Deploy with Komodo: main to staging, vX.Y.Z to prod

CI now builds the API and website images after the tests, pushes them to git.t5de.dev, and deploys them through
Komodo (.gitea/scripts/deploy.py): pushes to main as :main to hub.staging.t5de.dev, vX.Y.Z tags as :X.Y.Z to
hub.t5de.dev, with the version pinned in t5de/t5de-infra.

The API image installs with --linker hoisted: Bun's isolated layout keeps the workspace links (@t5de/db) in each
package's own node_modules, which the image didn't copy, so the API couldn't start.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/ci.yml

@@ -1,9 +1,11 @@
-# Type-checks, tests (the API against PGlite, an in-process Postgres) and builds the hub.
+# Type-checks, tests (the API against PGlite, an in-process Postgres) and builds the hub, then deploys it: main to
+# staging, vX.Y.Z tags to prod.
 name: CI
 
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
   workflow_dispatch:
 
@@ -32,3 +34,46 @@ jobs:
 
       - name: Build
         run: bun run build
+
+  # Images for Komodo, then the deploy: main → :main and :sha-<commit>, deployed to staging; vX.Y.Z → :X.Y.Z and
+  # :latest, pinned in t5de/t5de-infra and deployed to prod (.gitea/scripts/deploy.py).
+  deploy:
+    needs: test
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Image tags
+        id: tags
+        run: |
+          if [ "$GITHUB_REF_TYPE" = tag ]; then
+            version=$(echo "$GITHUB_REF_NAME" | sed -nE 's/^v([0-9]+\.[0-9]+\.[0-9]+)$/\1/p')
+            [ -n "$version" ] || { echo "Not a vX.Y.Z tag: $GITHUB_REF_NAME"; exit 1; }
+            echo "tags=$version latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "tags=main sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push
+        env:
+          TAGS: ${{ steps.tags.outputs.tags }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          echo "$REGISTRY_TOKEN" | docker login git.t5de.dev -u "$GITHUB_ACTOR" --password-stdin
+          for app in api web; do
+            image=git.t5de.dev/t5de/t5de-hub-$app
+            args=(-f apps/$app/Dockerfile
+              --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+              --label "org.opencontainers.image.revision=$GITHUB_SHA")
+            for tag in $TAGS; do args+=(-t "$image:$tag"); done
+            docker build "${args[@]}" .
+            for tag in $TAGS; do docker push "$image:$tag"; done
+          done
+
+      - name: Deploy
+        env:
+          KOMODO_API_KEY: ${{ secrets.KOMODO_API_KEY }}
+          KOMODO_API_SECRET: ${{ secrets.KOMODO_API_SECRET }}
+          INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+        run: python3 .gitea/scripts/deploy.py hub t5de-hub HUB_VERSION