ci: one workflow for tests, prek and the deploy to sega

.gitea/workflows/checks.yaml

@@ -1,38 +0,0 @@
-name: checks
-
-# Checks only, nothing here deploys. deploy.yaml calls it before deploying.
-on:
-  push:
-  pull_request:
-  workflow_call:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  checks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # bind9-utils provides named-checkzone, used by the zone sync tests.
-      - name: Install system dependencies
-        run: |
-          SUDO=$(command -v sudo || true)
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends bind9-utils
-
-      - name: Install mise
-        run: |
-          curl -fsSL https://mise.run | sh
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-
-      - name: Install pinned tools
-        run: mise install
-
-      - name: Install Python dependencies
-        run: mise exec -- uv sync --locked --no-group prod
-
-      - name: Unit tests
-        run: mise exec -- uv run --no-sync pytest

.gitea/workflows/ci.yaml

@@ -0,0 +1,61 @@
+name: CI
+
+# Tests and prek on every push and pull request. A push to main that passes both deploys
+# to sega, while the repository variable DEPLOY_SEGA is true.
+on:
+  push:
+  pull_request:
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # bind9-utils provides named-checkzone, used by the zone sync tests.
+      - name: Install system dependencies
+        run: |
+          SUDO=$(command -v sudo || true)
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends bind9-utils
+
+      - name: Install mise
+        run: |
+          curl -fsSL https://mise.run | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Install pinned tools
+        run: mise install
+
+      - name: Install Python dependencies
+        run: mise exec -- uv sync --locked --no-group prod
+
+      - name: Unit tests
+        run: mise exec -- uv run --no-sync pytest
+
+  # The hooks in prek.toml.
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: j178/prek-action@v1
+
+  # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh
+  # command line, builds that commit on the host and switches to it (edb-infra's
+  # roles/mdb.md).
+  deploy-sega:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_SEGA == 'true'
+    runs-on: ubuntu-latest
+    needs:
+      - tests
+      - prek
+    steps:
+      - name: Deploy
+        run: |
+          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
+          eval $(ssh-agent -s)
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          ssh mdb-deploy@sega.neuf.no "${{ github.sha }}"

.gitea/workflows/deploy.yaml

@@ -1,33 +0,0 @@
-name: deploy
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  checks:
-    if: vars.DEPLOY_SEGA == 'true'
-    uses: ./.gitea/workflows/checks.yaml
-  prek:
-    if: vars.DEPLOY_SEGA == 'true'
-    uses: ./.gitea/workflows/prek.yaml
-
-  # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh
-  # command line, builds that commit on the host and switches to it (edb-infra's
-  # roles/mdb.md).
-  deploy-sega:
-    if: vars.DEPLOY_SEGA == 'true'
-    runs-on: ubuntu-latest
-    needs:
-      - checks
-      - prek
-    steps:
-      - name: Deploy
-        run: |
-          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
-          eval $(ssh-agent -s)
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-          ssh mdb-deploy@sega.neuf.no "${{ github.sha }}"

.gitea/workflows/prek.yaml

@@ -1,14 +0,0 @@
-name: prek
-
-# The hooks in prek.toml. deploy.yaml calls it before deploying.
-on:
-  push:
-  pull_request:
-  workflow_call:
-
-jobs:
-  prek:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: j178/prek-action@v1

README.md

@@ -28,8 +28,8 @@ Run migrations and start the development server:
 MDB runs on sega under edb-infra's `mdb` role (`roles/mdb.md` there): gunicorn from a
 release directory per commit, its settings in the file `MDB_SETTINGS` names
 (`/etc/mdb/settings.py`), which `mdbsite/settings.py` executes last. A push to `main` that
-passes the checks deploys itself while the repository variable `DEPLOY_SEGA` is `true`
-(`.gitea/workflows/deploy.yaml`). The DNS and DHCP sync runs as root on sega:
+passes the tests and prek deploys itself while the repository variable `DEPLOY_SEGA` is `true`
+(`.gitea/workflows/ci.yaml`). The DNS and DHCP sync runs as root on sega:
 `sudo mdb-sync`.
 
 ## Development tasks

prek.toml

@@ -1,5 +1,5 @@
 # Git hooks, run by prek (https://prek.j178.dev). `prek install` once per clone; CI runs
-# them all (.gitea/workflows/prek.yaml).
+# them all (.gitea/workflows/ci.yaml).
 
 [[repos]]
 repo = "https://github.com/astral-sh/ruff-pre-commit"