55 Commits

Author	SHA1	Message	Date
Will Anderson	654b977796	ci: fall back to GCP_SA_KEY (Gitea doesn't inject OIDC request token) ... Gitea Actions doesn't currently inject ACTIONS_ID_TOKEN_REQUEST_TOKEN / ACTIONS_ID_TOKEN_REQUEST_URL into job env, so google-github-actions/auth can't mint a federated token. The WIF infrastructure stays in Terraform so we can flip back once that gap closes; the JSON key in GCP_SA_KEY is the working path today.	2026-05-02 12:58:06 -05:00
Will Anderson	00a63a202c	ci: replace second actions/checkout with raw git clone for engram-lang ... act_runner v0.6 host-mode hits a 'permission denied' error on .git/objects/pack/*.idx when running two checkout steps in the same job. Drop down to a plain git clone of engram-lang and pin EL_HOME outside the workspace.	2026-05-02 12:57:25 -05:00
Will Anderson	4629796a75	ci: use CHECKOUT_TOKEN repo secret for cross-repo engram-lang checkout ... The auto-issued GITHUB_TOKEN is scoped to the current repo only, so cross-repo actions/checkout needs an explicit token. CHECKOUT_TOKEN holds an admin-scoped Gitea API token; long-term we should switch to a dedicated read-only PAT.	2026-05-02 12:54:35 -05:00
Will Anderson	248ff89230	ci: use GITHUB_TOKEN for cross-repo engram-lang checkout ... Gitea Actions auto-issues GITHUB_TOKEN per workflow run; the previous GITEA_TOKEN reference evaluated to literal text and broke the checkout.	2026-05-02 12:52:49 -05:00
Will Anderson	b29ac61005	ci: add Gitea Actions deploy workflow for Cloud Run ... Push to main triggers build-stage.sh, push to Artifact Registry, parallel deploy to all 3 marketing prod regions, traffic flip, verify. Auth via Workload Identity Federation against the Gitea OIDC provider — no long-lived keys on the runner. Falls back to GCP_SA_KEY repo secret if WIF doesn't work end to end against this Gitea instance.	2026-05-02 12:44:51 -05:00