.forgejo/workflows/backend-deploy-prod.yml

@@ -8,7 +8,7 @@ name: Deploy backend to prod VPS
 # frontend-deploy-prod.yml -- a backend change ships to prod without touching
 # frontend and vice versa, exactly as in the split era.
 #
-# The tag MUST match backend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match backend-build-push.yml's last-backend-commit key (12
 # hex) -- see backend-deploy.yml for why it's truncated here. deploy.sh
 # retries the pull because the build for this push may still be in flight.
 
@@ -26,9 +26,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last backend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- backend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy backend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0

.forgejo/workflows/frontend-deploy-prod.yml

@@ -8,7 +8,7 @@ name: Deploy frontend to prod VPS
 # backend-deploy-prod.yml -- a frontend change ships to prod without touching
 # backend and vice versa, exactly as in the split era.
 #
-# The tag MUST match frontend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match frontend-build-push.yml's last-frontend-commit key (12
 # hex) -- see frontend-deploy.yml for why it's truncated here. deploy.sh
 # retries the pull because the build for this push may still be in flight.
 
@@ -31,9 +31,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last frontend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy frontend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0

.forgejo/workflows/frontend-deploy.yml

@@ -14,7 +14,7 @@ name: Deploy frontend to beta VPS
 # referenced by full GitHub URL because it isn't mirrored in Forgejo's default
 # action registry.
 #
-# The tag MUST match frontend-build-push.yml's `sha-${GITHUB_SHA:0:12}` (12
+# The tag MUST match frontend-build-push.yml's last-frontend-commit key (12
 # hex), not the full 40-char ${{ github.sha }} -- default Actions expressions
 # have no substring function, so the compute step below truncates it.
 # deploy.sh also retries the pull for ~5 min because Forgejo `needs:` can't
@@ -40,9 +40,19 @@ jobs:
   deploy:
     runs-on: docker
     steps:
-      - name: Compute image tag
+      - uses: actions/checkout@v4
+        # fetch-depth 0: the tag is keyed to the LAST COMMIT THAT TOUCHED THIS
+        # DOMAIN, not the branch tip -- in a path-filtered monorepo the tip is
+        # often an unrelated domain's commit, and a depth-1 clone can't see
+        # past it to find the real key.
+        with:
+          fetch-depth: 0
+
+      - name: Compute image tag (last frontend-touching commit)
         id: tag
-        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+        run: |
+          domain_sha="$(git log -1 --format=%H -- frontend/)"
+          echo "tag=sha-${domain_sha:0:12}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy frontend over SSH
         uses: https://github.com/appleboy/ssh-action@v1.2.0