ci: align deployment workflow with Gitea

Use native Gitea contexts, audit the full dependency tree, and document the runner and branch-protection requirements needed for reliable deployments.

.gitea/workflows/ci-cd.yml

@@ -2,6 +2,8 @@ name: Test and deploy
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
@@ -38,16 +40,16 @@ jobs:
         run: npm test
 
       - name: Audit production dependencies
-        run: npm audit --omit=dev --audit-level=high
+        run: npm audit --audit-level=high
 
   deploy:
     name: Deploy production
     needs: verify
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 20
-    environment: production
     env:
+      RELEASE_ID: ${{ gitea.sha }}
       DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
       DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
       DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
@@ -67,8 +69,6 @@ jobs:
           : "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
           : "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
           : "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"
-          DEPLOY_PORT="${DEPLOY_PORT:-22}"
-          echo "DEPLOY_PORT=$DEPLOY_PORT" >> "$GITHUB_ENV"
 
           install -d -m 700 "$HOME/.ssh"
           printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
@@ -82,14 +82,15 @@ jobs:
           set -Eeuo pipefail
           git archive \
             --format=tar.gz \
-            --output="$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \
+            --output="$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
             HEAD
 
       - name: Upload and activate release
         shell: bash
         run: |
           set -Eeuo pipefail
-          remote_archive="/tmp/portfolio-$GITHUB_SHA.tar.gz"
+          DEPLOY_PORT="${DEPLOY_PORT:-22}"
+          remote_archive="/tmp/portfolio-$RELEASE_ID.tar.gz"
           ssh_options=(
             -i "$HOME/.ssh/deploy_key"
             -o BatchMode=yes
@@ -102,12 +103,12 @@ jobs:
             -o BatchMode=yes \
             -o StrictHostKeyChecking=yes \
             -P "$DEPLOY_PORT" \
-            "$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \
+            "$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
             "$DEPLOY_USER@$DEPLOY_HOST:$remote_archive"
 
           printf -v remote_command \
             'bash -s -- %q %q %q' \
-            "$DEPLOY_PATH" "$GITHUB_SHA" "$remote_archive"
+            "$DEPLOY_PATH" "$RELEASE_ID" "$remote_archive"
 
           ssh "${ssh_options[@]}" \
             "$DEPLOY_USER@$DEPLOY_HOST" \

DEPLOYMENT.md

@@ -9,6 +9,18 @@ Releases are stored in `<DEPLOY_PATH>/releases/<commit-sha>`. The `current`
 symlink is changed only after the new container is healthy. If startup fails,
 the deployment script automatically rebuilds and starts the previous release.
 
+## Gitea Actions setup
+
+Enable **Repository Actions** in the repository settings and register a trusted
+Gitea Runner. The workflow uses the `ubuntu-latest` label; that runner image must
+provide Bash, Git, `tar`, OpenSSH (`ssh` and `scp`), and standard GNU utilities.
+Node.js 22 is installed by the workflow.
+
+After the first successful verification run, protect `main` in Gitea and make
+the **Verify production build** status check required. This prevents a pull
+request from merging when linting, type-checking, tests, the production build,
+or the dependency audit fails.
+
 ## Gitea repository secrets
 
 Add these secrets under the repository's **Settings > Actions > Secrets**: