.gitea/workflows/workflow.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - legacy-network-restriction
   pull_request:
     types: [opened, synchronize, reopened, closed]
 
@@ -23,7 +22,6 @@ env:
 jobs:
   # ------------------------------------------------------------------
   # STAGE 1: PREPARE
-  # Calculate dynamic paths (like PR folders) so other jobs can use them
   # ------------------------------------------------------------------
   prepare_context:
     name: Prepare Context
@@ -34,42 +32,37 @@ jobs:
       - id: calc
         run: |
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
-          # Only needed for PRs
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
           fi
 
   # ------------------------------------------------------------------
   # STAGE 2: DEPLOY PREVIEW (DEV)
-  # Runs only on Pull Requests
   # ------------------------------------------------------------------
   deploy_preview:
     name: Deploy (Dev/Preview)
     runs-on: ubuntu-latest
-    needs: prepare_context
+    needs: 
+      - prepare_context
     if: github.event_name == 'pull_request' && github.event.action != 'closed'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
-          # 1. Setup Known Hosts
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
-          # 2. Define Target
           TARGET="${{ needs.prepare_context.outputs.pr_path }}"
           
-          # 3. Create Remote Dir
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
-
+          
-          # 4. Sync Files (Exclude .git to save bandwidth)
           rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
             --exclude '.git/' --exclude '.github/' \
             ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-          # 5. Build and Run on Server
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
             cd '$TARGET'
             docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
@@ -77,7 +70,6 @@ jobs:
 
   # ------------------------------------------------------------------
   # STAGE 3: DEPLOY STAGING
-  # Runs on 'main'. Always runs before Prod.
   # ------------------------------------------------------------------
   deploy_staging:
     name: Deploy (Staging)
@@ -85,13 +77,14 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ env.REMOTE_STAGING_PATH }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
@@ -107,22 +100,23 @@ jobs:
 
   # ------------------------------------------------------------------
   # STAGE 4: DEPLOY PRODUCTION
-  # Runs on 'main'. DEPENDS ON STAGING SUCCESS.
   # ------------------------------------------------------------------
   deploy_prod:
     name: Deploy (Production)
     runs-on: ubuntu-latest
-    needs: deploy_staging # <--- This is the key logic separation
+    needs: 
+      - deploy_staging
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
+      
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Sync & Build
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ env.REMOTE_PROD_PATH }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
@@ -131,29 +125,28 @@ jobs:
             --exclude '.git/' --exclude '.github/' \
             ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
 
-          # Note: Since Staging just built this commit on the same server, 
-          # this build step will be nearly instant (using Docker cache).
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
             cd '$TARGET'
             docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
           "
 
   # ------------------------------------------------------------------
-  # CLEANUP (On PR Close)
+  # CLEANUP
   # ------------------------------------------------------------------
   cleanup:
     name: Cleanup Preview
     runs-on: ubuntu-latest
-    needs: prepare_context
+    needs: 
+      - prepare_context
     if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
     steps:
       - uses: webfactory/ssh-agent@v0.9.0
-        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
+        with:
+          ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
 
       - name: Remove Remote Environment
         run: |
           mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
-          
           TARGET="${{ needs.prepare_context.outputs.pr_path }}"
           
           ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "