In a path-filtered monorepo the branch tip is often another domain's
commit: a push tipping at an infra-only change made every backend deploy
(push-triggered or dispatched) compute sha-<tip> and go looking for an
image no build ever produced -- 5 minutes of pull retries, then a red run
(this bit backend-deploy-prod on the release tip today).
Build and deploy now compute the SAME key: git log -1 -- <domain>/, the
last commit that actually touched the domain. Builds tag with it, deploys
pull it, dispatches always resolve, and re-pushes of unrelated commits
are naturally idempotent (same key -> image already exists). Deploy
workflows gain a fetch-depth:0 checkout -- a depth-1 clone can't see past
an unrelated tip to find the key.
One root workflow set replaces the four repos' copies (deleted -- root-only
is where Forgejo reads them, and dead copies are a trap): per-domain
build-push with explicit image paths (emi/thermograph/backend|frontend; the
old github.repository-derived path collides in a monorepo), path-filtered
per-domain beta/prod/dev deploys, a domain-input reusable build check, a
single always-reporting PR gate (path-filtered required checks deadlock
auto-merge), a new infra-sync pipeline (host checkout + secrets render on
infra/** pushes), and ports of secrets-guard / ops-cron /
observability-validate to monorepo paths.
