[jung-thomas]

Problem

A full QA content rebuild fails at the final step "Guard - approuter serves referenced CSS + islands (QA)" with:

[check-approuter-assets] FAILED: missing --approuter-url

The step sets APPROUTER_URL: ${{ secrets.APPROUTER_URL_QA }}, but there is no APPROUTER_URL_QA secret — the repo has only APPROUTER_URL_DEV and APPROUTER_URL_PROD. The reference resolves to an empty string, so the guard aborts. (This is independent of the #2917 CSS-build fix, which works — the QA Hugo build now passes head.html:27.)

Root cause

QA is a feature of production, not a separate environment. /tutorials-qa/* is routed by the main (prod) approuter — approuter/xs-app.json sends it to the srv-qa-api destination (the tutorials-srv-qa app in the prod MTA). So the QA HTML is dressed by the PROD approuter, and the asset guard — which probes the approuter serving that HTML — must target the PROD approuter.

Fix

APPROUTER_URL: ${{ secrets.APPROUTER_URL_QA }} → ${{ secrets.APPROUTER_URL_PROD }}, with a comment explaining the QA-is-prod routing so it isn't "corrected" back later.

Impact / safety

• The guard runs before the HANA publish, so the failing runs published nothing — no QA content was poisoned; the channel simply didn't refresh.
• No runtime/srv change; one env line in one CI workflow.

Verification

• yq confirms the step's env.APPROUTER_URL now resolves to secrets.APPROUTER_URL_PROD.
• Routing confirmed in approuter/xs-app.json (^/tutorials-qa/(.*)$ → srv-qa-api).

Follow-up once merged + promoted to main: re-run the full QA rebuild to confirm the guard passes and QA content refreshes.

🤖 Generated with Claude Code