From d7960276b1745ebe0c3ef5e44c0743bf06e9d836 Mon Sep 17 00:00:00 2001
From: Light1YT <evileyecreation@gmail.com>
Date: Tue, 9 Jun 2026 18:14:12 +0500
Subject: [PATCH] =?UTF-8?q?chore(deploy):=20wire=20OWN=5FDEVELOPER=5FIDS?=
 =?UTF-8?q?=20into=20prod=20env=20for=20=C2=A725.3=20own-portfolio=20(#116?=
 =?UTF-8?q?9)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirror the LLM_ENABLED wiring for OWN_DEVELOPER_IDS (own-portfolio
cannibalization, #1169): forward vars.OWN_DEVELOPER_IDS into the SSH deploy
(env block + envs list) and write it to backend/.env.runtime ONLY when
non-empty (conditional, like OPENAI_API_KEY/LLM_ENABLED). Non-sensitive
(public companyGroup ids) → actions variable. Unset → cannibalization keeps
the proxy (dormant). No literal id in the workflow (refs only).

Captures in the pipeline the value already set live on prod via .env.runtime
(OWN_DEVELOPER_IDS=6208 = PRINZIP, verified against domrf_kn → 28 projects).
Owner must set Forgejo Variable OWN_DEVELOPER_IDS=6208 for full pipeline
management; meanwhile the .env.runtime line holds (survives git reset).

Refs #1169
---
 .forgejo/workflows/deploy.yml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 0c883480..f3529b40 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -170,12 +170,16 @@ jobs:
           # boolean toggle → actions variable (vars.*).
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           LLM_ENABLED: ${{ vars.LLM_ENABLED }}
+          # OWN_DEVELOPER_IDS (#1169 §25.3): свои developer_id (companyGroup) для
+          # own-portfolio каннибализации. Non-sensitive (публичные id) → actions
+          # variable. UNSET → каннибализация отдаёт proxy (фича дормант).
+          OWN_DEVELOPER_IDS: ${{ vars.OWN_DEVELOPER_IDS }}
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           port: ${{ secrets.DEPLOY_PORT }}
-          envs: IMAGE_TAG,SENTRY_RELEASE_VAL,GHCR_PAT,GLITCHTIP_BACKEND_DSN,OBJECTIVE_API_KEY,OPENAI_API_KEY,LLM_ENABLED
+          envs: IMAGE_TAG,SENTRY_RELEASE_VAL,GHCR_PAT,GLITCHTIP_BACKEND_DSN,OBJECTIVE_API_KEY,OPENAI_API_KEY,LLM_ENABLED,OWN_DEVELOPER_IDS
           script: |
             set -euo pipefail
             cd /opt/gendesign
@@ -233,6 +237,16 @@ jobs:
                     printf 'LLM_ENABLED=%s\n' "$LLM_ENABLED" >> backend/.env.runtime
                 fi
             fi
+            # OWN_DEVELOPER_IDS (#1169 §25.3 own-portfolio каннибализация). Тоже
+            # conditional-on-non-empty: UNSET var → не трогаем (если строка уже есть
+            # в .env.runtime — она переживает git reset, .gitignored — остаётся).
+            if [ -n "${OWN_DEVELOPER_IDS:-}" ]; then
+                if grep -q '^OWN_DEVELOPER_IDS=' backend/.env.runtime; then
+                    sed -i "s|^OWN_DEVELOPER_IDS=.*|OWN_DEVELOPER_IDS=$OWN_DEVELOPER_IDS|" backend/.env.runtime
+                else
+                    printf 'OWN_DEVELOPER_IDS=%s\n' "$OWN_DEVELOPER_IDS" >> backend/.env.runtime
+                fi
+            fi
             chmod 600 backend/.env.runtime
 
             # External network для Caddy + obsidian-stack share