ci: deploy only successful validated revisions

.gitea/workflows/unraid-deploy.yml

@@ -1,12 +1,10 @@
 name: Unraid autoredeploy
 
 on:
-  push:
+  workflow_run:
+    workflows: ["GeoIntel release gates"]
+    types: [completed]
     branches: [main]
-    paths-ignore:
-      - ".gitea/**"
-      - "docs/**"
-      - "**/*.md"
   workflow_dispatch:
 
 concurrency:
@@ -19,13 +17,16 @@ permissions:
 jobs:
   deploy:
     name: Deploy geointel
+    if: ${{ gitea.event_name == 'workflow_dispatch' || gitea.event.workflow_run.conclusion == 'success' }}
     runs-on: deploy-geointel
     timeout-minutes: 180
     steps:
-      - name: Deploy exact Gitea revision
+      - name: Deploy exact validated Gitea revision
+        env:
+          DEPLOY_SHA: ${{ gitea.event.workflow_run.head_sha || gitea.sha }}
         run: |
           set -euo pipefail
+          test -n "$DEPLOY_SHA"
           docker exec gitea-deploy-control \
             /opt/gitea-deploy/deploy.py deploy \
-            "$GITHUB_REPOSITORY" "$GITHUB_SHA"
+            "$GITHUB_REPOSITORY" "$DEPLOY_SHA"
-