feat(ci): add Gitea Actions deploy pipeline and fix prod image module assets

- Add .gitea/workflows/deploy.yaml: QA → build prod image → SCP to server → docker load + compose up + module:sync
- Fix Dockerfile prod stage: copy module web assets directly from modules/*/web/ instead of resolving symlinks (symlinks are excluded via .dockerignore and break on Windows/CI)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -0,0 +1,83 @@
+name: deploy
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  qa:
+    name: QA gates
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Start project services
+        run: docker compose up -d
+
+      - name: Run required QA gates
+        run: bin/qa-required.sh
+
+  build-and-deploy:
+    name: Build & deploy
+    runs-on: ubuntu-latest
+    needs: qa
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build production image
+        run: |
+          docker build \
+            --target prod \
+            -f docker/php/Dockerfile \
+            -t breadcrumb-the-shire:latest \
+            .
+
+      - name: Export image to tar.gz
+        run: docker save breadcrumb-the-shire:latest | gzip > breadcrumb-the-shire.tar.gz
+
+      - name: Copy image to server
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: breadcrumb-the-shire.tar.gz
+          target: /root/dockerfiles-breadcrumb-infra/projects/
+
+      - name: Copy updated deploy files to server
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: "deploy/docker-compose.yml,deploy/nginx/"
+          target: /root/dockerfiles-breadcrumb-infra/projects/
+          strip_components: 1
+
+      - name: Deploy on server
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USER }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            set -e
+            cd /root/dockerfiles-breadcrumb-infra/projects
+
+            echo "=== Load image ==="
+            docker load < breadcrumb-the-shire.tar.gz
+            rm breadcrumb-the-shire.tar.gz
+
+            echo "=== Restart containers ==="
+            docker compose up -d --remove-orphans
+
+            echo "=== Wait for PHP container ==="
+            sleep 5
+
+            echo "=== Run module sync ==="
+            docker compose exec -T php php bin/console module:sync
+
+            echo "=== Done ==="

docker/php/Dockerfile

@@ -50,15 +50,16 @@ RUN composer install \
 # Apply production PHP hardening AFTER composer is done.
 COPY docker/php/php.prod.ini /usr/local/etc/php/conf.d/zzz-minty-prod.ini
 
-# Publish module web assets as real files (not symlinks) so web_init cp works correctly.
-# Symlinks from web/modules/<id> → modules/<id>/web are replaced by actual copies,
-# because web_init uses "cp -rp" which follows symlinks only to directories, not files.
-RUN find /var/www/web/modules -maxdepth 1 -mindepth 1 -type l | while read link; do \
-        id=$(basename "$link"); \
-        target=$(readlink "$link"); \
-        rm "$link"; \
-        cp -r "$target" "/var/www/web/modules/$id"; \
-    done || true
+# Publish module web assets as real files so web_init cp works correctly.
+# web/modules/ is excluded via .dockerignore (absolute symlinks break on Windows/CI),
+# so we copy directly from modules/<id>/web/ instead of resolving symlinks.
+RUN mkdir -p /var/www/web/modules && \
+    for mod_web in /var/www/modules/*/web; do \
+        id=$(basename "$(dirname "$mod_web")"); \
+        if [ -d "$mod_web" ]; then \
+            cp -r "$mod_web" "/var/www/web/modules/$id"; \
+        fi; \
+    done
 
 # Create runtime directories (storage/ and var/ are excluded via .dockerignore;
 # they will be mounted as volumes in production — we just ensure the paths exist).