fix(ci): compare staged vs HEAD when deciding to commit gitops update

git diff --quiet (no --cached) compares the working tree to the index,
not the index to HEAD. It ran right after git add, at which point the
working tree always matches the index - so it reported "no changes"
unconditionally, on every single run, regardless of whether the sed
substitution actually changed anything relative to HEAD. This silently
skipped the gitops commit+push every time (job still exited 0), which
is why the deployed digest never advanced across ~15 build runs.
Switched to git diff --cached --quiet, and added step-by-step echo
diagnostics so a future silent failure is visible in the run log
instead of just vanishing between two log lines.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -84,16 +84,21 @@ jobs:
           DIGEST: ${{ env.IMAGE_DIGEST }}
         run: |
           set -euo pipefail
+          echo "[gitops] DIGEST=${DIGEST:-<empty>} SHA=${SHA:-<empty>}"
+          test -n "${DIGEST:-}"
           apk add --no-cache git
+          echo "[gitops] git installed: $(git --version)"
 
           git config --global credential.helper '!f() { printf "%s\\n" "username=forgejo-actions"; printf "%s\\n" "password=$GITOPS_TOKEN"; }; f'
 
           GITOPS_DIR=$(mktemp -d)
+          echo "[gitops] cloning into $GITOPS_DIR"
           # -b main: this repo's server-side HEAD symref is broken (returns
           # "remote HEAD refers to nonexistent ref" on a plain clone even
           # though refs/heads/main exists) - an explicit branch bypasses
           # HEAD resolution entirely instead of relying on it.
           git clone -b main "$GITOPS_REPO" "$GITOPS_DIR"
+          echo "[gitops] clone done"
           cd "$GITOPS_DIR"
 
           # release-patch.yaml pins by digest (@sha256:...), not by mutable
@@ -103,8 +108,17 @@ jobs:
           # clobbering this step's commits every ~2 minutes. The marker was
           # removed from the file so this CI step is now the sole writer.
           sed -i -E "s#image: ci\.nxtgauge\.com/ashwin/nxtgauge-ai-assistant(:[a-f0-9]+|@sha256:[a-f0-9]+)#image: ci.nxtgauge.com/ashwin/nxtgauge-ai-assistant@${DIGEST}#" apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
+          echo "[gitops] after sed:"
+          cat apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
 
           git config user.name "forgejo-actions[bot]"
           git config user.email "forgejo-actions@ci.nxtgauge.com"
           git add apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml
-          git diff --quiet || (git commit -m "chore(gitops): deploy ai-assistant@${SHA} (${DIGEST})" && git push)
+          if git diff --cached --quiet; then
+            echo "[gitops] no changes to commit"
+          else
+            echo "[gitops] committing and pushing"
+            git commit -m "chore(gitops): deploy ai-assistant@${SHA} (${DIGEST})"
+            git push
+            echo "[gitops] push exit code: $?"
+          fi