The deploying pipeline stays on Forgejo, where the runner can reach the cluster.
This one only scans for secrets and runs vet, test and lint, so the mirrored
repo shows its own checks without ever needing a secret. Go steps no-op until
apps/api/go.mod exists.
Directory skeleton from the project plan, held open with .gitkeep so the layout
survives a clone. The .gitignore blocks credentials, kubeconfigs, terraform
state and local editor state, and keeps *-sealed.yaml committable since those
are encrypted on purpose.
