fix(deploy): sync hub signing secret before capture #251

Merged

gmackie merged 1 commit from fix/deploy-sync-hub-secret into main

2026-08-05 11:18:08 +00:00

gmackie commented

2026-08-05 11:09:45 +00:00

Owner

What changed

make the command-hub signing secret an explicit required deployment input
sync that secret to the Cloudflare Worker immediately after code deployment
record the active Worker version only after the secret deployment
assert the sync occurs before unattended capture configuration

Root cause

Deploy run 1279 upgraded the hub, reconnected both production nodes, deployed a healthy Worker, then failed because the Worker had a stale hub signing secret and /api/fg/hub-token returned 502. The active hub secret is now stored in ForgeGraph's encrypted production secret store and the matching Forgejo Actions secret.

Verification

targeted public-feed workflow test: 6 passed
Prettier check
workflow YAML parse

## What changed - make the command-hub signing secret an explicit required deployment input - sync that secret to the Cloudflare Worker immediately after code deployment - record the active Worker version only after the secret deployment - assert the sync occurs before unattended capture configuration ## Root cause Deploy run 1279 upgraded the hub, reconnected both production nodes, deployed a healthy Worker, then failed because the Worker had a stale hub signing secret and `/api/fg/hub-token` returned 502. The active hub secret is now stored in ForgeGraph's encrypted production secret store and the matching Forgejo Actions secret. ## Verification - targeted public-feed workflow test: 6 passed - Prettier check - workflow YAML parse

gmackie added the

forgegraph:public-update

label

2026-08-05 11:09:45 +00:00

gmackie added 1 commit

2026-08-05 11:09:45 +00:00