Publish curated ForgeFlow source from 2ed1787c0b52

examples/gitea-actions/deploy.yml

@@ -0,0 +1,51 @@
+name: ForgeFlow deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Fixed ForgeFlow deployment environment
+        required: true
+        default: production
+      commit_sha:
+        description: Exact commit verified by ForgeFlow
+        required: true
+      request_id:
+        description: ForgeFlow correlation identifier
+        required: true
+
+concurrency:
+  group: forgeflow-${{ gitea.repository }}-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    # Register a trusted runner with this label, or replace it with your own.
+    runs-on: forgeflow-production
+    steps:
+      - name: Validate dispatch inputs
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "${{ inputs.environment }}" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]] || {
+            echo "Invalid environment identifier" >&2
+            exit 64
+          }
+          [[ "${{ inputs.commit_sha }}" =~ ^[0-9a-fA-F]{40,64}$ ]] || {
+            echo "Invalid commit SHA" >&2
+            exit 64
+          }
+          [[ "${{ inputs.request_id }}" =~ ^[A-Za-z0-9._:-]{1,100}$ ]] || {
+            echo "Invalid request identifier" >&2
+            exit 64
+          }
+
+      - name: Deploy exact allowlisted version
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo /usr/local/bin/forgeflow-deploy \
+            "${{ gitea.repository }}" \
+            "${{ inputs.environment }}" \
+            "${{ inputs.commit_sha }}" \
+            "${{ inputs.request_id }}"