Read CI env from Infisical and give the local stack its own ports

CI reads Infisical staging as the read-only convexmonorepo-base-ci machine identity, runs the quality gate, and builds and pushes the image. The template is not deployed, so there is no Convex or VPS deploy step. The local stack moves to its own Compose name and ports so it runs beside the Payload template's, and it syncs the Convex runtime env. The scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

.gitea/workflows/build-next.yml

@@ -2,55 +2,86 @@ name: Build and Push Next App
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
     paths:
-      - 'apps/**'
+      - 'apps/next/**'
       - 'packages/**'
       - 'tools/**'
       - 'scripts/**'
       - 'docker/**'
       - '.gitea/workflows/build-next.yml'
-      - '.infisical.json'
       - 'package.json'
       - 'bun.lock'
       - 'turbo.json'
 
+# One image build at a time; a newer push waits rather than racing.
+concurrency:
+  group: build-next
+  cancel-in-progress: false
+
+# This template is not deployed. CI runs the quality gate and builds and pushes
+# the image so the template stays known-good. Env comes from the Infisical
+# `staging` environment: each job logs in as the read-only
+# `convexmonorepo-base-ci` machine identity and writes it to a temp file
+# (scripts/ci-export-env.mjs), so no values live in Gitea.
 jobs:
+  # Quality gate: workspace lint (sherif), eslint, typecheck and the unit,
+  # integration and component suites must pass before anything touches
+  # production. The local-stack e2e smoke check is skipped in CI.
   quality:
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.10
-      - run: bun install --frozen-lockfile
-      - name: Lint, typecheck, and test
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: ./scripts/ci-install
+
+      - name: Lint and typecheck
         env:
-          DOTENV_PROD: ${{ secrets.DOTENV_PROD }}
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
         run: |
           env_file="$(mktemp)"
           trap 'rm -f "$env_file"' EXIT
-          printf '%s\n' "$DOTENV_PROD" > "$env_file"
+          node scripts/ci-export-env.mjs staging > "$env_file"
           bunx dotenv -e "$env_file" -- env NODE_ENV=test SKIP_E2E=1 bun run ci:check
 
   build-next:
     needs: [quality]
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
       - name: Log in to container registry
-        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      - name: Build image
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build app using project script
         env:
-          DOTENV_PROD: ${{ secrets.DOTENV_PROD }}
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
         run: |
           env_file="$(mktemp)"
           trap 'rm -f "$env_file"' EXIT
-          printf '%s\n' "$DOTENV_PROD" > "$env_file"
+          node scripts/ci-export-env.mjs staging > "$env_file"
           CI_ENV_FILE="$env_file" ./scripts/build-next-app staging
-      - name: Tag and push image
+
+      - name: Tag built image
         run: |
           docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
           docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:latest
+
+      - name: Push image tags
+        run: |
           docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
           docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:latest