From af839c6cd0d8ee493b68a253d138118843e1ed62 Mon Sep 17 00:00:00 2001
From: emi <emerytgriffith@gmail.com>
Date: Thu, 23 Jul 2026 13:58:57 +0000
Subject: [PATCH] Finish the domain-sha tag keying: three deploy workflows were
 missed (#6)

---
 .forgejo/workflows/backend-deploy-prod.yml  | 16 +++++++++++++---
 .forgejo/workflows/frontend-deploy-prod.yml | 16 +++++++++++++---
 .forgejo/workflows/frontend-deploy.yml      | 16 +++++++++++++---
 3 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/backend-deploy-prod.yml b/.forgejo/workflows/backend-deploy-prod.yml
index 9df7155..c4fba2c 100644
--- a/.forgejo/workflows/backend-deploy-prod.yml
+++ b/.forgejo/workflows/backend-deploy-prod.yml
@@ -8,7 +8,7 @@ name: Deploy backend to prod VPS
 # frontend-deploy-prod.yml -- a backend change ships to prod without touching
 # frontend and vice versa, exactly as in the split era.
 #
-# The tag MUST match backend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match backend-build-push.yml's last-backend-commit key (12
 # hex) -- see backend-deploy.yml for why it's truncated here. deploy.sh
 # retries the pull because the build for this push may still be in flight.
 
@@ -26,9 +26,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last backend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- backend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy backend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0
diff --git a/.forgejo/workflows/frontend-deploy-prod.yml b/.forgejo/workflows/frontend-deploy-prod.yml
index 7a707d2..e483273 100644
--- a/.forgejo/workflows/frontend-deploy-prod.yml
+++ b/.forgejo/workflows/frontend-deploy-prod.yml
@@ -8,7 +8,7 @@ name: Deploy frontend to prod VPS
 # backend-deploy-prod.yml -- a frontend change ships to prod without touching
 # backend and vice versa, exactly as in the split era.
 #
-# The tag MUST match frontend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match frontend-build-push.yml's last-frontend-commit key (12
 # hex) -- see frontend-deploy.yml for why it's truncated here. deploy.sh
 # retries the pull because the build for this push may still be in flight.
 
@@ -31,9 +31,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last frontend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy frontend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0
diff --git a/.forgejo/workflows/frontend-deploy.yml b/.forgejo/workflows/frontend-deploy.yml
index 75c511a..bbdad62 100644
--- a/.forgejo/workflows/frontend-deploy.yml
+++ b/.forgejo/workflows/frontend-deploy.yml
@@ -14,7 +14,7 @@ name: Deploy frontend to beta VPS
 # referenced by full GitHub URL because it isn't mirrored in Forgejo's default
 # action registry.
 #
-# The tag MUST match frontend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match frontend-build-push.yml's last-frontend-commit key (12
 # hex), not the full 40-char ${{ github.sha }} -- default Actions expressions
 # have no substring function, so the compute step below truncates it.
 # deploy.sh also retries the pull for ~5 min because Forgejo `needs:` can't
@@ -40,9 +40,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last frontend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy frontend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0