Stop documenting a decommissioned host address as the DEPLOY_HOST example

[aterga]

Summary

Both workflows used ec2-user@10.118.0.61 as the example DEPLOY_HOST value. That address belonged to a staging instance that has since been deleted — and during an incident it was read off this workflow source and mistaken for live configuration, sending an infra engineer after a phantom MTU/MSS problem for half an hour while the real cause was elsewhere. A placeholder cannot be mistaken for config.

While replacing it, the description now states the requirement the example was silently failing to convey: the value must be the host's private address, not the public FQDN.

That is not hypothetical either. Staging's DEPLOY_HOST was the public hostname, which resolves to the public-facing interface, so staging's deploys were travelling over the internet rather than the VPN — the property #84 exists to provide. It went unnoticed until that interface's security group stopped permitting 22 and the deploy failed with a connection timeout. It is also what produced the misleading public source address that #91's whole "no stable CIDR exists" argument was built on.

Related issues

Item 4 of #101. Context for the private-vs-public requirement is on #91.

Changes

• deploy-native.yml: DEPLOY_HOST secret description → ec2-user@<private-ip>, plus why it must not be DEPLOY_DOMAIN's value.
• deploy-release.yml: same for PROD_DEPLOY_HOST in the header comment block.

No behaviour change — comments and a workflow_call secret description only.

Testing

• All three deploy workflows still parse as YAML.
• All five secrets still declared on deploy-native.yml's workflow_call, with unchanged required flags (DEPLOY_KNOWN_HOSTS false, rest true).
• git grep 10.118.0.61 over the tree returns nothing.
• Not run: cargo / npm — no source changed.

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change — this PR is the doc change.
• No secrets, credentials, or internal-only information are included — it removes an internal address rather than adding one.

Not in this PR

deploy/native/README.md's "Narrowing inbound SSH" section is the other half of this and needs a substantive rewrite, not a placeholder swap. It currently asserts that 22/tcp is still open to the world (closed as of today) and spends four paragraphs arguing that no narrower CIDR exists (the evidence for which was the artifact described above). Kept separate so that prose gets reviewed on its own rather than buried behind a two-line find-and-replace.

---

Generated by Claude Code

[Copilot]

Pull request overview

Updates deploy workflow documentation to remove a decommissioned internal host IP from example configuration and to explicitly document that deploy hosts must be specified via their private address (not a public FQDN) to ensure deploy traffic stays on the intended private network path.

Changes:

• Replaced the stale ec2-user@10.118.0.61 example with ec2-user@<private-ip>.
• Clarified (in both workflows) that *_DEPLOY_HOST must be the host’s private address and must not reuse the public *_DEPLOY_DOMAIN value.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/deploy-release.yml	Updates header comment docs for PROD_DEPLOY_HOST to use a non-real placeholder and clarify private-vs-public addressing.
.github/workflows/deploy-native.yml	Updates workflow_call secret description for DEPLOY_HOST to use a non-real placeholder and clarify private-vs-public addressing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.