feat!: domain split by default, plus the October dependency batch

.github/dependabot.yml

@@ -10,7 +10,8 @@ updates:
     open-pull-requests-limit: 8
     labels: ["dependencies"]
     commit-message:
-      prefix: "chore(deps)"
+      # include: scope appends (deps) or (deps-dev), giving chore(deps): ...
+      prefix: "chore"
       include: scope
     cooldown:
       default-days: 7
@@ -61,7 +62,8 @@ updates:
     open-pull-requests-limit: 8
     labels: ["dependencies"]
     commit-message:
-      prefix: "chore(deps)"
+      # include: scope appends (deps) or (deps-dev), giving chore(deps): ...
+      prefix: "chore"
       include: scope
     cooldown:
       default-days: 7
@@ -102,7 +104,8 @@ updates:
     open-pull-requests-limit: 4
     labels: ["dependencies"]
     commit-message:
-      prefix: "chore(deps)"
+      # include: scope appends (deps) or (deps-dev), giving chore(deps): ...
+      prefix: "chore"
       include: scope
     cooldown:
       default-days: 7
@@ -120,31 +123,11 @@ updates:
       # which is not exported by Astro 5). Stay on 12.x until we bump Astro.
       - dependency-name: "@astrojs/cloudflare"
         update-types: ["version-update:semver-major"]
-
-  # Shared workspace packages under packages/. The glob matches nothing when the
-  # directory is absent, so products without packages/ get no entry in effect.
-  - package-ecosystem: bun
-    directories:
-      - /packages/*
-    schedule:
-      interval: weekly
-      day: monday
-      time: "09:00"
-      timezone: Europe/Berlin
-    open-pull-requests-limit: 4
-    labels: ["dependencies"]
-    commit-message:
-      prefix: "chore(deps)"
-      include: scope
-    cooldown:
-      default-days: 7
-    groups:
-      production-dependencies:
-        dependency-type: "production"
-        patterns: ["*"]
-      development-dependencies:
-        dependency-type: "development"
-        patterns: ["*"]
+      # astro-mermaid declares a peer of mermaid ^10 || ^11, and mermaid 12
+      # pulls lodash-es 4.17.23 (GHSA-r5fr-rjxr-66jc) through chevrotain's
+      # exact pin. Move together once astro-mermaid supports 12.
+      - dependency-name: "mermaid"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: bun
     directory: /apps/site
@@ -156,7 +139,8 @@ updates:
     open-pull-requests-limit: 4
     labels: ["dependencies"]
     commit-message:
-      prefix: "chore(deps)"
+      # include: scope appends (deps) or (deps-dev), giving chore(deps): ...
+      prefix: "chore"
       include: scope
     cooldown:
       default-days: 7
@@ -167,6 +151,10 @@ updates:
       development-dependencies:
         dependency-type: "development"
         patterns: ["*"]
+    ignore:
+      # astro check does not support TypeScript 7 yet.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/apps-api-ci.yml

@@ -136,7 +136,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: steps.filter.outputs.code == 'true'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: apps/api/coverage/lcov.info
           flags: api

.github/workflows/apps-api-release.yml

@@ -39,7 +39,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -68,7 +68,7 @@ jobs:
             wud.watch=true
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod

.github/workflows/apps-ui-release.yml

@@ -75,7 +75,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -104,7 +104,7 @@ jobs:
             wud.watch=true
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/ui
           file: apps/ui/Dockerfile.prod

.github/workflows/apps-ui-validate.yml

@@ -77,7 +77,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: steps.filter.outputs.code == 'true'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: apps/ui/coverage/lcov.info
           flags: ui

.github/workflows/infra-compose-validate-compose.yml

@@ -485,11 +485,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.filter.outputs.code == 'true'
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build apps/api prod image
         if: steps.filter.outputs.code == 'true'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/api
           file: apps/api/Dockerfile.prod
@@ -501,7 +501,7 @@ jobs:
 
       - name: Build apps/ui prod image
         if: steps.filter.outputs.code == 'true'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: apps/ui
           file: apps/ui/Dockerfile.prod

.github/workflows/pr-title.yml

@@ -27,4 +27,5 @@ jobs:
       - name: Check the title
         env:
           TITLE: ${{ github.event.pull_request.title }}
+          COMMIT_TITLE_MAX_LENGTH: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && '200' || '100' }}
         run: bash scripts/ci/check-commit-title.sh "$TITLE"

.github/workflows/production-release.yml

@@ -31,6 +31,10 @@ permissions:
 
 jobs:
   release:
+    # Off until an operator opts in. A fresh template has no cluster, and an
+    # older install may still run argocd-image-updater, which would overwrite
+    # the coordinated digests. See infra/k3s/README.md for the activation steps.
+    if: vars.PRODUCTION_RELEASE_MODE == 'coordinated'
     # Do not compete with PR checks for self-hosted runners.
     runs-on: ubuntu-24.04
     timeout-minutes: 90
@@ -39,14 +43,6 @@ jobs:
       actions: read
       packages: write
     steps:
-      - name: Require coordinated deployment activation
-        env:
-          RELEASE_MODE: ${{ vars.PRODUCTION_RELEASE_MODE }}
-        run: |
-          if [ "$RELEASE_MODE" != coordinated ]; then
-            echo '::error::Remove the argocd-image-updater annotations from the live Argo Application, then set PRODUCTION_RELEASE_MODE=coordinated. See infra/k3s/README.md.'
-            exit 1
-          fi
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0

.tsforge/scaffold-manifest.json

@@ -72,10 +72,14 @@
       "key": "WITH_SITE",
       "kind": "toggle",
       "group": "infra",
-      "label": "Public marketing site (apps/site). Dev: Astro dev server on 7333. Prod: static site on the apex host, app on app.<domain>",
+      "label": "Public marketing site (apps/site). Dev: Astro dev server on 7333. Prod: static site on the apex host, app on app.<domain>. Set 0 for the single-host layout.",
       "devDefault": "1",
-      "prodDefault": "0",
-      "addsServices": { "1": ["site-dev", "site"] }
+      "prodDefault": "1",
+      "addsServices": { "1": ["site-dev", "site"] },
+      "requiresSecrets": {
+        "1": ["PUBLIC_SITE_HOST", "SITE_CONTACT_EMAIL", "SITE_IMAGE_TAG"]
+      },
+      "requiresSecretsProdOnly": true
     },
     {
       "key": "WUD",