Deploy Tabularium on ces-control with verified image reuse and persistent caches

.gitea/workflows/ci-deploy.yml

@@ -0,0 +1,33 @@
+name: Verify and deploy Tabularium
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: tabularium-${{ gitea.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify-and-deploy:
+    runs-on: ces-control
+    timeout-minutes: 45
+    env:
+      DOCKER_BUILDKIT: "0"
+      CI_CACHE_SCOPE: ${{ gitea.event_name == 'pull_request' && format('pr-{0}', gitea.event.pull_request.number) || 'main' }}
+    steps:
+      - name: Checkout project
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          persist-credentials: false
+      - name: Verify with persistent caches or reuse verified image
+        run: python3 scripts/ci.py
+      - name: Deploy latest main with health checks and rollback
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name != 'pull_request'
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_TOKEN: ${{ gitea.token }}
+          TABULARIUM_RELEASE_SHA: ${{ gitea.sha }}
+        run: python3 scripts/deploy.py