From c3fd87790de00da10fd7f3b9ae437af23a88784c Mon Sep 17 00:00:00 2001
From: bakerboy448 <55419169+bakerboy448@users.noreply.github.com>
Date: Mon, 9 Nov 2026 20:23:49 -0600
Subject: [PATCH] ci: automatic CalVer release and self-hosted deploy runner

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      |  4 +++-
 .github/workflows/deploy.yml  |  4 ++--
 .github/workflows/release.yml | 25 +++++++++++++++++++++++++
 3 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7baac06..5ca1509 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,8 @@
 name: CI
 
 "on":
+  push:
+    branches: [main]
   pull_request:
     branches: [main]
 
@@ -11,7 +13,7 @@ permissions:
 jobs:
   docs-build:
     # Fork PRs never run on the self-hosted runner.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, Linux, X64, hetzner]
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 07d2f0c..3cf1664 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, hetzner]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -50,7 +50,7 @@ jobs:
 
   deploy:
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, hetzner]
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..3664e1b
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,25 @@
+---
+name: Release
+
+"on":
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release
+    if: >-
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      contents: write
+      actions: read
+    uses: bakerboy448/.github/.github/workflows/release-calver-gated.yml@3f32d193e96c22760f874cc5ae35e0f072e0a173
+    with:
+      sha: ${{ github.event.workflow_run.head_sha }}
+      required_workflows: ci.yml