY_GRPC_PORT; in the cluster the app had to guess the port the agent
had already rendered into the Service. The scaffold guessed 9090, and a
service that reads the variable strictly crashlooped with KeyError.

The deployment template now projects CODEFLY_GRPC_PORT from
Parameters.GRPCPort whenever GRPCEnabled is set, mirroring the Connect
block, so the variable and the Service port come from the same value. The
Parameters doc comment and the scaffold's main.py comment say so.

TestDeploymentRendersGRPCPort asserts the variable and its value on a
gRPC-enabled render and its absence when gRPC is off; it fails against the
previous template.

Co-authored-by: antoinetoussaint-byte <312536060+antoinetoussaint-byte@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: antoinetoussaint-byte

builder.go

@@ -504,9 +504,9 @@ func (s *Builder) Upgrade(ctx context.Context, req *builderv0.UpgradeRequest) (*
 // Parameters is the template parameter set for the k8s deployment.
 type Parameters struct {
 	Probes string
-	// GRPCEnabled adds the gRPC containerPort and Service port to the rendered
-	// manifests. GRPCPort is the fixed in-cluster port the grpc.aio listener
-	// binds (the app defaults to it when CODEFLY_GRPC_PORT is unset).
+	// GRPCEnabled adds the gRPC containerPort, Service port and
+	// CODEFLY_GRPC_PORT, the variable the app binds its grpc.aio listener on.
+	// GRPCPort is the fixed in-cluster port it binds.
 	GRPCEnabled bool
 	GRPCPort    int
 	// ConnectEnabled adds the Connect face's containerPort, Service port and

grpc_test.go

@@ -190,8 +190,10 @@ func TestGRPCEndpointReloadsContract(t *testing.T) {
 	require.Contains(t, names, "Echo")
 }
 
-// TestDeploymentRendersGRPCPort proves the gRPC container/service ports appear
-// only when the deployment parameters opt in.
+// TestDeploymentRendersGRPCPort proves the gRPC container/service ports, and
+// the CODEFLY_GRPC_PORT the app binds on, appear only when the deployment
+// parameters opt in: a deployed service never guesses the port the Service
+// routes to.
 func TestDeploymentRendersGRPCPort(t *testing.T) {
 	enabled := agenttesting.AssertKustomizeTemplates(t, deploymentFS, deploymentTestParameters(t, Parameters{GRPCEnabled: true, GRPCPort: 9090}))
 	svc, err := os.ReadFile(filepath.Join(enabled, "base", "service.yaml"))
@@ -202,9 +204,13 @@ func TestDeploymentRendersGRPCPort(t *testing.T) {
 	deployment, err := os.ReadFile(filepath.Join(enabled, "base", "deployment.yaml"))
 	require.NoError(t, err)
 	require.Contains(t, string(deployment), "containerPort: 9090")
+	require.Contains(t, string(deployment), "- name: CODEFLY_GRPC_PORT\n              value: \"9090\"")
 
 	disabled := agenttesting.AssertKustomizeTemplates(t, deploymentFS, deploymentTestParameters(t, Parameters{}))
 	svc, err = os.ReadFile(filepath.Join(disabled, "base", "service.yaml"))
 	require.NoError(t, err)
 	require.NotContains(t, string(svc), "grpc-port")
+	deployment, err = os.ReadFile(filepath.Join(disabled, "base", "deployment.yaml"))
+	require.NoError(t, err)
+	require.NotContains(t, string(deployment), "CODEFLY_GRPC_PORT")
 }

templates/deployment/kustomize/base/deployment.yaml.tmpl

@@ -74,6 +74,12 @@ spec:
             # writable scratch mount so libraries that use ~/.cache still work.
             - name: HOME
               value: /tmp
+{{- if .Deployment.Parameters.GRPCEnabled }}
+            # grpc-server is on: the app binds its grpc.aio listener on this
+            # port, the one the grpc containerPort and the Service declare.
+            - name: CODEFLY_GRPC_PORT
+              value: "{{ .Deployment.Parameters.GRPCPort }}"
+{{- end }}
 {{- if .Deployment.Parameters.ConnectEnabled }}
             # connect-endpoint is on: the app serves the Connect face on this
             # port, and only when the variable is set.

