ci: read the production env from Infisical and deploy on push

Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time.

Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.

.gitea/workflows/build-next.yml

@@ -1,4 +1,4 @@
-name: Build and Push Spoon Images
+name: Build and Deploy Spoon
 
 on:
   push:
@@ -15,6 +15,14 @@ on:
       - 'bun.lock'
       - 'turbo.json'
 
+# One production deploy at a time; a newer push waits rather than racing.
+concurrency:
+  group: build-spoon-production
+  cancel-in-progress: false
+
+# Production env comes from the Infisical `prod` environment. Each job logs in
+# as the read-only `spoon-ci` machine identity and writes the env to a temp
+# file (scripts/ci-export-env.mjs), so no prod values live in Gitea.
 jobs:
   quality:
     runs-on: ubuntu-latest
@@ -23,14 +31,15 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.10
-      - run: bun install --frozen-lockfile
+      - run: ./scripts/ci-install
       - name: Lint, typecheck, and test
         env:
-          DOTENV_PROD: ${{ secrets.DOTENV_PROD }}
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
         run: |
           env_file="$(mktemp)"
           trap 'rm -f "$env_file"' EXIT
-          printf '%s\n' "$DOTENV_PROD" > "$env_file"
+          node scripts/ci-export-env.mjs prod > "$env_file"
           bunx dotenv -e "$env_file" -- env NODE_ENV=test SKIP_E2E=1 bun run ci:check
 
   build-images:
@@ -43,14 +52,15 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.10
-      - run: bun install --frozen-lockfile
+      - run: ./scripts/ci-install
       - name: Build Next image
         env:
-          DOTENV_PROD: ${{ secrets.DOTENV_PROD }}
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
         run: |
           env_file="$(mktemp)"
           trap 'rm -f "$env_file"' EXIT
-          printf '%s\n' "$DOTENV_PROD" > "$env_file"
+          node scripts/ci-export-env.mjs prod > "$env_file"
           CI_ENV_FILE="$env_file" ./scripts/build-next-app production
       - name: Build agent images
         env:
@@ -72,3 +82,23 @@ jobs:
           docker tag spoon-agent-job:latest git.gbrown.org/gib/spoon-agent-job:latest
           docker push git.gbrown.org/gib/spoon-agent-job:${{ gitea.sha }}
           docker push git.gbrown.org/gib/spoon-agent-job:latest
+
+      # Asks the VPS to pull the new images and restart podman-spoon.service
+      # through the forced-command deploy key (~/Server/AGENTS.md §15). A
+      # failure only warns: the images are pushed and the midnight
+      # podman-update.timer deploys them anyway. The key comes in through env,
+      # not ${{ secrets.* }} in the script: the runner prints the script, and
+      # Gitea does not mask a multi-line secret split across script lines.
+      - name: Trigger immediate deploy
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          install -m600 /dev/null "$HOME/.deploy_key"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.deploy_key"
+          ssh -i "$HOME/.deploy_key" \
+              -o BatchMode=yes \
+              -o StrictHostKeyChecking=accept-new \
+              -o ConnectTimeout=15 \
+              [email protected] spoon \
+            || echo "::warning::deploy trigger failed; nightly sweep will deploy instead"
+          rm -f "$HOME/.deploy_key"