Test: portal.test.klingenbergbygg.no, nyeste portal og en egen NATS; søknad på pause

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

.gitea/workflows/deploy.yml

@@ -1,35 +1,25 @@
-name: Deploy instance
+name: Deploy test instance
 
-# This content repo owns its portal instance: which portal version runs
-# on kasse. uhhm/portal only publishes versioned release artifacts;
-# PORTAL_RELEASE below pins the one this site runs, so every rollout is
-# a commit - auditable, and revertable by reverting it.
-#
-# Content-only changes never come through here: lint-and-reload
-# hot-swaps those into the running instance over NATS.
-#
-# Runs on the host runner, because a deploy has to touch this host's
-# filesystem and its units. It is allowed exactly one root action:
-# /usr/local/bin/deploy-portal-instance, which checks the instance
-# against a fixed list and the tag against a release-tag shape before
-# it touches anything, and health-checks the site afterwards without a
-# forwarded header - a check that sends the header Caddy would send
-# cannot tell you the site is broken for everything that is not Caddy.
+# Branch `test` is portal.test.klingenbergbygg.no: the newest portal
+# release (cut from uhhm/portal main), with a NATS of its own on kasse,
+# so nothing tried here reaches production or mails a customer. The
+# production site is branch `main`, pinned in its own deploy.yml.
 
 on:
   workflow_dispatch:
   push:
-    branches: [main]
+    branches: [test]
     paths:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.6.3
-  INSTANCE: klingenberg-portal
+  INSTANCE: klingenberg-test
 
 jobs:
   deploy:
     runs-on: fish
     steps:
-      - name: Ship the pinned release and restart
-        run: sudo /usr/local/bin/deploy-portal-instance "$INSTANCE" "$PORTAL_RELEASE"
+      - name: Ship the newest release and restart
+        run: |
+          tag=$(curl -sf https://project.uhhm.no/api/v1/repos/uhhm/portal/releases/latest | jq -r .tag_name)
+          sudo /usr/local/bin/deploy-portal-instance "$INSTANCE" "$tag"