fix: staging deploy via needs no CI, não workflow_run

workflow_run nunca disparou no Gitea 1.24 com CI multi-job.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -275,3 +275,18 @@ jobs:
 
           docker logs "$HEALTH_NAME"
           exit 1
+
+  # Staging deploy runs in-process after gates. workflow_run never fired on
+  # this Gitea 1.24 multi-job CI setup (0 deploy runs after green CI).
+  deploy-staging:
+    name: deploy-staging
+    needs: [static, unit, feature, browser, container]
+    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+    uses: ./.gitea/workflows/deploy-staging.yml
+    secrets:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+      DOKPLOY_URL: ${{ secrets.DOKPLOY_URL }}
+      DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
+      DOKPLOY_STAGING_COMPOSE_ID: ${{ secrets.DOKPLOY_STAGING_COMPOSE_ID }}
+      STAGING_URL: ${{ secrets.STAGING_URL }}

.gitea/workflows/deploy-staging.yml

@@ -1,10 +1,11 @@
 name: Deploy staging
 
+# Invoked from ci.yml after all gates pass on main (workflow_call).
+# workflow_run is unreliable on Gitea 1.24 with multi-job CI (never fired).
+# workflow_dispatch keeps a manual re-deploy path.
 on:
-  workflow_run:
+  workflow_call:
-    workflows: [CI]
+  workflow_dispatch:
-    types: [completed]
-    branches: [main]
 
 permissions:
   contents: read
@@ -21,21 +22,15 @@ env:
 jobs:
   deploy:
     name: publish-and-deploy-staging
-    if: >-
-      gitea.event.workflow_run.conclusion == 'success' &&
-      gitea.event.workflow_run.event == 'push' &&
-      gitea.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout deployed SHA
+      - name: Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ gitea.event.workflow_run.head_sha }}
 
       - name: Set image metadata
         id: meta
         run: |
-          SHA="${{ gitea.event.workflow_run.head_sha }}"
+          SHA="${{ gitea.sha }}"
           SHORT_SHA="${SHA:0:7}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           IMAGE="$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')"

docs/deployment/dokploy.md

@@ -154,13 +154,15 @@ Parallel CI jobs need the act_runner `config.yaml` to keep `container.network` *
 
 ### Staging (automatic)
 
-[`.gitea/workflows/deploy-staging.yml`](../../.gitea/workflows/deploy-staging.yml)
+Job `deploy-staging` in [`.gitea/workflows/ci.yml`](../../.gitea/workflows/ci.yml) (reusable [`.gitea/workflows/deploy-staging.yml`](../../.gitea/workflows/deploy-staging.yml)).
 
-1. Waits for workflow `CI` success (`workflow_run`) on push to `main`.
+1. Runs only on push to `main`, after `static`/`unit`/`feature`/`browser`/`container` all succeed (`needs:`). Do **not** rely on `workflow_run` here — it did not fire on Gitea 1.24 with multi-job CI.
 2. Builds once; pushes `:<full-sha>` and `:staging` to the Gitea registry.
 3. Calls Dokploy `compose.deploy` and polls until done.
 4. Runs [`scripts/deploy/smoke.sh`](../../scripts/deploy/smoke.sh) against `STAGING_URL`.
 
+Manual re-deploy: **Actions → Deploy staging → Run workflow** (`workflow_dispatch`).
+
 ### Production (manual)
 
 [`.gitea/workflows/promote-production.yml`](../../.gitea/workflows/promote-production.yml)