From 4ba7ab9acae442d87b19b51466644ca74b704cdb Mon Sep 17 00:00:00 2001
From: Jens Caers <jens@itworx.tech>
Date: Wed, 26 Aug 2026 22:14:15 +0200
Subject: [PATCH] ci: deploy only successful validated revisions

---
 .gitea/workflows/unraid-deploy.yml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/unraid-deploy.yml b/.gitea/workflows/unraid-deploy.yml
index 98d1b88c..4ee2401f 100644
--- a/.gitea/workflows/unraid-deploy.yml
+++ b/.gitea/workflows/unraid-deploy.yml
@@ -1,12 +1,10 @@
 name: Unraid autoredeploy
 
 on:
-  push:
+  workflow_run:
+    workflows: ["GeoIntel release gates"]
+    types: [completed]
     branches: [main]
-    paths-ignore:
-      - ".gitea/**"
-      - "docs/**"
-      - "**/*.md"
   workflow_dispatch:
 
 concurrency:
@@ -19,13 +17,16 @@ permissions:
 jobs:
   deploy:
     name: Deploy geointel
+    if: ${{ gitea.event_name == 'workflow_dispatch' || gitea.event.workflow_run.conclusion == 'success' }}
     runs-on: deploy-geointel
     timeout-minutes: 180
     steps:
-      - name: Deploy exact Gitea revision
+      - name: Deploy exact validated Gitea revision
+        env:
+          DEPLOY_SHA: ${{ gitea.event.workflow_run.head_sha || gitea.sha }}
         run: |
           set -euo pipefail
+          test -n "$DEPLOY_SHA"
           docker exec gitea-deploy-control \
             /opt/gitea-deploy/deploy.py deploy \
-            "$GITHUB_REPOSITORY" "$GITHUB_SHA"
-
+            "$GITHUB_REPOSITORY" "$DEPLOY_SHA"