From 4e09f27e4db8f7070f5b7ec20a4de2050ed8d4d7 Mon Sep 17 00:00:00 2001
From: Gelu <gelu@mihes.ro>
Date: Mon, 24 Aug 2026 11:01:35 +0000
Subject: [PATCH] ci: trigger Watchtower instead of waiting for its poll

The poll is the fallback, not the mechanism. It is 30s on staging but 300s
on production, so a green run could sit five minutes ahead of the deploy it
claimed to have made -- the smoke job was absorbing that wait.

Copied from easyDent verbatim, including the soft failure: an unset secret
or an unreachable API logs and falls back to the poll rather than failing
the build. That matters right now because production has no Watchtower HTTP
API yet, so the production URL will do nothing until the infra stack there
is updated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpTYCBLH58XzrM7n3xPJ5N
---
 .gitea/workflows/build.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 154d406..dfe370e 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -108,6 +108,25 @@ jobs:
         run: |
           docker push "${REGISTRY_HOST}/${PAGE_FETCHER_API_IMAGE}:${IMAGE_TAG}"
 
+      # Watchtower's poll is the fallback, not the mechanism: 30s on staging but 300s on
+      # production, so without this a green run can sit five minutes ahead of the deploy it
+      # claims to have made. Copied from easyDent, including the soft failure -- an unset
+      # secret or an unreachable API must degrade to the poll, never fail the build.
+      - name: Trigger Watchtower redeploy
+        env:
+          URL_STAGING: ${{ secrets.WATCHTOWER_URL_STAGING }}
+          URL_PRODUCTION: ${{ secrets.WATCHTOWER_URL_PRODUCTION }}
+          TOKEN: ${{ secrets.WATCHTOWER_TOKEN }}
+        run: |
+          if [ "${IMAGE_TAG}" = "production" ]; then URL="${URL_PRODUCTION}"; else URL="${URL_STAGING}"; fi
+          if [ -n "${URL}" ] && [ -n "${TOKEN}" ]; then
+            echo "Triggering Watchtower at ${URL}"
+            curl -sf -m 30 -H "Authorization: Bearer ${TOKEN}" "${URL}" && echo "  -> redeploy triggered" \
+              || echo "  -> trigger failed; Watchtower will still pick it up on the next poll"
+          else
+            echo "Watchtower push-trigger not configured (WATCHTOWER_* secrets unset); relying on the poll interval."
+          fi
+
       - name: Reclaim disk space (keep recent build cache)
         if: always()
         run: |