From 40d3b5f5dcb970d98fd6d9e3ca74ef37557fa149 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Sat, 25 Jul 2026 00:12:07 -0700
Subject: [PATCH] render-secrets.sh: fix SC2015 in the mirror-write guard

A && B || C isn't if-then-else -- C can run when A is true but B
fails too. Use an explicit if/else so an mkdir success + install
failure is still caught.
---
 infra/deploy/render-secrets.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/infra/deploy/render-secrets.sh b/infra/deploy/render-secrets.sh
index 2db9cb4..b3b5b3c 100755
--- a/infra/deploy/render-secrets.sh
+++ b/infra/deploy/render-secrets.sh
@@ -137,9 +137,11 @@ render_thermograph_secrets() {
   # prod/beta (apt-installed Docker, no snap confinement) leave it unset and
   # this is a no-op for them.
   if [ "$rc" = 0 ] && [ -n "${THERMOGRAPH_SECRETS_ENV_FILE_MIRROR:-}" ]; then
-    mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \
-      && install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" \
-      || { echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2; rc=1; }
+    if ! mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \
+       || ! install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR"; then
+      echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2
+      rc=1
+    fi
   fi
 
   rm -f "$tmp"