From f1664bc0f5e338bd7b2db8b3ae74f14c79982799 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Sat, 25 Jul 2026 15:03:29 -0700 Subject: [PATCH] runbook: spell out that the CI secrets must exist before the merge infra-sync fires on any push to dev/main touching infra/**, which this change does heavily. Without VPS1_SSH_*/VPS2_SSH_* those jobs SSH to an empty host and fail; sync-beta also targets a checkout that does not exist until step 1. Nothing is damaged (the jobs only fetch and render) but the red run reads like an outage. Also records that the app Deploy workflow does NOT fire here, being path-filtered to backend/** and frontend/**. --- infra/deploy/RUNBOOK-vps1-vps2-cutover.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md index d2acb3c..72934a5 100644 --- a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md +++ b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md @@ -49,6 +49,17 @@ or 8 is done wrong, which is what the verification lines are for. Keep the old `SSH_*` / `PROD_SSH_*` secrets until step 11 — they are the rollback path, and deleting them early strands you. + + **Create these BEFORE merging.** `infra-sync.yml` fires on any push to + `dev` or `main` touching `infra/**`, and this change touches a great deal + of it. Without the new secrets those jobs SSH to an empty host and fail; + `sync-beta` additionally targets `/opt/thermograph-beta`, which does not + exist until step 1. Nothing is damaged either way — the jobs only fetch + and render — but you will get a red run and a misleading alert. + + The app `Deploy` workflow does **not** fire on this merge: it is + path-filtered to `backend/**` and `frontend/**`, and this change touches + neither. - [ ] **Take a fresh prod backup and confirm it landed**, rather than trusting the schedule: