feat: implement full CI/CD pipeline with staged deployments

- PR workflow: build, deploy to CI site, wait for health, run acceptance tests
- Release workflow: deploy to dev using mounted compose path with health check
- Add deploy-prod workflow (workflow_dispatch) for human-gated prod deployment
- Add just recipes: deploy-prod, status (view current image tags across envs)
- Runners now have /apps mount for access to all environment compose files

.gitea/workflows/pr.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+env:
+  REGISTRY: docker.notsosm.art
+  IMAGE_NAME: euchre-camp
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
@@ -27,8 +31,9 @@ jobs:
       - name: Run unit tests
         run: bun test src/__tests__/unit/ src/__tests__/*.test.tsx src/__tests__/auth-simple.test.ts
 
-  acceptance-tests:
+  build-and-deploy-ci:
     runs-on: ubuntu-latest
+    needs: unit-tests
     container:
       image: docker.notsosm.art/euchre-camp/ci-base:latest
       options: --user root
@@ -45,11 +50,57 @@ jobs:
         env:
           DATABASE_URL: postgresql://user:pass@localhost:5432/dummy
 
+      - name: Extract PR number and commit info
+        id: info
+        run: |
+          echo "pr_number=$(echo $GITHUB_REF | grep -oP 'refs/pull/\K[0-9]+')" >> $GITHUB_OUTPUT
+          echo "short_sha=$(echo $GITHUB_SHA | cut -c1-7)" >> $GITHUB_OUTPUT
+
+      - name: Build Docker image for PR
+        run: |
+          IMAGE_TAG="pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }}"
+          docker build \
+            --target runner \
+            --build-arg GIT_COMMIT=$GITHUB_SHA \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG} \
+            .
+
+      - name: Update CI site compose and restart
+        run: |
+          IMAGE_TAG="pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }}"
+          COMPOSE_FILE="/apps/euchre_camp_ci/docker-compose.yml"
+
+          # Update the image tag in the compose file
+          sed -i "s|image: docker.notsosm.art/euchre-camp:[a-zA-Z0-9.-]*|image: docker.notsosm.art/euchre-camp:${IMAGE_TAG}|" ${COMPOSE_FILE}
+
+          # Pull the new image and restart the CI stack
+          cd /apps/euchre_camp_ci
+          docker compose pull app
+          docker compose up -d app
+
+      - name: Wait for CI site to be healthy
+        run: |
+          for i in {1..30}; do
+            if curl -sf https://euchre-ci.notsosm.art/api/health > /dev/null 2>&1; then
+              echo "CI site is healthy"
+              exit 0
+            fi
+            sleep 0.5
+          done
+          echo "CI site failed to become healthy after 15 seconds"
+          docker compose -f /apps/euchre_camp_ci/docker-compose.yml logs app
+          exit 1
+
       - name: Run acceptance tests
         run: DATABASE_URL="${{ secrets.CI_DATABASE_URL }}" bun test:acceptance
         env:
           CI: true
 
+      - name: Cleanup PR images
+        if: always()
+        run: |
+          docker rmi ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ steps.info.outputs.pr_number }}-${{ steps.info.outputs.short_sha }} || true
+
   analyze-bump-type:
     runs-on: ubuntu-latest
     needs: unit-tests