Deploy зависит от lint через needs:, поэтому при failure
lint (исторический долг empty-блоков) deploy не запускается ВООБЩЕ
(висит pending бесконечно).
Lint опциональный — не в branch protection required-checks.
Deploy должен зависеть только от Build + Secret-scan.
Adds new "deploy" job in .gitea/workflows/ci.yml that runs on push
to main (after PR is merged). Builds production bundle and rsyncs
it to /var/www/rublox-player/build/ on both production servers
(S1 VM 124 via NAT 1998, S2 VM 124 directly via runner network).
Uses Gitea Secrets:
- DEPLOY_SSH_KEY: dedicated ed25519 key for CI, pubkey already
on ~min/.ssh/authorized_keys on both VM 124
- KNOWN_HOSTS: host-keys of both targets to prevent MITM
Also updates CONTRIBUTING.md:
- Maintainer workflow section explaining why even Lead works via PR
- Hotfix flow (always via PR, never direct push to main)
- DevPanel as fallback if CI deploy is broken
