jkdsjkdjs

.gitea/workflows/deploy.yml

@@ -8,8 +8,8 @@ on:
 jobs:
   # One file, two lifecycles. The app pair (frontend + backend) moves with
   # most commits; the lean image carries Mathlib and is heavy to build and
-  # push, so its job runs only when lean/** actually changed. This step reads
-  # the pushed diff and opens the gates for the jobs below.
+  # push, so its build runs only when lean/** actually changed. This step
+  # reads the pushed diff and opens the gates for the deploy job below.
   changes:
     runs-on: docker
 
@@ -48,11 +48,15 @@ jobs:
           echo "lean=$lean" >> "$GITHUB_OUTPUT"
           echo "app=$app lean=$lean"
 
-  # The wiki app itself — its deploy step never touches the lean service.
+  # Both images deploy from here so the checkout, SSH setup and registry
+  # login happen once. The two builds stay gated on the pushed diff: a
+  # lean-only push skips every app step, and an app-only push skips lean —
+  # rebuilding Mathlib on a wiki commit would be pointless and slow. A lean
+  # change does not rebuild the app pair, and vice versa.
   deploy:
     runs-on: docker
     needs: changes
-    if: needs.changes.outputs.app == 'yes'
+    if: needs.changes.outputs.app == 'yes' || needs.changes.outputs.lean == 'yes'
 
     steps:
       - name: Checkout
@@ -76,24 +80,27 @@ jobs:
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
 
       - name: Build frontend
+        if: needs.changes.outputs.app == 'yes'
         run: |
           docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest ./frontend
           docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest
 
       - name: Build backend
+        if: needs.changes.outputs.app == 'yes'
         run: |
           docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest ./backend
           docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest
 
       - name: Copy files
+        if: needs.changes.outputs.app == 'yes'
         run: |
           scp docker-compose.yml deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/
           scp nginx.conf deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/nginx.conf
 
-      # Scoped to the services this job owns: never pulls/builds lean from
-      # here (that would need the lean tag or lean/ sources on the host).
-      # deploy-lean.yml owns the lean service's pull and up.
-      - name: Deploy
+      # Scoped to the services this step owns: never pulls/builds lean from
+      # here — the lean steps below do that, only when lean/** changed.
+      - name: Deploy app
+        if: needs.changes.outputs.app == 'yes'
         run: |
           ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
             echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
@@ -102,41 +109,17 @@ jobs:
             docker compose up -d frontend backend nginx
           EOF
 
-  # The Lean editor (lean4web): multi-stage, heavy by nature (it fetches
-  # Mathlib); expect a long build and a multi-GB push. Pin upstream with:
-  #   docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
-  deploy-lean:
-    runs-on: docker
-    needs: changes
-    if: needs.changes.outputs.lean == 'yes'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install SSH client
-        run: |
-          apt-get update -y && apt-get install -y openssh-client
-
-      - name: Setup SSH inside container
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-
-          # Add the container host to known_hosts
-          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
-
-      - name: Log in to registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
+      # The Lean editor (lean4web): multi-stage, heavy by nature (it fetches
+      # Mathlib); expect a long build and a multi-GB push. Pin upstream with:
+      #   docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
       - name: Build lean editor server
+        if: needs.changes.outputs.lean == 'yes'
         run: |
           docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest ./lean
           docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest
 
-      - name: Deploy
+      - name: Deploy lean
+        if: needs.changes.outputs.lean == 'yes'
         run: |
           ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
             echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin