ci: full CI/CD pipeline via Gitea Actions

Replaces the minimal CI workflow with a complete build/release pipeline:
- lint, typecheck, test (parallel, every push/PR)
- build: TS + completions + bun binaries + RPM packaging
- docker: build & push all 4 images (mcpd, node-runner, python-runner, docmost-mcp)
- publish-rpm: upload RPM to Gitea packages
- deploy: update Portainer stack

Also adds scripts/link-package.sh shared helper to auto-link packages
to the repository (Gitea 1.24+ API with graceful fallback), called from
all build/publish scripts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/build-docmost-mcp.sh

@@ -28,5 +28,9 @@ podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
 echo "==> Pushing to $REGISTRY/michal/$IMAGE:$TAG..."
 podman push --tls-verify=false "$REGISTRY/michal/$IMAGE:$TAG"
 
+# Ensure package is linked to the repository
+source "$SCRIPT_DIR/link-package.sh"
+link_package "container" "$IMAGE"
+
 echo "==> Done!"
 echo "    Image: $REGISTRY/michal/$IMAGE:$TAG"

scripts/build-mcpd.sh

@@ -28,5 +28,9 @@ podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
 echo "==> Pushing to $REGISTRY/michal/$IMAGE:$TAG..."
 podman push --tls-verify=false "$REGISTRY/michal/$IMAGE:$TAG"
 
+# Ensure package is linked to the repository
+source "$SCRIPT_DIR/link-package.sh"
+link_package "container" "$IMAGE"
+
 echo "==> Done!"
 echo "    Image: $REGISTRY/michal/$IMAGE:$TAG"

scripts/build-python-runner.sh

@@ -28,5 +28,9 @@ podman login --tls-verify=false -u michal -p "$GITEA_TOKEN" "$REGISTRY"
 echo "==> Pushing to $REGISTRY/michal/$IMAGE:$TAG..."
 podman push --tls-verify=false "$REGISTRY/michal/$IMAGE:$TAG"
 
+# Ensure package is linked to the repository
+source "$SCRIPT_DIR/link-package.sh"
+link_package "container" "$IMAGE"
+
 echo "==> Done!"
 echo "    Image: $REGISTRY/michal/$IMAGE:$TAG"

scripts/link-package.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Link a Gitea package to a repository.
+# Works automatically on Gitea 1.24+ (uses API), warns on older versions.
+#
+# Usage: source scripts/link-package.sh
+#        link_package <type> <name>
+#
+# Requires: GITEA_URL, GITEA_TOKEN, GITEA_OWNER, GITEA_REPO
+
+link_package() {
+  local PKG_TYPE="$1"  # e.g. "rpm", "container"
+  local PKG_NAME="$2"  # e.g. "mcpctl", "mcpd"
+
+  if [ -z "$PKG_TYPE" ] || [ -z "$PKG_NAME" ]; then
+    echo "Usage: link_package <type> <name>"
+    return 1
+  fi
+
+  local GITEA_URL="${GITEA_URL:-http://10.0.0.194:3012}"
+  local GITEA_OWNER="${GITEA_OWNER:-michal}"
+  local GITEA_REPO="${GITEA_REPO:-mcpctl}"
+
+  if [ -z "$GITEA_TOKEN" ]; then
+    echo "WARNING: GITEA_TOKEN not set, skipping package-repo linking."
+    return 0
+  fi
+
+  # Check if already linked (search all packages, filter by type+name client-side)
+  local REPO_LINK
+  REPO_LINK=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
+    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}" \
+    | python3 -c "
+import json,sys
+for p in json.load(sys.stdin):
+    if p['type']=='$PKG_TYPE' and p['name']=='$PKG_NAME':
+        r=p.get('repository')
+        if r: print(r['full_name'])
+        break
+" 2>/dev/null)
+
+  if [ -n "$REPO_LINK" ]; then
+    echo "==> Package ${PKG_TYPE}/${PKG_NAME} already linked to ${REPO_LINK}"
+    return 0
+  fi
+
+  # Try Gitea 1.24+ link API
+  local HTTP_CODE
+  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/${PKG_TYPE}/${PKG_NAME}/-/link/${GITEA_REPO}")
+
+  if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+    echo "==> Linked ${PKG_TYPE}/${PKG_NAME} to ${GITEA_OWNER}/${GITEA_REPO}"
+    return 0
+  fi
+
+  # API not available (Gitea < 1.24) — warn with manual instructions
+  echo ""
+  echo "WARNING: Could not auto-link ${PKG_TYPE}/${PKG_NAME} to repository (Gitea < 1.24)."
+  echo "Link it manually in the Gitea UI:"
+  echo "  ${GITEA_URL}/${GITEA_OWNER}/-/packages/${PKG_TYPE}/${PKG_NAME}/settings"
+  echo "  -> Link to repository: ${GITEA_OWNER}/${GITEA_REPO}"
+  return 0
+}

scripts/publish-rpm.sh

@@ -51,20 +51,9 @@ curl --fail -s -X PUT \
 echo ""
 echo "==> Published successfully!"
 
-# Verify the package is linked to the repo (Gitea stores the link at package level)
-REPO_LINK=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
-  "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/mcpctl/${RPM_VERSION}" \
-  | python3 -c "import json,sys; d=json.load(sys.stdin); r=d.get('repository'); print(r.get('full_name') if r else '')" 2>/dev/null)
-
-if [ -n "$REPO_LINK" ]; then
-  echo "==> Linked to repo: ${REPO_LINK}"
-else
-  echo ""
-  echo "WARNING: Package is not linked to a repository."
-  echo "Link it manually in the Gitea UI:"
-  echo "  ${GITEA_URL}/${GITEA_OWNER}/-/packages/rpm/mcpctl/${RPM_VERSION}/settings"
-  echo "  → Link to repository: ${GITEA_OWNER}/${GITEA_REPO}"
-fi
+# Ensure package is linked to the repository
+source "$SCRIPT_DIR/link-package.sh"
+link_package "rpm" "mcpctl"
 
 echo ""
 echo "Install with:"