.forgejo/workflows/build.yml

@@ -28,17 +28,3 @@ jobs:
           scp -i /tmp/deploy_key -o StrictHostKeyChecking=no hsa $TARGET:$REL/hsa
           ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET "chmod +x $REL/hsa"
           rm /tmp/deploy_key
-      - name: Activate release
-        if: startsWith(github.ref, 'refs/tags/')
-        run: |
-          TAG=${{ github.ref_name }}
-          if ! echo "$TAG" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "Tag $TAG is a pre-release; staged but not activated."
-            exit 0
-          fi
-          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
-          chmod 600 /tmp/deploy_key
-          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
-          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
-            "cd hsa-app && ln -sfn releases/hsa-app-V$TAG/hsa hsa && systemctl --user restart hsa_app"
-          rm /tmp/deploy_key

.forgejo/workflows/deploy.yml

@@ -0,0 +1,24 @@
+name: Deploy
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release version to activate, e.g. 0.0.0a1 (must already be staged in ~/hsa-app/releases/hsa-app-V<tag>/hsa)'
+        required: true
+jobs:
+  deploy:
+    runs-on: shell
+    steps:
+      - name: Activate release
+        run: |
+          echo "${{ secrets.FORGEJO_SSH }}" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+          TAG=${{ github.event.inputs.tag }}
+          TARGET=${{ vars.HSA_APP_USER }}@${{ vars.HSA_APP_HOST }}
+          ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no $TARGET \
+            "cd hsa-app \
+             && test -f releases/hsa-app-V$TAG/hsa \
+             && chmod +x releases/hsa-app-V$TAG/hsa \
+             && ln -sfn releases/hsa-app-V$TAG/hsa hsa \
+             && systemctl --user restart hsa_app"
+          rm /tmp/deploy_key

deploy/INSTALL.md

@@ -1,17 +1,16 @@
 # Deploying hsa-app
 
-The app runs as a **user systemd service** (no sudo). Deployment is driven by
+The app runs as a **user systemd service** (no sudo). Deployment is two steps:
-git tags:
 
-- **Release tags `X.Y.Z`** (e.g. `1.2.0`) — CI builds + tests, stages the binary
+1. **Stage (automatic on tag)** — pushing a git tag builds + tests, then CI
-  into `~/hsa-app/releases/hsa-app-V<tag>/hsa`, then **activates** it: points the
+   copies the binary into `~/hsa-app/releases/hsa-app-V<tag>/hsa`. Nothing goes
-  `~/hsa-app/hsa` symlink at that release and restarts the service.
+   live yet.
-- **Pre-release tags** (anything else, e.g. `0.0.0a2`) — built, tested, and
+2. **Activate (manual button)** — run the **Deploy** workflow from the Forgejo
-  staged into `releases/`, but **not** activated. Nothing goes live.
+   Actions tab ("Run workflow"), entering the tag to activate. It points the
+   `~/hsa-app/hsa` symlink at that release and restarts the service.
 
-The symlink decouples "what's on disk" from "what's running," so activating a
+The symlink decouples "what's on disk" from "what's running," so activation and
-staged pre-release or rolling back is just a symlink repoint + restart (see
+rollback are just a symlink repoint + restart.
-below).
 
 ## Layout on the host
 
@@ -74,8 +73,9 @@ journalctl --user -u hsa_app -f    # follow logs
 
 ## Deploy a tagged release
 
-Push a release tag `X.Y.Z` — CI builds, stages, and activates it automatically.
+Pushing a tag stages the binary automatically. To activate it, open the repo's
-To manually activate a staged pre-release (or any release) from the host:
+**Actions → Deploy** workflow, click **Run workflow**, and enter the tag (e.g.
+`0.0.0a1`). To activate from the host instead:
 
 ```bash
 cd ~/hsa-app