Sharang ParnerkarandClaude Fable 5
fa07b3bae0
Three defects left the deployment frozen on an Aug-06 image while five
RBAC merges landed on main:
1. The job-level `hashFiles('Dockerfile')` condition evaluates BEFORE
checkout, against an empty workspace — always '', so the job was
silently skipped on every push to main.
2. Had it run, it pushed only sha-* and env-stage tags; orca deploys
:latest, which nothing ever updated.
3. The final step ran `orca apply --env=stage` against a stage
environment this cluster does not have.
Now: condition without hashFiles (the Dockerfile is not optional),
:latest tagged alongside sha-*, and the deploy step replaced with the
HMAC-signed orca webhook the other repos use (registered on the master;
ORCA_WEBHOOK_SECRET set as a repo Actions secret).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>