I cant

.gitea/workflows/deploy.yml

@@ -1,21 +1,64 @@
-name: Build and Deploy Nuxt
+name: Build and Deploy
 
 on:
   push:
     branches: [master]
-    # The Lean editor carries Mathlib and moves on its own schedule — its
-    # image is built and pushed by deploy-lean.yml, only when lean/** changes
-    paths-ignore:
-      - "lean/**"
+  workflow_dispatch:
 
 jobs:
-  build:
+  # One file, two lifecycles. The app pair (frontend + backend) moves with
+  # most commits; the lean image carries Mathlib and is heavy to build and
+  # push, so its job runs only when lean/** actually changed. This step reads
+  # the pushed diff and opens the gates for the jobs below.
+  changes:
     runs-on: docker
-  
+
+    outputs:
+      app: ${{ steps.filter.outputs.app }}
+      lean: ${{ steps.filter.outputs.lean }}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      
+        with:
+          fetch-depth: 0
+
+      - name: What changed?
+        id: filter
+        env:
+          BEFORE: ${{ github.event.before }}
+          AFTER: ${{ github.event.after }}
+        run: |
+          # Manual runs, first pushes or rewritten history carry no usable
+          # "before" commit — rebuild everything rather than guess.
+          if [ -z "${BEFORE}" ] || [ -z "${BEFORE//0/}" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
+            echo "app=yes" >> "$GITHUB_OUTPUT"
+            echo "lean=yes" >> "$GITHUB_OUTPUT"
+            echo "app=yes lean=yes (no usable before-commit)"
+            exit 0
+          fi
+          changed=$(git diff --name-only "$BEFORE" "$AFTER")
+          lean=no
+          app=no
+          if [ -n "$changed" ]; then
+            if echo "$changed" | grep -q '^lean/'; then lean=yes; fi
+            if echo "$changed" | grep -qvx 'lean/.*'; then app=yes; fi
+          fi
+          echo "app=$app" >> "$GITHUB_OUTPUT"
+          echo "lean=$lean" >> "$GITHUB_OUTPUT"
+          echo "app=$app lean=$lean"
+
+  # The wiki app itself. Its deploy (`compose pull && up -d`) also pulls
+  # whatever mathew-lean:latest the registry holds — the lean job keeps it current.
+  deploy:
+    runs-on: docker
+    needs: changes
+    if: needs.changes.outputs.app == 'yes'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Install SSH client
         run: |
           apt-get update -y && apt-get install -y openssh-client
@@ -48,8 +91,6 @@ jobs:
           scp docker-compose.yml deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/
           scp nginx.conf deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/nginx.conf
 
-      # `compose pull` also pulls the lean image from the registry —
-      # deploy-lean.yml is what keeps that tag current
       - name: Deploy
         run: |
           ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
@@ -58,3 +99,46 @@ jobs:
             docker compose pull
             docker compose up -d --remove-orphans
           EOF
+
+  # The Lean editor (lean4web): multi-stage, heavy by nature (it fetches
+  # Mathlib); expect a long build and a multi-GB push. Pin upstream with:
+  #   docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
+  deploy-lean:
+    runs-on: docker
+    needs: changes
+    if: needs.changes.outputs.lean == 'yes'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install SSH client
+        run: |
+          apt-get update -y && apt-get install -y openssh-client
+
+      - name: Setup SSH inside container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+          # Add the container host to known_hosts
+          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
+
+      - name: Log in to registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build lean editor server
+        run: |
+          docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest ./lean
+          docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest
+
+      - name: Deploy
+        run: |
+          ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
+            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            cd /var/www/app/
+            docker compose pull lean
+            docker compose up -d lean
+          EOF