From c4f90b0830e41e2e3f261cf127a825647c374842 Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Mon, 22 Jun 2026 21:03:14 +0200
Subject: [PATCH] ci: test on v* tags, optional self-hosted staging deploy on
 betas

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/actionlint.yaml          |  6 +++++
 .github/workflows/ci-staging.yml | 42 ++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/ci-staging.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..bb71eb3
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+self-hosted-runner:
+  # Custom self-hosted runner label for the internal staging host (.165).
+  # The runner is not wired up yet; the deploy-staging job is gated behind
+  # the STAGING_ENABLED repo variable until it is.
+  labels:
+    - clusev-staging
diff --git a/.github/workflows/ci-staging.yml b/.github/workflows/ci-staging.yml
new file mode 100644
index 0000000..928470a
--- /dev/null
+++ b/.github/workflows/ci-staging.yml
@@ -0,0 +1,42 @@
+name: CI + staging
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+      - run: composer install --no-interaction --prefer-dist --no-progress
+      - run: cp .env.example .env && php artisan key:generate
+      - run: php artisan test
+      - run: ./vendor/bin/pint --test
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm ci
+      - run: npm run build
+      - name: shellcheck
+        run: |
+          docker run --rm -v "$PWD:/mnt" -w /mnt koalaman/shellcheck:stable \
+            docker/wg/clusev-wg.sh install.sh update.sh scripts/*.sh
+
+  deploy-staging:
+    needs: test
+    # Only beta tags, and only when a self-hosted internal runner is wired up.
+    if: ${{ contains(github.ref_name, '-beta') && vars.STAGING_ENABLED == 'true' }}
+    runs-on: [self-hosted, clusev-staging]
+    environment: staging
+    steps:
+      - name: Update the staging stack
+        run: |
+          cd "${{ vars.STAGING_PROJECT_DIR }}"
+          sudo ./update.sh