Add a stage branch deploy beside production on z00.

Pushing stage runs CI and deploys to stage.transcribe.z00.nu with its own data, Reverb credentials, and Caddy network.

.gitea/workflows/ci.yml

@@ -4,12 +4,13 @@ on:
   push:
     branches:
       - main
+      - stage
   pull_request:
   workflow_dispatch:
 
 env:
   REGISTRY: gitea.z00.nu
-  # Baked into the Vite client bundle for production WebSockets.
+  # Fallback baked into the Vite bundle; public pages prefer Blade meta tags.
   VITE_REVERB_HOST: reverb.transcribe.z00.nu
   VITE_REVERB_PORT: "443"
   VITE_REVERB_SCHEME: https
@@ -47,6 +48,18 @@ jobs:
           APP_KEY="base64:dGVzdC1hcHAta2V5LWZvci1jaS1jb21wb3NlLXZhbGlkYXRpb24=" \
           docker compose -f docker-compose.yml -f compose.z00.yaml config --quiet
 
+      - name: Validate stage compose
+        run: |
+          set -euo pipefail
+          APP_IMAGE="${REGISTRY}/$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]'):test" \
+          APP_KEY="base64:dGVzdC1hcHAta2V5LWZvci1jaS1jb21wb3NlLXZhbGlkYXRpb24=" \
+          PUBLIC_APP_URL="https://stage.transcribe.z00.nu" \
+          APP_URL="https://stage.transcribe.z00.nu" \
+          REVERB_PUBLIC_HOST="reverb.stage.transcribe.z00.nu" \
+          CONTAINER_PREFIX="andytranscribe-stage" \
+          CADDY_NETWORK="andytranscribe-stage-caddy" \
+          docker compose -f docker-compose.yml -f compose.z00.yaml config --quiet
+
   build-and-push:
     if: gitea.event_name != 'pull_request'
     needs: test
@@ -70,6 +83,7 @@ jobs:
           REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
           TAG_SHA="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
           TAG_LATEST="${REGISTRY}/${REPO_LC}:latest"
+          TAG_STAGE="${REGISTRY}/${REPO_LC}:stage"
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ gitea.actor }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build \
             --build-arg VITE_APP_NAME=AndyTranscribe \
@@ -78,10 +92,15 @@ jobs:
             --build-arg "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
             --build-arg "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
             -t "${TAG_SHA}" \
-            -t "${TAG_LATEST}" \
             .
           docker push "${TAG_SHA}"
-          docker push "${TAG_LATEST}"
+          if [ "${{ gitea.ref }}" = "refs/heads/main" ]; then
+            docker tag "${TAG_SHA}" "${TAG_LATEST}"
+            docker push "${TAG_LATEST}"
+          elif [ "${{ gitea.ref }}" = "refs/heads/stage" ]; then
+            docker tag "${TAG_SHA}" "${TAG_STAGE}"
+            docker push "${TAG_STAGE}"
+          fi
 
   deploy:
     if: gitea.ref == 'refs/heads/main' && gitea.event_name != 'pull_request'
@@ -115,3 +134,36 @@ jobs:
             exit 0
           fi
           ./scripts/deploy-production.sh
+
+  deploy-stage:
+    if: gitea.ref == 'refs/heads/stage' && gitea.event_name != 'pull_request'
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          set -euo pipefail
+          HOST="${{ gitea.server_url }}"
+          HOST="${HOST#https://}"
+          HOST="${HOST#http://}"
+          git clone --depth 1 \
+            "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
+            .
+          git fetch --depth 1 origin "${{ gitea.sha }}"
+          git checkout --force "${{ gitea.sha }}"
+
+      - name: Deploy stage
+        env:
+          DEPLOY_PATHS: ${{ secrets.STAGE_DEPLOY_PATHS }}
+          DEPLOY_SHA: ${{ gitea.sha }}
+        run: |
+          set -euo pipefail
+          REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
+          export APP_IMAGE="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
+          chmod +x scripts/deploy-production.sh
+          if [ -z "${DEPLOY_PATHS:-}" ]; then
+            echo "STAGE_DEPLOY_PATHS secret is not set; skipping deploy."
+            echo "Built image: ${APP_IMAGE}"
+            exit 0
+          fi
+          ./scripts/deploy-production.sh