Address Review Findings from the Develop-to-Main Promotion PR

.secrets/README.md

@@ -7,7 +7,7 @@ exposing one.
 
 ## Real values live on the host, never in the checkout
 
-Every real value this repo's scripts read comes from `~/.secrets/`, not from this directory.
+Every real value a local invocation of this repo's scripts reads comes from `~/.secrets/`, not from this directory. CI supplies the same values directly from the GitHub Environment instead, reading no file here at all.
 `ENV_FILE=<name> deploy/make-release.sh` and `ops/install.sh` both resolve a relative `ENV_FILE`
 against `$HOME/.secrets`, refuse a traversing one, and default to
 `~/.secrets/Blog.local.production.env`. `~/.secrets/` is shared across every repo on the host,

OPERATIONS.md

@@ -77,11 +77,11 @@ So release to the local mirror and run the live check **before** opening a pull
 
 ```sh
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-deploy/make-release.sh
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
 checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 
-Against the staging mirror, name its file in both places, since the sourced values and the ones `make-release.sh` reads must describe the same environment:
+Name the file in both places, even when it is the default, since `make-release.sh` sources `ENV_FILE` independently of the shell above and a value already exported earlier in the same session would otherwise win silently over the sourced one:
 
 ```sh
 set -a; . ~/.secrets/Blog.local.staging.env; set +a
@@ -142,8 +142,9 @@ Three properties of how the credential is handled, each there for a reason worth
 ## Deploying
 
 ```sh
-SITE_BASE_URL=<base-url> deploy/make-release.sh <deploy-root> "$(git rev-parse --short HEAD)"
-checks/check-live-urls.sh <base-url>
+RELEASE="$(git rev-parse --short HEAD)"
+SITE_BASE_URL=<base-url> deploy/make-release.sh <deploy-root> "$RELEASE"
+EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh <base-url>
 ```
 
 The deploy root and the base URL are the only host-specific values. A local run reads them from a file under `~/.secrets/`, one per environment, copied from [`.secrets/example.env`](./.secrets/example.env), and CI passes both explicitly. The real files live on the host, never in this checkout.

README.md

@@ -179,7 +179,7 @@ Build a release and verify it against a running server:
 
 ```sh
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-deploy/make-release.sh
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
 checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 

deploy/README.md

@@ -54,7 +54,7 @@ neither. Seven facts are the whole contract:
 
 ```sh
 set -a; . ~/.secrets/Blog.local.production.env; set +a
-deploy/make-release.sh
+ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
 checks/check-live-urls.sh "$SITE_BASE_URL"
 ```
 

ops/install.sh

@@ -91,7 +91,7 @@ MOUNT=$(findmnt -no TARGET --target "$ANCESTOR" 2>/dev/null) ||
 
 VPS_TRAEFIK_ARCHIVE=${VPS_TRAEFIK_LOG_ARCHIVE:-/var/log/traefik/archive}
 
-printf '=== derived from %s\n' "${ENV_FILE/#"$HOME"/\~}"
+printf '=== derived from %s\n' "${ENV_FILE/#"$HOME"\//\~/}"
 note "VPS_SSH_HOST         $VPS_SSH_HOST"
 note "BACKUP_ARCHIVE_ROOT  $BACKUP_ARCHIVE_ROOT"
 note "LOG_ARCHIVE_ROOT     $LOG_ARCHIVE_ROOT"
@@ -105,7 +105,7 @@ DROPIN_DEST=$DROPIN_DIR/local.conf
 
 ENV_BODY=$(
 	cat <<EOF
-# Generated by ops/install.sh from ${ENV_FILE/#"$HOME"/\~}. Re-run that rather than editing
+# Generated by ops/install.sh from ${ENV_FILE/#"$HOME"\//\~/}. Re-run that rather than editing
 # here, or this copy and the one the log review reads stop agreeing and nothing reports it.
 VPS_SSH_HOST=$VPS_SSH_HOST
 VPS_ARCHIVE_DIR=${VPS_ARCHIVE_DIR:-/var/backups/pangolin}