templates/factory/code/src/main.py.tmpl

@@ -56,8 +56,8 @@ for plugin in plugins:
 {{- if .GRPCEnabled }}
 
 # gRPC server — runs a grpc.aio listener in this process alongside FastAPI.
-# The port is provided by codefly at runtime; it falls back to the standard
-# gRPC port in container/Kubernetes where the mapping is fixed.
+# codefly hands the process its port as CODEFLY_GRPC_PORT, locally and in the
+# deployment.
 _grpc_server = None
 # The Connect face (Connect, gRPC-Web and gRPC on one listener over the gRPC
 # server): codefly hands the process CODEFLY_CONNECT_PORT exactly when the

testdata/recipe315327749/mod/svc-1793294758768/GETTING_STARTED.md

@@ -0,0 +1,13 @@
+## Welcome to your `fastapi` project!
+
+This agent follows the [fastapi best practices](https://github.com/zhanymkanov/fastapi-best-practices) layout.
+
+Dependency management uses [uv](https://docs.astral.sh/uv/). Common commands:
+
+- `uv sync` — install/refresh the venv from `pyproject.toml` + `uv.lock`
+- `uv add <package>` — add a runtime dependency
+- `uv add --dev <package>` — add a dev dependency
+- `uv run pytest` — run tests
+- `uv run uvicorn src.main:app --reload` — run the dev server
+
+`codefly run service <name>` does all of the above for you via the agent.

testdata/recipe315327749/mod/svc-1793294758768/code/codefly_uvicorn_logging.py

@@ -0,0 +1,18 @@
+"""Codefly's uvicorn logging filter. Generated by the python-fastapi agent;
+regenerated on every start, so edits here do not survive. Health probes are
+not traffic: an access-log line for /healthz or /readyz is dropped before it is
+formatted, and every other line is written exactly as uvicorn writes it."""
+import logging
+import re
+
+PROBE_PATHS = re.compile(r"^/(healthz|readyz|livez|health|ready|live|ping)$")
+
+
+class ProbeFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        args = record.args
+        if isinstance(args, tuple) and len(args) >= 3 and isinstance(args[2], str):
+            path = args[2].split("?", 1)[0]
+            if PROBE_PATHS.match(path):
+                return False
+        return True

testdata/recipe315327749/mod/svc-1793294758768/code/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "base"
+version = "0.0.0"
+description = ""
+requires-python = ">=3.10"
+dependencies = [
+    "fastapi>=0.109.0",
+    "uvicorn>=0.25.0",
+    "codefly-sdk>=0.0.14",
+    "pydantic>=2.9.2",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.2.0",
+    "httpx>=0.27.0",
+    "pytest-asyncio>=0.23.6",
+    "codefly-cli>=0.0.19",
+    "ruff>=0.6.0",
+]
+
+[tool.uv]
+package = false
+# A CONSTRAINT, not a dependency: it bounds a version only if something
+# else pulls the package in. multidict 7.1.0 (PyPI, 2026-10-09) shipped
+# without manylinux wheels, so `uv sync` in the Debian runtime had nothing
+# to install and no compiler to build it -- every fresh service failed at
+# Create. Lift it once a 7.1.x with manylinux wheels exists; the durable
+# fix is a uv.lock shipped with this template so a create never resolves
+# whatever PyPI published an hour ago.
+constraint-dependencies = ["multidict<7.1"]
+
+[tool.pytest.ini_options]
+# "." — not "src" — so the `from src.X` imports in the scaffolded tests
+# resolve. src/ ships with an __init__.py making it a proper package.
+pythonpath = ["."]
+testpaths = ["tests"]
+# pytest-asyncio 1.x needs an explicit mode. "auto" picks up async def
+# tests without needing @pytest.mark.asyncio on every one; keeps the
+# boilerplate low for scaffolded services.
+asyncio_mode = "auto"

testdata/recipe315327749/mod/svc-1793294758768/code/src/__init__.py

@@ -0,0 +1,5 @@
+from pydantic import BaseModel
+
+
+class Version(BaseModel):
+    version: str

testdata/recipe315327749/mod/svc-1793294758768/code/src/admin/models.py

@@ -0,0 +1,11 @@
+from fastapi import APIRouter
+
+from src.admin.models import Version
+from src.admin.version import get_version
+
+router = APIRouter()
+
+
+@router.get("/version", response_model=Version)
+async def version():
+    return get_version()