Resolve the plugin and SDKs from Gitea

PluginDownloadURL moves off github:// to a templated Gitea release URL.
Pulumi interpolates ${VERSION}, then appends
pulumi-resource-dokploy-v<version>-<os>-<arch>.tar.gz -- which is what
the GoReleaser archive template already produces. Schema, bridge
metadata and all four SDKs regenerated to carry it.

Releases publish to this instance's npm, PyPI, NuGet and Go registries
using the GITEA_TOKEN that Gitea injects, so no secrets need
configuring.

The Go SDK keeps its github.com module path, which is exactly why it
goes to Gitea's Go registry: pointing GOPROXY there is what makes that
path resolve at all. Verified locally by serving the module zip from a
file proxy and building a consumer against it -- note zip -D, without
which go get rejects the archive's directory entries.

sdk/dotnet/README.md

@@ -6,7 +6,7 @@ redirects, basic auth, registries, SSH keys, certificates and backup
 destinations.
 
 This is a *bridged* provider. All of the behaviour lives in
-[`terraform-provider-dokploy`](https://github.com/maxvojtkov/terraform-provider-dokploy);
+[`terraform-provider-dokploy`](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy);
 [`pulumi-terraform-bridge`](https://github.com/pulumi/pulumi-terraform-bridge)
 turns it into a Pulumi package with typed SDKs for TypeScript, Python, Go and
 .NET. The two providers stay in lockstep — a resource added upstream shows up
@@ -49,6 +49,7 @@ new dokploy.Domain("api", {
 - [Installing](#installing)
 - [Configuration](#configuration)
 - [Resources and data sources](#resources-and-data-sources)
+- [Deploying from CI](#deploying-from-ci)
 - [Differences from the Terraform provider](#differences-from-the-terraform-provider)
 - [Examples](#examples)
 - [Development](#development)
@@ -56,23 +57,52 @@ new dokploy.Domain("api", {
 
 ## Installing
 
-The SDKs are published per language; the plugin binary is resolved
-automatically from this repository's GitHub releases.
+The SDKs live in this Gitea instance's package registries, and the plugin
+binary is resolved automatically from this repository's Gitea releases — the
+download URL is baked into the schema, so `pulumi up` fetches it without any
+configuration.
+
+The SDKs do need one-time registry configuration, because none of these
+package managers know about a private host by default.
+
+**TypeScript / JavaScript**
 
 ```bash
-# TypeScript / JavaScript
+npm config set @maxvojtkov:registry \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/npm/
 npm install @maxvojtkov/pulumi-dokploy
+```
 
-# Python
-pip install pulumi_dokploy
+**Python**
 
-# Go
-go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```bash
+pip install pulumi_dokploy \
+  --index-url https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/pypi/simple
+```
 
-# .NET
+**.NET**
+
+```bash
+dotnet nuget add source \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/nuget/index.json \
+  --name gitea-dokploy
 dotnet add package Maxvojtkov.Dokploy
 ```
 
+**Go** — the module path stays `github.com/maxvojtkov/...` even though nothing
+is hosted on GitHub, so point the proxy at Gitea and skip the public checksum
+database for that path:
+
+```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
+go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```
+
+If the registries are private, add credentials the usual way for each tool —
+an `_authToken` in `.npmrc`, `--extra-index-url` with basic auth for pip, and
+`--username`/`--password` on the `dotnet nuget add source`.
+
 Before the first release, build and install it locally instead:
 
 ```bash
@@ -123,6 +153,30 @@ pulumi config set --secret dokploy:apiKey "$DOKPLOY_API_KEY"
 Data sources: `getProject`, `getProjects`, `getEnvironment`, `getApplication`,
 `getServers`.
 
+## Deploying from CI
+
+Like the Terraform provider, this one manages *configuration*, not *rollouts*.
+Creating an `Application` writes its definition; it does not build or start
+anything.
+
+[`dokploy-deploy-action`](https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action)
+covers the other half on GitHub Actions and Gitea Actions: it triggers a
+deployment, waits for the build, and fails the job when the deployment fails.
+Export the application id from your stack and hand it over.
+
+```ts
+export const apiApplicationId = api.id;
+```
+
+```yaml
+- uses: https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action@v1
+  with:
+    host: ${{ secrets.DOKPLOY_HOST }}
+    api-key: ${{ secrets.DOKPLOY_API_KEY }}
+    application-id: ${{ steps.stack.outputs.apiApplicationId }}
+    docker-image: ghcr.io/acme/api:${{ github.sha }}
+```
+
 ## Differences from the Terraform provider
 
 Everything is a mechanical translation of the Terraform provider, with three
@@ -138,7 +192,7 @@ Pulumi conventions applied on top:
   instead — see [`examples/typescript/webService.ts`](examples/typescript/webService.ts),
   which is a port of that module.
 
-The [known API quirks](https://github.com/maxvojtkov/terraform-provider-dokploy#known-api-quirks)
+The [known API quirks](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy#known-api-quirks)
 documented upstream apply here unchanged, because it is the same code doing the
 work.
 
@@ -175,11 +229,16 @@ replace github.com/maxvojtkov/terraform-provider-dokploy => ../../dokploy-terafo
 ```
 
 so the two repositories can be developed side by side. CI reproduces that
-layout by checking the upstream provider out as a sibling directory. Once
-`terraform-provider-dokploy` is tagged on GitHub, drop the `replace` and pin a
-real version instead:
+layout by checking the upstream provider out as a sibling directory.
+
+The `replace` is load-bearing here, not just a convenience: the module path
+says `github.com`, but the code lives on Gitea, and Go has no way to discover
+that on its own. It can go away once the upstream provider is published to
+Gitea's Go registry, at which point the module resolves through `GOPROXY`:
 
 ```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
 cd provider && go mod edit -dropreplace github.com/maxvojtkov/terraform-provider-dokploy \
   && go get github.com/maxvojtkov/terraform-provider-dokploy@v0.1.0
 ```
@@ -196,10 +255,20 @@ Tag the repository and the `release` workflow does the rest:
 git tag v0.1.0 && git push origin v0.1.0
 ```
 
-It publishes plugin binaries to a GitHub release via GoReleaser, pushes the
-npm / PyPI / NuGet packages, and commits and tags the Go SDK as `sdk/v0.1.0`.
-The workflow needs three repository secrets: `NPM_TOKEN`, `PYPI_API_TOKEN` and
-`NUGET_PUBLISH_KEY`.
+GoReleaser publishes the plugin binaries to a Gitea release first — Pulumi
+resolves the plugin from there, so it has to exist before anyone installs an
+SDK — and then the four SDKs go to this instance's npm, PyPI, NuGet and Go
+registries.
+
+**No secrets to configure.** Every step authenticates with `secrets.GITEA_TOKEN`,
+which Gitea injects into each run automatically.
+
+Two things the workflow depends on:
+
+- A registered `act_runner` with an `ubuntu-latest` label, and enough of a
+  toolchain for Go, Node, Python and .NET.
+- The upstream `terraform-provider-dokploy` repository being readable by that
+  token, since the `replace` directive needs it checked out as a sibling.
 
 ## License