ci: read the production env from Infisical and deploy on push

Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time.

Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.

scripts/ci-export-env.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// ci-export-env.mjs [environment]
+//
+// CI's counterpart to scripts/export-env: prints an Infisical environment
+// (default `staging`) as dotenv on stdout, in the same quoting export-env uses.
+// It logs in as the `spoon-ci` machine identity through Universal Auth, using
+// INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET from the job's Gitea secrets,
+// and reads the project and host from .infisical.json. Plain Node, no CLI to
+// install, so it runs in every job whether or not Bun is set up.
+import { readFile } from 'node:fs/promises';
+
+const environment = process.argv[2] ?? 'staging';
+const { INFISICAL_CLIENT_ID: clientId, INFISICAL_CLIENT_SECRET: clientSecret } =
+  process.env;
+
+const fail = (message) => {
+  console.error(`ci-export-env: ${message}`);
+  process.exit(1);
+};
+
+if (!clientId || !clientSecret)
+  fail('INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET must be set.');
+
+const { workspaceId, domain } = JSON.parse(
+  await readFile(new URL('../.infisical.json', import.meta.url), 'utf8'),
+);
+
+const request = async (path, init) => {
+  const response = await fetch(`${domain}${path}`, init);
+  if (!response.ok)
+    fail(`${init?.method ?? 'GET'} ${path} returned ${response.status}.`);
+  return response.json();
+};
+
+const { accessToken } = await request('/v1/auth/universal-auth/login', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ clientId, clientSecret }),
+});
+
+const query = new URLSearchParams({
+  workspaceId,
+  environment,
+  secretPath: '/',
+  expandSecretReferences: 'true',
+  include_imports: 'true',
+});
+const { secrets, imports = [] } = await request(`/v3/secrets/raw?${query}`, {
+  headers: { Authorization: `Bearer ${accessToken}` },
+});
+
+// Imported secrets first so the environment's own values win.
+const values = new Map();
+for (const { secretKey, secretValue } of [
+  ...imports.flatMap((folder) => folder.secrets),
+  ...secrets,
+])
+  values.set(secretKey, secretValue);
+
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+for (const [key, value] of [...values].sort(([a], [b]) => a.localeCompare(b)))
+  process.stdout.write(`${key}=${quote(value)}\n`);

scripts/ci-install

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Install on a runner, and survive a half-written cache entry.
+#
+# Runners have failed twice with "Fail extracting tarball" on a different
+# package each time, on different machines, and passed on a re-run. The cache
+# is shared between jobs on a host, so a job that dies mid-write leaves an
+# entry the next job cannot read. Clearing it and installing again costs a
+# couple of minutes; a human re-running the job costs however long it takes
+# someone to notice.
+set -euo pipefail
+if bun install --frozen-lockfile; then exit 0; fi
+echo "Install failed. Clearing the bun cache and trying once more." >&2
+rm -rf "${BUN_INSTALL_CACHE_DIR:-$HOME/.bun/install/cache}"
+bun install --frozen-lockfile