ci: workflow по стандартному шаблону Gitea Actions

Workflow приведён к шаблону из memory/reference_gitea_actions.md:
- runs-on: ubuntu-latest (act_runner на str-u-01 даёт node:20-bookworm)
- apt-get install openssh-client (нет в node:20 by default)
- secrets: SSH_DEPLOY_KEY (raw private key, не base64) + SSH_KNOWN_HOSTS
- ssh ... bash -s <<'REMOTE' с git clone/pull, docker compose build+up,
  health-check curl, docker image prune retention 7d

.gitea/workflows/deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy to web.hhivp.com
+name: deploy
 
 on:
   push:
@@ -9,34 +9,42 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - name: Set up SSH key
+      - name: Install SSH client
         run: |
-          mkdir -p ~/.ssh
+          apt-get update -qq
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/deploy_key
+          apt-get install -y --no-install-recommends openssh-client
-          chmod 600 ~/.ssh/deploy_key
-          cat >> ~/.ssh/config <<EOF
-          Host web
-            HostName ${{ secrets.SSH_HOST }}
-            User ${{ secrets.SSH_USER }}
-            Port ${{ secrets.SSH_PORT }}
-            IdentityFile ~/.ssh/deploy_key
-            StrictHostKeyChecking accept-new
-            UserKnownHostsFile ~/.ssh/known_hosts
-          EOF
 
-      - name: Deploy
+      - name: Setup SSH
         run: |
-          ssh web 'bash -s' <<'REMOTE'
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "${{ secrets.SSH_DEPLOY_KEY }}" > ~/.ssh/id_deploy
+          chmod 600 ~/.ssh/id_deploy
+          printf '%s\n' "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Deploy to web.hhivp.com
+        run: |
+          ssh -i ~/.ssh/id_deploy striker@web.hhivp.com bash -s <<'REMOTE'
           set -euo pipefail
-          cd /opt/docker/sites/anotherreflections-ru-v2
+          REPO_URL="ssh://git@git.striker.su:2222/striker/anotherreflections-website-v2.git"
-          git fetch --prune origin
+          DEPLOY_PATH="/opt/docker/sites/anotherreflections-ru-v2"
-          git reset --hard origin/main
+          HEALTH_URL="http://127.0.0.1:4084/"
-          docker compose build --pull
+
+          if [ ! -d "$DEPLOY_PATH/.git" ]; then
+            mkdir -p "$DEPLOY_PATH"
+            git clone --branch main "$REPO_URL" "$DEPLOY_PATH"
+          else
+            cd "$DEPLOY_PATH"
+            git remote set-url origin "$REPO_URL"
+            git fetch origin main
+            git reset --hard origin/main
+          fi
+
+          cd "$DEPLOY_PATH"
+          docker compose build
           docker compose up -d
-          # Чистка старых образов (CI/CD retention >7d по правилу проекта)
+          sleep 5
+          docker compose ps
+          curl -fsS -o /dev/null -w "HEALTH HTTP %{http_code}\n" "$HEALTH_URL"
           docker image prune -af --filter "until=168h" >/dev/null 2>&1 || true
           REMOTE
-
-      - name: Verify
-        run: |
-          ssh web 'curl -sf -H "Host: anotherreflections.ru" http://127.0.0.1:4084/ -o /dev/null -w "HTTP %{http_code} | %{size_download} bytes\n"'