ci: use lionsctl-ci image; drop actions/checkout dependency

.gitea/workflows/ci.yml

@@ -1,32 +1,76 @@
-name: CI/CD Lions Pipeline
+# ============================================================================
+# Template — .gitea/workflows/ci.yml
+# Drop this file into each app repo (adjust LIONS_JAVA_VERSION +
+# LIONS_APP_NAME + optional --deploy-repo-url). It runs inside the
+# registry.lions.dev/lionsdev/lionsctl-ci:latest image, so lionsctl,
+# kubectl, helm, docker CLI, JDK 17+21 and Maven are all pre-installed.
+#
+# Required Gitea repo secrets:
+#   LIONS_REGISTRY_USERNAME   (typically "lionsregistry")
+#   LIONS_REGISTRY_PASSWORD
+#   LIONS_GIT_USERNAME        (typically "lionsdev")
+#   LIONS_GIT_ACCESS_TOKEN    (Gitea PAT with write:repository, write:package)
+#   LIONS_GIT_PASSWORD        (Gitea password for same user — Helm mode)
+#   SMTP_HOST SMTP_PORT SMTP_USERNAME SMTP_PASSWORD SMTP_FROM
+# ============================================================================
+name: CI/CD Pipeline
 
 on:
   push:
-    branches: [main, develop]
+    branches: [ main ]
-  workflow_dispatch:
+  workflow_dispatch: {}
 
 env:
-  LIONS_CLUSTER: k1
+  # Adjust per repo:
-  LIONS_JAVA_VERSION: '17'
+  #   - unionflow-server-impl-quarkus      -> 21
+  #   - all others                         -> 17
+  LIONS_JAVA_VERSION: "17"
+  LIONS_CLUSTER: "k1"
 
 jobs:
   pipeline:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    container:
+      image: registry.lions.dev/lionsdev/lionsctl-ci:latest
+      credentials:
+        username: ${{ secrets.LIONS_REGISTRY_USERNAME }}
+        password: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
+      # Mount the host docker socket so `docker build/push` inside the
+      # container hits the runner's daemon (DinD-free).
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Show tooling
-      - name: Pipeline deploy (btpxpress-frontend → btpxpress-client image)
+        run: |
+          lionsctl --version || true
+          docker --version
+          kubectl version --client=true
+          helm version --short
+          mvn --version | head -n2
+
+      - name: Pipeline deploy
         env:
           LIONS_REGISTRY_USERNAME: ${{ secrets.LIONS_REGISTRY_USERNAME }}
           LIONS_REGISTRY_PASSWORD: ${{ secrets.LIONS_REGISTRY_PASSWORD }}
-          LIONS_GIT_USERNAME: lionsctl-bot
+          LIONS_GIT_USERNAME:      ${{ secrets.LIONS_GIT_USERNAME }}
-          LIONS_GIT_PASSWORD: ${{ secrets.LIONS_GIT_PASSWORD }}
+          LIONS_GIT_ACCESS_TOKEN:  ${{ secrets.LIONS_GIT_ACCESS_TOKEN }}
-          LIONS_GIT_ACCESS_TOKEN: ${{ secrets.LIONS_GIT_ACCESS_TOKEN }}
+          LIONS_GIT_PASSWORD:      ${{ secrets.LIONS_GIT_PASSWORD }}
+          SMTP_HOST:               ${{ secrets.SMTP_HOST }}
+          SMTP_PORT:               ${{ secrets.SMTP_PORT }}
+          SMTP_USERNAME:           ${{ secrets.SMTP_USERNAME }}
+          SMTP_PASSWORD:           ${{ secrets.SMTP_PASSWORD }}
+          SMTP_FROM:               ${{ secrets.SMTP_FROM }}
+        # No actions/checkout — lionsctl clones internally using git_access_token.
         run: |
+          # For btpxpress-backend add:  --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-server-k1
+          # For btpxpress-frontend add: --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-client-k1
           lionsctl pipeline \
             -u ${{ gitea.server_url }}/${{ gitea.repository }} \
             -b ${{ gitea.ref_name }} \
             -j ${{ env.LIONS_JAVA_VERSION }} \
-            -e production -c ${{ env.LIONS_CLUSTER }} -p prod \
+            -e production \
-            -m admin@lions.dev \
+            -c ${{ env.LIONS_CLUSTER }} \
-            --deploy-repo-url ${{ gitea.server_url }}/lionsdev/btpxpress-client-k1
+            -p prod \
+            --deploy-repo-url https://git.lions.dev/lionsdev/btpxpress-client-k1 \
+            -m admin@lions.dev