ci: split pipeline into ci plus deploy, add test and health jobs

.gitea/workflows/ci.yaml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+    pull_request:
+    push:
+        branches: ["main"]
+
+jobs:
+    check:
+        name: Lint, Test & Build
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+            - name: Setup pnpm
+              uses: pnpm/action-setup@v4
+            - name: Get pnpm store path
+              id: pnpm-store
+              run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+            - name: Cache pnpm store
+              uses: actions/cache@v4
+              with:
+                  path: ${{ steps.pnpm-store.outputs.path }}
+                  key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
+                  restore-keys: |
+                      ${{ runner.os }}-pnpm-
+            - name: Setup Node
+              uses: actions/setup-node@v4
+              with:
+                  node-version: lts/*
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+            - name: Check formatting
+              run: pnpm format:check
+            - name: Lint
+              run: pnpm lint
+            - name: Test
+              run: pnpm test
+            - name: Build
+              run: pnpm build
+
+    health:
+        name: Code Health
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+            - name: Setup Python
+              uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
+            - name: Scan with desloppify (CI profile, objective only)
+              continue-on-error: true
+              run: |
+                  pipx run --spec desloppify desloppify scan --profile ci --no-badge
+            - name: Upload scorecard
+              uses: actions/upload-artifact@v4
+              with:
+                  name: desloppify-scorecard
+                  path: scorecard.png
+                  if-no-files-found: ignore

.gitea/workflows/deploy.yaml

@@ -1,51 +1,21 @@
-name: Build & Push
+name: Deploy
 
 on:
     push:
         branches: ["main"]
         tags: ["v*"]
-    pull_request:
+
+concurrency:
+    group: deploy-${{ github.ref }}
+    cancel-in-progress: true
 
 env:
     REGISTRY: git.fristy.net
     IMAGE_NAME: fristy/fristynet
 
 jobs:
-    check:
-        name: Lint & Build
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-            - name: Setup pnpm
-              uses: pnpm/action-setup@v4
-            - name: Get pnpm store path
-              id: pnpm-store
-              run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
-            - name: Cache pnpm store
-              uses: actions/cache@v4
-              with:
-                  path: ${{ steps.pnpm-store.outputs.path }}
-                  key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-                  restore-keys: |
-                      ${{ runner.os }}-pnpm-
-            - name: Setup Node
-              uses: actions/setup-node@v4
-              with:
-                  node-version: lts/*
-            - name: Install dependencies
-              run: pnpm install --frozen-lockfile
-            - name: Check formatting
-              run: pnpm format:check
-            - name: Lint
-              run: pnpm lint
-            - name: Build
-              run: pnpm build
-
     image:
         name: Build & Push Image
-        needs: check
-        if: github.event_name == 'push'
         runs-on: ubuntu-latest
         permissions:
             contents: read
@@ -79,7 +49,7 @@ jobs:
     deploy:
         name: Trigger Deploy
         needs: image
-        if: github.ref == 'refs/heads/main'
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         runs-on: ubuntu-latest
         steps:
             - name: Trigger Deploy