Fredriks rettelser i bildetekstene (#6)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

.gitea/workflows/deploy.yml

@@ -1,25 +1,35 @@
-name: Deploy test instance
+name: Deploy instance
 
-# Branch `test` is portal.test.klingenbergbygg.no: the newest portal
-# release (cut from uhhm/portal main), with a NATS of its own on kasse,
-# so nothing tried here reaches production or mails a customer. The
-# production site is branch `main`, pinned in its own deploy.yml.
+# This content repo owns its portal instance: which portal version runs
+# on kasse. uhhm/portal only publishes versioned release artifacts;
+# PORTAL_RELEASE below pins the one this site runs, so every rollout is
+# a commit - auditable, and revertable by reverting it.
+#
+# Content-only changes never come through here: lint-and-reload
+# hot-swaps those into the running instance over NATS.
+#
+# Runs on the host runner, because a deploy has to touch this host's
+# filesystem and its units. It is allowed exactly one root action:
+# /usr/local/bin/deploy-portal-instance, which checks the instance
+# against a fixed list and the tag against a release-tag shape before
+# it touches anything, and health-checks the site afterwards without a
+# forwarded header - a check that sends the header Caddy would send
+# cannot tell you the site is broken for everything that is not Caddy.
 
-# Every push: a test site that follows the newest release has no pin
-# to change, so a push is the moment to pick the newest up.
 on:
   workflow_dispatch:
   push:
-    branches: [test]
+    branches: [main]
+    paths:
+      - .gitea/workflows/deploy.yml
 
 env:
-  INSTANCE: klingenberg-test
+  PORTAL_RELEASE: v0.6.3
+  INSTANCE: klingenberg-portal
 
 jobs:
   deploy:
     runs-on: fish
     steps:
-      - name: Ship the newest release and restart
-        run: |
-          tag=$(curl -sf https://project.uhhm.no/api/v1/repos/uhhm/portal/releases/latest | jq -r .tag_name)
-          sudo /usr/local/bin/deploy-portal-instance "$INSTANCE" "$tag"
+      - name: Ship the pinned release and restart
+        run: sudo /usr/local/bin/deploy-portal-instance "$INSTANCE" "$PORTAL_RELEASE"

.gitea/workflows/lint-and-reload.yml

@@ -1,21 +1,21 @@
 name: lint-and-reload
 on:
   push:
-    branches: [test]
+    branches: [main]
 jobs:
   lint:
     runs-on: fish
     steps:
       - name: checkout
         run: |
-          rm -rf checkout && git clone --depth 1 --branch test https://prosjekt.klingenbergbygg.no/klingenbergbygg/questions.git checkout
-      # The lint is portal itself, at the newest release: the one the
-      # test instance runs.
+          rm -rf checkout && git clone --depth 1 https://prosjekt.klingenbergbygg.no/klingenbergbygg/questions.git checkout
+      # The lint is portal itself (`portal lint`), at the version this
+      # site runs (PORTAL_RELEASE in deploy.yml).
       - name: lint
+        env:
+          PORTAL_RELEASE: v0.6.3
         run: |
-          tag=$(curl -sf https://project.uhhm.no/api/v1/repos/uhhm/portal/releases/latest | jq -r .tag_name)
-          curl -sfL "https://project.uhhm.no/uhhm/portal/releases/download/$tag/portal-x86_64-linux" -o portal && chmod +x portal
+          curl -sfL "https://project.uhhm.no/uhhm/portal/releases/download/$PORTAL_RELEASE/portal-x86_64-linux" -o portal && chmod +x portal
           ./portal lint --path checkout/questions
-      # The test instance's own NATS, never production's.
       - name: reload
-        run: nats --server nats://127.0.0.1:4232 pub portal.content.reload ""
+        run: nats --server nats://127.0.0.1:4222 pub portal.content.reload ""