Wire up automated deploy via Gitea Releases + site-deployer watcher

.gitea/workflows/build.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+  releases: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -27,8 +31,38 @@ jobs:
           name: dist
           path: dist/
 
-      # Deploy step intentionally not wired up yet: this runner spins up
-      # ephemeral job containers (no host bind-mount for the workspace), so
-      # syncing dist/ to /mnt/e/sites/<site> needs an SSH deploy key added as
-      # a Gitea Actions secret. See repo README for the manual deploy steps
-      # used until that's set up.
+      # Publishes dist/ as a Gitea Release asset (tag "deploy") using the
+      # automatic per-job token - no secrets needed. A separate watcher
+      # container on octo-winsrv (site-deployer) polls this release and
+      # extracts it into /mnt/e/sites/<site>, which Caddy serves - see
+      # README "Deploy" section.
+      - name: Publish deploy release
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -e
+          command -v zip >/dev/null 2>&1 || (apt-get update -qq && apt-get install -y -qq zip)
+          command -v jq >/dev/null 2>&1 || (apt-get update -qq && apt-get install -y -qq jq)
+          (cd dist && zip -rq ../site.zip .)
+
+          # replace the previous "deploy" release/tag, if any, so exactly
+          # one always exists
+          curl -s -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+            "$API/releases/tags/deploy" >/dev/null || true
+          curl -s -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+            "$API/tags/deploy" >/dev/null || true
+
+          REL_ID="$(curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"deploy\",\"name\":\"deploy\",\"target_commitish\":\"${{ github.sha }}\",\"draft\":false,\"prerelease\":false}" \
+            "$API/releases" | jq -r '.id // empty')"
+          if [ -z "$REL_ID" ]; then
+            echo "::error::Failed to create deploy release"
+            exit 1
+          fi
+
+          curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
+            -F "attachment=@site.zip" \
+            "$API/releases/$REL_ID/assets?name=site.zip" >/dev/null