Deploy to Komodo on main / manual dispatch (#40)

After a successful build on main (or a manual workflow_dispatch), point the
Komodo `pansy` stack's PANSY_TAG at the fresh :sha-<short> image and redeploy
it, mirroring mort's pipeline. Branch builds still only push the image.

Read-modify-write of the stack env via the Komodo /read + /write API, then
DeployStack via /execute. Uses the account-wide KOMODO_URL / KOMODO_API_KEY /
KOMODO_API_SECRET secrets; all secrets travel through env, never inline.

Closes #40.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

.gitea/workflows/build-image.yml

@@ -9,6 +9,10 @@ name: Build image
 # Runs on every branch push (so branch images are always available) and can be
 # triggered manually. A push to a PR branch covers the PR too, so there is no
 # separate pull_request trigger (avoids double builds).
+#
+# On main (or a manual dispatch) a successful build also points the Komodo `pansy`
+# stack at the fresh :sha-<short> image (PANSY_TAG) and redeploys it — mirroring
+# mort's pipeline. Branch builds only push the image; they never deploy.
 
 on:
   push:
@@ -85,3 +89,53 @@ jobs:
             --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
             --file ./Dockerfile \
             .
+
+      - name: Point Komodo at the fresh image (PANSY_TAG)
+        # Only deploy from main or a manual dispatch, and only if the build above
+        # succeeded. Secrets travel through env (never inline ${{ }}); the tag is
+        # sha-<7hex>, safe for the sed replacement below.
+        if: (github.ref_name == 'main' || github.event_name == 'workflow_dispatch') && success()
+        env:
+          SHA: ${{ github.sha }}
+          KOMODO_URL: ${{ secrets.KOMODO_URL }}
+          KOMODO_API_KEY: ${{ secrets.KOMODO_API_KEY }}
+          KOMODO_API_SECRET: ${{ secrets.KOMODO_API_SECRET }}
+        run: |
+          TAG="sha-$(echo "$SHA" | cut -c1-7)"
+
+          # Read the current stack so we can edit its environment in place.
+          CURRENT=$(curl -sSf -X POST "${KOMODO_URL}/read" \
+            -H "Content-Type: application/json" \
+            -H "X-Api-Key: ${KOMODO_API_KEY}" \
+            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
+            -d '{"type": "GetStack", "params": {"stack": "pansy"}}')
+
+          STACK_ID=$(echo "$CURRENT" | jq -r '._id["$oid"]')
+          CURRENT_ENV=$(echo "$CURRENT" | jq -r '.config.environment')
+
+          # Replace PANSY_TAG if present, else append it.
+          if echo "$CURRENT_ENV" | grep -q "^PANSY_TAG="; then
+            UPDATED_ENV=$(echo "$CURRENT_ENV" | sed "s/^PANSY_TAG=.*/PANSY_TAG=${TAG}/")
+          else
+            UPDATED_ENV=$(printf '%s\nPANSY_TAG=%s' "$CURRENT_ENV" "$TAG")
+          fi
+
+          curl -sSf -X POST "${KOMODO_URL}/write" \
+            -H "Content-Type: application/json" \
+            -H "X-Api-Key: ${KOMODO_API_KEY}" \
+            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
+            -d "$(jq -n --arg id "$STACK_ID" --arg env "$UPDATED_ENV" \
+              '{"type": "UpdateStack", "params": {"id": $id, "config": {"environment": $env}}}')"
+
+      - name: Deploy via Komodo
+        if: (github.ref_name == 'main' || github.event_name == 'workflow_dispatch') && success()
+        env:
+          KOMODO_URL: ${{ secrets.KOMODO_URL }}
+          KOMODO_API_KEY: ${{ secrets.KOMODO_API_KEY }}
+          KOMODO_API_SECRET: ${{ secrets.KOMODO_API_SECRET }}
+        run: |
+          curl -sSf -X POST "${KOMODO_URL}/execute" \
+            -H "Content-Type: application/json" \
+            -H "X-Api-Key: ${KOMODO_API_KEY}" \
+            -H "X-Api-Secret: ${KOMODO_API_SECRET}" \
+            -d '{"type": "DeployStack", "params": {"stack": "pansy", "services": [], "stop_time": null}}'