ci: prek, and deploy to sega from main

.gitea/workflows/checks.yaml

@@ -1,9 +1,10 @@
 name: checks
 
-# Checks only, nothing here deploys
+# Checks only, nothing here deploys. deploy.yaml calls it before deploying.
 on:
   push:
   pull_request:
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.gitea/workflows/deploy.yaml

@@ -0,0 +1,33 @@
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    if: vars.DEPLOY_SEGA == 'true'
+    uses: ./.gitea/workflows/checks.yaml
+  prek:
+    if: vars.DEPLOY_SEGA == 'true'
+    uses: ./.gitea/workflows/prek.yaml
+
+  # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh
+  # command line, builds that commit on the host and switches to it (edb-infra's
+  # roles/mdb.md).
+  deploy-sega:
+    if: vars.DEPLOY_SEGA == 'true'
+    runs-on: ubuntu-latest
+    needs:
+      - checks
+      - prek
+    steps:
+      - name: Deploy
+        run: |
+          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
+          eval $(ssh-agent -s)
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+          ssh mdb-deploy@sega.neuf.no "${{ github.sha }}"

.gitea/workflows/prek.yaml

@@ -0,0 +1,14 @@
+name: prek
+
+# The hooks in prek.toml. deploy.yaml calls it before deploying.
+on:
+  push:
+  pull_request:
+  workflow_call:
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: j178/prek-action@v1