- the repo's pre-certbot HTTP-only gitea/woodpecker confs CLOBBERED the
live SSL config on every cicd-playbook run, and the certbot task's
creates: guard meant TLS never came back — verified by live diff
2026-06-10. Both confs now carry the certbot 443 blocks + the live 1G
client_max_body_size, so the play converges instead of clobbering
- deploy-staging listed infra/** in when.path while its dependency
build-and-push did not → an infra-only push (1536fea) pruned
build-and-push but selected deploy-staging → "depends on unknown
step" config error (pipeline #385). deploy-staging's paths are now a
subset of its dependency chain's; ansible changes are applied by
hand, not CI, and a deploy without a fresh image is a no-op re-pull
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65dd18cdb7