Deploy Dokploy applications from GitHub and Gitea Actions

A dependency-free node20 action that triggers application.deploy or
compose.deploy, then follows the deployment to a terminal status so a
failed build fails the CI run. Snapshots the deployment list before
triggering, so a concurrent deployment is never mistaken for this one.

Optionally points the application at a freshly built image first, which
is what lets a workflow lint, test, push and deploy the same artifact.

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: write
+
+jobs:
+  # Workflows pin `@v1`, so the major tag has to follow each release.
+  major-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Test before moving the tag
+        run: node --test
+
+      - name: Move the major version tag
+        run: |
+          major="${GITHUB_REF_NAME%%.*}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -f "$major" "$GITHUB_REF_NAME"
+          git push origin "refs/tags/$major" --force
+          echo "Moved $major to $GITHUB_REF_NAME"

.github/workflows/test.yml

@@ -0,0 +1,62 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ["20", "22"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - run: node --test
+
+      # The action runs straight from source on every runner, so it must never
+      # acquire a dependency or a build step.
+      - name: Stay dependency-free
+        run: |
+          test ! -d node_modules || { echo "node_modules must not be committed"; exit 1; }
+          test ! -e package-lock.json || { echo "a lockfile means dependencies crept in"; exit 1; }
+          ! grep -rn "require(\"[^.n]" src/ || { echo "src/ may only require node: builtins and local files"; exit 1; }
+
+  # A misconfigured step should fail with an explanation, not a stack trace.
+  misconfiguration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: No target named
+        env:
+          INPUT_HOST: https://dokploy.example.com
+          INPUT_API-KEY: not-a-real-key
+        run: |
+          set +e
+          output=$(node src/index.js 2>&1)
+          status=$?
+          echo "$output"
+          test "$status" -eq 1 || { echo "expected exit 1, got $status"; exit 1; }
+          echo "$output" | grep -q "No target" || { echo "expected a 'No target' error"; exit 1; }
+
+      - name: Host without a scheme
+        env:
+          INPUT_HOST: dokploy.example.com
+          INPUT_API-KEY: not-a-real-key
+          INPUT_APPLICATION-ID: whatever
+        run: |
+          set +e
+          output=$(node src/index.js 2>&1)
+          echo "$output"
+          echo "$output" | grep -q "must start with http" || { echo "expected a scheme error"; exit 1; }