feat(ci): add draft/prerelease mapping, enforce tests before stable release

- release_call.yaml: add draft input, use draft+prerelease in JSON body
- ci.yml test jobs: run for test tags AND stable release tags
- ci.yml build jobs: add needs on test jobs (skipped jobs dont block)
- ci.yml release: draft=true for beta, prerelease=true for dev, plain for stable

.gitea/workflows/ci.yml

@@ -10,9 +10,9 @@ on:
       - 'v[0-9]*.[0-9]*.[0-9]'
 
 jobs:
-  # --- TESTS (only for test tags) ---
+  # --- TESTS (test tags + stable release tags) ---
   server-core-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -36,7 +36,7 @@ jobs:
         run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1
 
   device-agent-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -55,7 +55,7 @@ jobs:
         run: go test ./... -cover
 
   dashboard-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -76,27 +76,31 @@ jobs:
         working-directory: apps/dashboard-ui
         run: npm run build
 
-  # --- BUILD + RELEASE (only for dev/beta/release tags, no tests needed) ---
+  # --- BUILD + RELEASE (dev/beta/release tags) ---
   build-server-core:
     if: "!contains(gitea.ref_name, 'test')"
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_server_core.yaml
     secrets: inherit
 
   build-device-agent:
     if: "!contains(gitea.ref_name, 'test')"
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_device_agent.yaml
     secrets: inherit
 
   build-dashboard:
     if: "!contains(gitea.ref_name, 'test')"
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_dashboard.yaml
     secrets: inherit
 
   build-docs:
     if: "!contains(gitea.ref_name, 'test')"
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/docs_call.yaml
     secrets: inherit
@@ -106,5 +110,6 @@ jobs:
     needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
     uses: ./.gitea/workflows/release_call.yaml
     with:
-      prerelease: ${{ contains(gitea.ref_name, 'dev-') || contains(gitea.ref_name, 'beta') }}
+      prerelease: ${{ contains(gitea.ref_name, 'dev') }}
+      draft: ${{ contains(gitea.ref_name, 'beta') }}
     secrets: inherit

.gitea/workflows/release_call.yaml

@@ -8,6 +8,11 @@ on:
         required: false
         type: boolean
         default: false
+      draft:
+        description: 'Mark as draft'
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -65,7 +70,7 @@ jobs:
           fi
 
           # Create release
-          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":false,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.prerelease }}")
+          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":%s,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.draft }}" "${{ inputs.prerelease }}")
           RELEASE_RESP=$(curl -s -X POST \
             -H "Authorization: token $TOKEN" \
             -H "Content-Type: application/json" \