perf(web-app-discourse): pin the launcher and plugins to commits

discourse_docker tracked main, so every upstream push changed the git pull and rebuilt the image: 1029 s of the 2338 s full-4 deploy on echoserver. The launcher and the upstream plugins are pinned to their current branch tips; the git task fetches the pinned commit by refspec, and the plugin hook fetches a single commit instead of cloning a branch, which works for commits and branch names alike. The dead budget-derived UNICORN_WORKERS line is dropped: YAML kept the later 8, and the budget value would be 55 to 200 workers because split_postgres_connections no longer finds a postgres role.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/web-app-discourse/meta/addons/discourse-activity-pub.yml

@@ -10,4 +10,4 @@ update:
   upstream_id: discourse-activity-pub
 config:
   repository: https://github.com/discourse/discourse-activity-pub.git
-  ref: main
+  ref: d89d1b0131bbce4dc4102b1409f797be39b41961

roles/web-app-discourse/meta/addons/discourse-akismet.yml

@@ -10,4 +10,4 @@ update:
   upstream_id: discourse-akismet
 config:
   repository: https://github.com/discourse/discourse-akismet.git
-  ref: main
+  ref: 21ff08f0f1bd1bb4ea5773ceb0691f267fee0b2f

roles/web-app-discourse/meta/addons/discourse-ldap-auth.yml

@@ -8,7 +8,7 @@ bridges:
 version: "master"
 config:
   repository: https://github.com/jonmbake/discourse-ldap-auth.git # nocheck: repository-declared
-  ref: master
+  ref: 9776c1d021696e5bfdb8857093b8434063bc6ae1
   site_settings:
     ldap_auth_enabled: true
     ldap_sync_enabled: true

roles/web-app-discourse/meta/addons/docker_manager.yml

@@ -10,4 +10,4 @@ update:
   upstream_id: docker_manager
 config:
   repository: https://github.com/discourse/docker_manager.git
-  ref: main
+  ref: 8b136890f945828646c97212583b74ecfd07def5

roles/web-app-discourse/meta/services.yml

@@ -66,7 +66,7 @@ discourse:
   shared: true
   enabled: true # nocheck: dynamic-flag
   name: discourse
-  ref: main
+  ref: 775903891a8c34e87de66f747bd98ea48fa32eff
   min_storage: 15GB
   repository: https://github.com/discourse/discourse_docker.git
   application:

roles/web-app-discourse/tasks/03_launcher.yml

@@ -8,6 +8,7 @@
     repo: "{{ DISCOURSE_REPOSITORY_URL }}"
     dest: "{{ DISCOURSE_REPOSITORY_DIR }}"
     version: "{{ DISCOURSE_REF }}"
+    refspec: "{{ DISCOURSE_REF }}"
     update: true
     depth: 1
   register: discourse_repo_pull

roles/web-app-discourse/templates/config.yml.j2

@@ -38,7 +38,6 @@ env:
 
   DB_POOL:            "{{ POSTGRES_ALLOWED_AVG_CONNECTIONS }}"
   RAILS_MAX_THREADS:  "{{ [ (POSTGRES_ALLOWED_AVG_CONNECTIONS | int), 5 ] | min }}"
-  UNICORN_WORKERS:    "{{ [ (POSTGRES_ALLOWED_AVG_CONNECTIONS | int) // 2, 1 ] | max }}"
 
 
   ## How many concurrent web requests are supported? Depends on memory and CPU cores.
@@ -137,7 +136,11 @@ hooks:
         cmd:
 {% for plugin_name, plugin_config in DISCOURSE_PLUGINS.items() %}
 {% if plugin_config.enabled and plugin_config.source != 'bundled' %}
-          - git clone --depth=1 --branch {{ plugin_config.config.ref }} {{ plugin_config.config.repository }}
+{% set plugin_dir = plugin_config.config.repository | basename | regex_replace('\.git$', '') %}
+          - git init {{ plugin_dir }}
+          - git -C {{ plugin_dir }} remote add origin {{ plugin_config.config.repository }}
+          - git -C {{ plugin_dir }} fetch --depth=1 origin {{ plugin_config.config.ref }}
+          - git -C {{ plugin_dir }} checkout FETCH_HEAD
 {% endif %}
 {% endfor %}