Actions builds can't fetch api-internal; pre-commit hook calls removed bd sync #614

Actions can't build the image

main-build-and-push.yaml and shipit.yaml have failed on every run since 2026-08-31. npm can't authenticate to the private humanlogio/api-internal.

Since c64e9f8, the Dockerfile fetches api-internal over a forwarded SSH agent (RUN --mount=type=ssh npm ci) instead of a GITHUB_TOKEN build-arg. The token was printed in plain build logs, and git over HTTPS now rejects it with a 401. The two workflows no longer pass the token, but they still won't build until:

• a read-only deploy key for api-internal is added as a repo secret;
• a webfactory/ssh-agent step (or similar) loads it;
• docker build gets --ssh default, or script/build is used, which already passes it.

Also:

• main-build-and-push.yaml dispatches the tag bump to humanlogio/deploy, which ArgoCD no longer watches. Prod is in hcorpinc/deploy; see ci: dispatch image tag bumps to hcorpinc/deploy #613.
• shipit.yaml never bumps the deploy repo.
• pr.yaml and lint.yaml fetch api-internal through their own HTTPS insteadOf rule with PRIVATE_REPO_ACCESS_TOKEN. Check that secret still works, or move them to the deploy key.

Until this is fixed, prod is built and pushed by hand: docker build --ssh default --platform linux/amd64 …, then script/set_humanlogio_tag.sh in hcorpinc/deploy.

Pre-commit hook

.beads hooks run bd sync --flush-only. bd 0.61.0 removed sync, so every commit fails unless it's made with --no-verify.

• Update or remove the hook.