ci: unify workflows - split build per component, single tag-triggered pipeline

.gitea/workflows/ci.yml

@@ -1,19 +1,19 @@
-name: NexusGuard CI
+name: CI
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+    tags:
+      - 'dev-*'
+      - 'v*-beta*'
+      - 'v*-test*'
+      - 'v[0-9]*.[0-9]*.[0-9]'
   pull_request:
-    branches:
-      - main
-
-env:
-  BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
+    branches: [main]
 
 jobs:
   # ──────────────────────────────────────────────
-  # TEST — all 3 components in parallel
+  # TEST — all 3 components in parallel (always)
   # ──────────────────────────────────────────────
   server-core-test:
     runs-on: ubuntu-latest
@@ -25,12 +25,9 @@ jobs:
         with:
           submodules: true
           fetch-depth: 0
-          token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
-          github-server-url: 'https://git.datadunia.com'
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.26'
       - name: Test
         run: go test ./... -tags dev -cover
 
@@ -44,12 +41,9 @@ jobs:
         with:
           submodules: true
           fetch-depth: 0
-          token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
-          github-server-url: 'https://git.datadunia.com'
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25'
+          go-version: '1.26'
       - name: Test
         run: go test ./... -cover
 
@@ -63,9 +57,6 @@ jobs:
         with:
           submodules: true
           fetch-depth: 0
-          token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
-          github-server-url: 'https://git.datadunia.com'
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
@@ -75,93 +66,34 @@ jobs:
         run: npm run build
 
   # ──────────────────────────────────────────────
-  # BUILD — binaries + frontend dist
+  # BUILD — only on tag push, parallel per component
   # ──────────────────────────────────────────────
-  server-core-build:
-    runs-on: ubuntu-latest
-    needs: server-core-test
-    defaults:
-      run:
-        working-directory: apps/server-core
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
-          github-server-url: 'https://git.datadunia.com'
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.25'
-      - name: Build
-        run: go build -o bin/server-core .
-      - name: Upload binary
-        uses: actions/upload-artifact@v4
-        with:
-          name: server-core-linux-amd64
-          path: apps/server-core/bin/server-core
+  build-server-core:
+    if: startsWith(gitea.ref, 'refs/tags/')
+    needs: [server-core-test]
+    uses: ./.gitea/workflows/build_server_core.yaml
 
-  device-agent-cross-build:
-    runs-on: ubuntu-latest
-    needs: device-agent-test
-    strategy:
-      matrix:
-        goos: [linux, windows]
-        goarch: [amd64, arm64]
-        exclude:
-          - goos: windows
-            goarch: arm64
-    defaults:
-      run:
-        working-directory: apps/device-agent
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
-          github-server-url: 'https://git.datadunia.com'
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.25'
-      - name: Build
-        env:
-          CGO_ENABLED: 0
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-        run: |
-          EXT=""
-          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
-          go build -o bin/nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} .
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: apps/device-agent/bin/nexus-device-agent-*
+  build-device-agent:
+    if: startsWith(gitea.ref, 'refs/tags/')
+    needs: [device-agent-test]
+    uses: ./.gitea/workflows/build_device_agent.yaml
 
-  dashboard-dist:
-    runs-on: ubuntu-latest
-    needs: dashboard-test
-    defaults:
-      run:
-        working-directory: apps/dashboard-ui
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.BUILD_TOKEN }}
-          github-server-url: 'https://git.datadunia.com'
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-      - name: Install
-        run: npm ci || npm install
-      - name: Build
-        run: npm run build
-      - name: Upload dist
-        uses: actions/upload-artifact@v4
-        with:
-          name: dashboard-ui-dist
-          path: apps/dashboard-ui/dist/
+  build-dashboard:
+    if: startsWith(gitea.ref, 'refs/tags/')
+    needs: [dashboard-test]
+    uses: ./.gitea/workflows/build_dashboard.yaml
 
+  build-docs:
+    if: startsWith(gitea.ref, 'refs/tags/')
+    uses: ./.gitea/workflows/docs_call.yaml
 
+  # ──────────────────────────────────────────────
+  # RELEASE — after all builds complete
+  # ──────────────────────────────────────────────
+  release:
+    if: startsWith(gitea.ref, 'refs/tags/')
+    needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
+    uses: ./.gitea/workflows/release_call.yaml
+    with:
+      prerelease: ${{ contains(gitea.ref_name, 'dev-') || contains(gitea.ref_name, 'beta') || contains(gitea.ref_name, 'test') }}
+    secrets: inherit