sync-dev rendered deploy/secrets/dev.yaml into /etc/thermograph.env
unconditionally. That path is dev's env file — and it is also BETA's, on the
box beta is still running on until the cutover completes. With the dev checkout
present, the next push to dev would have overwritten the live env file of the
environment currently serving beta.thermograph.org: its containers would keep
running (env_file is read at container start) and then come up on the next
deploy pointed at dev's database password.
The earlier run only escaped this by failing first on the missing checkout.
Gate the render on the host's own secrets-env marker, which provision-dev.sh
flips to 'dev' only after beta has vacated. Until then the job syncs the
checkout and skips the render loudly rather than failing, so the ordering is
enforced by the host's own statement of what it is rather than by remembering
to do the steps in the right order.
One root workflow set replaces the four repos' copies (deleted -- root-only
is where Forgejo reads them, and dead copies are a trap): per-domain
build-push with explicit image paths (emi/thermograph/backend|frontend; the
old github.repository-derived path collides in a monorepo), path-filtered
per-domain beta/prod/dev deploys, a domain-input reusable build check, a
single always-reporting PR gate (path-filtered required checks deadlock
auto-merge), a new infra-sync pipeline (host checkout + secrets render on
infra/** pushes), and ports of secrets-guard / ops-cron /
observability-validate to monorepo paths.
