ci: use Gitea Actions as delivery gate

.github/workflows/ci.yml

@@ -4,7 +4,13 @@ on:
   pull_request:
     branches: [main]
   push:
-    branches: [main]
+    branches:
+      - main
+      - 'feature/**'
+      - 'fix/**'
+      - 'chore/**'
+      - 'release/**'
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -52,9 +58,10 @@ jobs:
       - run: npm run build
 
   contract:
-    name: Docker / scripts contract
+    name: Docker / migrations / production images
     runs-on: ubuntu-latest
     needs: [api, web]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_dispatch' }}
     steps:
       - uses: actions/checkout@v4
       - name: Validate shell scripts
@@ -347,3 +354,22 @@ jobs:
           docker image rm "$image" >/dev/null 2>&1 || true
       - name: Build production images
         run: docker compose --env-file .env.example build api migrate web
+
+  promote-deploy:
+    name: Promote verified main to deploy
+    runs-on: ubuntu-latest
+    needs: [api, web, contract]
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Fast-forward deploy to the verified commit
+        run: |
+          set -Eeuo pipefail
+          git fetch origin deploy main
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          git merge-base --is-ancestor origin/deploy "$GITHUB_SHA"
+          git push origin "$GITHUB_SHA:refs/heads/deploy"