6 Commits

Author	SHA1	Message	Date
jwright	1c87af560d	ci(bump-digest): force-push the ephemeral deploy branch (idempotent re-runs) ... Re-running the same commit collided with the prior run's deploy/<sha> branch (non-fast-forward reject). The branch is a disposable deploy artifact; main is the protected human-merge gate, so force-push is safe and makes re-runs work.	2026-06-17 23:33:34 +10:00
jwright	2592b5680b	ci(bump-digest): bound PR-open curl + make it non-fatal so runs go green ... The branch push is the deploy artifact; opening the PR is best-effort. Previously a no-timeout curl to the private Gitea API tripped split-horizon DNS from the runner, hanging the step ~10min then failing the whole run. Now: --connect-timeout 10 --max-time 30, failure is logged non-fatally, exit 0.	2026-06-17 23:02:27 +10:00
jwright	1c956d6ec4	Hero: fix title descender clipping (g); CI: rename PR token var so Gitea's auto GITEA_TOKEN doesn't 401 the branch step	2026-06-17 20:54:57 +10:00
jwright	18ed7458c3	CI: per-user digest file path (avoid /tmp collision between manual + runner)	2026-06-17 20:51:08 +10:00
jwright	fbad7a18db	CI: digest-bump pushes a branch for manual PR (no broad token needed)	2026-06-17 20:11:13 +10:00
jwright	83edaf5975	M5: publish seam + CI/CD pipeline ... scripts/new-post.mjs writes schema-valid posts from flags or a JSON event (the IaC publish seam). Gitea Actions workflow: ci check, audit-ci gate, build, dist scan, CycloneDX SBOM, buildah build+push, and a least-privilege digest-bump PR to home-ops (never auto-merged). Renovate + audit allowlist.	2026-06-17 17:20:54 +10:00