Add Gitea Actions workflow to auto-provision Coder templates

.gitea/workflows/coder-templates.yml pushes every templates/<env>/ dir
to Coder as profiles-<env> on every push to main that touches
templates/**, scripts/**, or profile-templates/** - coder templates push
creates the template on first run and updates it thereafter, so adding a
new templates/<env>/ directory is enough to provision it, no workflow
edits needed.

It also diffs templates/ against the previous commit and runs
`coder templates delete profiles-<env>` for any directory that was
removed. Deletion fails (loudly, as a job warning, not a hard failure)
rather than succeeding if the template still has active workspaces,
since coder templates delete already refuses that server-side.

Runs on the ubuntu-latest self-hosted Gitea runner already registered on
this instance (confirmed via gitea-runner-1's /data/.runner labels) and
installs the coder CLI itself. Needs CODER_URL and CODER_SESSION_TOKEN
as repo/org Actions secrets - documented in README, left for the user to
set up since token creation needs their own Coder login.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/coder-templates.yml

@@ -0,0 +1,80 @@
+name: Provision Coder Templates
+
+# Keeps Coder templates in sync with templates/*/ in this repo:
+#   - every push to main pushes a new version of each templates/<env>/ dir
+#     (coder templates push creates it if it doesn't exist yet, so adding a
+#     new templates/<env>/ directory is enough to provision a new one)
+#   - if a templates/<env>/ directory is removed on main, its template is
+#     deleted from Coder. `coder templates delete` refuses to delete a
+#     template that still has active workspaces, so this can't silently
+#     orphan running workspaces - it just fails loudly and needs a human.
+#
+# Requires two repo/org secrets (Settings > Actions > Secrets):
+#   CODER_URL             e.g. https://code.octoturge.com
+#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+#                          dedicated service account rather than a personal one
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "templates/**"
+      - "scripts/**"
+      - "profile-templates/**"
+      - ".gitea/workflows/coder-templates.yml"
+  workflow_dispatch: {}
+
+jobs:
+  provision:
+    runs-on: ubuntu-latest
+    env:
+      CODER_URL: ${{ secrets.CODER_URL }}
+      CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
+    steps:
+      - name: Checkout (full history, needed to detect removed templates)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install coder CLI
+        run: |
+          set -e
+          curl -fsSL https://coder.com/install.sh | sh
+          coder version
+
+      - name: Push (create or update) every template
+        run: |
+          set -e
+          for dir in templates/*/; do
+            name="profiles-$(basename "$dir")"
+            echo "::group::Pushing $name from $dir"
+            coder templates push "$name" -d "$dir" --yes \
+              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
+            echo "::endgroup::"
+          done
+
+      - name: Delete templates whose directory was removed
+        if: github.event_name == 'push'
+        run: |
+          set -e
+          PREV_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)"
+          if [ -z "$PREV_SHA" ]; then
+            echo "No previous commit on this branch (first push), nothing to diff. Skipping."
+            exit 0
+          fi
+
+          OLD_DIRS="$(git ls-tree -d --name-only "$PREV_SHA" -- templates 2>/dev/null | xargs -n1 basename 2>/dev/null || true)"
+          if [ -z "$OLD_DIRS" ]; then
+            echo "No templates/ directory at $PREV_SHA, nothing to diff. Skipping."
+            exit 0
+          fi
+
+          for old in $OLD_DIRS; do
+            if [ ! -d "templates/$old" ]; then
+              name="profiles-$old"
+              echo "::group::Deleting $name (templates/$old was removed)"
+              coder templates delete "$name" --yes \
+                || echo "::warning::Failed to delete $name - check for active workspaces still using it."
+              echo "::endgroup::"
+            fi
+          done

README.md

@@ -25,15 +25,17 @@ extensions/                 # Agent Skills bundles, installed per env (see below
 Each `templates/<env>/main.tf` is a complete, independent Coder template
 (agent, docker container, code-server, JetBrains). They're deliberately not
 built from a shared Terraform module - only their `locals` block differs
-(which profile file to read). Push them individually:
+(which profile file to read). The naming convention is `profiles-<dir>`
+(matches what `.gitea/workflows/coder-templates.yml` does automatically -
+see below). To push by hand:
 
 ```sh
-coder templates push profiles-default    -d templates/default
-coder templates push profiles-3d         -d templates/3d-printing
-coder templates push profiles-cobol      -d templates/cobol
-coder templates push profiles-python     -d templates/python
-coder templates push profiles-ttrpg      -d templates/ttrpg
-coder templates push profiles-web        -d templates/web
+coder templates push profiles-default      -d templates/default
+coder templates push profiles-3d-printing  -d templates/3d-printing
+coder templates push profiles-cobol        -d templates/cobol
+coder templates push profiles-python       -d templates/python
+coder templates push profiles-ttrpg        -d templates/ttrpg
+coder templates push profiles-web          -d templates/web
 ```
 
 ### How the VS Code profile gets applied
@@ -111,3 +113,40 @@ the `SPECIALTY_SKILLS` env var passed to the script from each template's
 - 3D Printing -> `openscad-parametric`
 - TTRPG -> `foundryvtt-modding` and `ttrpg-lore-weaver`
 - Default / Python / Web -> none (no matching specialty skill exists yet)
+
+### Auto-provisioning (Gitea Actions)
+
+`.gitea/workflows/coder-templates.yml` keeps Coder in sync with this repo on
+every push to `main` that touches `templates/**`, `scripts/**`, or
+`profile-templates/**`:
+
+- **Add** a new `templates/<env>/` directory -> next push creates a new
+  Coder template `profiles-<env>` automatically. No workflow edits needed.
+- **Edit** an existing `templates/<env>/main.tf` (or a shared script/profile
+  it references) -> next push updates that template with a new version.
+- **Remove** a `templates/<env>/` directory -> next push deletes
+  `profiles-<env>` from Coder. `coder templates delete` refuses if the
+  template still has active workspaces, so this fails loudly instead of
+  silently orphaning anyone's running workspace - that failure only shows up
+  as a `::warning::` in the job log, it doesn't fail the whole run.
+
+It runs on the `ubuntu-latest` self-hosted runner already registered on this
+Gitea instance and installs the `coder` CLI itself via `coder.com/install.sh`.
+
+**One-time setup required** (not something this workflow can do for itself -
+needs a human with Coder access):
+
+1. Create a Coder API token - ideally under a dedicated service account
+   rather than a personal login, since this token can create/delete
+   templates:
+   ```sh
+   coder login https://code.octoturge.com
+   coder tokens create --name gitea-ci --lifetime 8760h
+   ```
+2. In Gitea, go to this repo's **Settings -> Actions -> Secrets** (or the
+   org-level equivalent to share across repos) and add:
+   - `CODER_URL` = `https://code.octoturge.com`
+   - `CODER_SESSION_TOKEN` = the token printed by step 1
+
+Until those secrets exist, the workflow will run and fail cleanly at the
+`coder templates push` step rather than doing anything destructive.