feat: polish deployment and cd pipeline

.github/workflows/ci.yml

@@ -83,3 +83,17 @@ jobs:
       - name: Run UI tests
         working-directory: apps/ui
         run: npm run test -- --run
+
+  deployment:
+    name: Deployment Artifacts
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Validate docker compose
+        run: docker compose config -q
+
+      - name: Build deployable images
+        run: docker compose build admin-api mcp-server ui

.github/workflows/deploy.yml

@@ -1,22 +1,33 @@
 name: Deploy
 
 on:
-  push:
-    branches:
-      - main
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
   workflow_dispatch:
 
 concurrency:
-  group: deploy-${{ github.ref }}
+  group: deploy-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref }}
   cancel-in-progress: true
 
 jobs:
   deploy:
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_branch == 'main'
+      )
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
       - name: Configure SSH key
         run: |
@@ -50,6 +61,7 @@ jobs:
           ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
             set -e
             cd '${{ secrets.DEPLOY_PATH }}'
+            docker compose config -q
             docker compose up -d --build --remove-orphans
           "
 
@@ -57,6 +69,16 @@ jobs:
         run: |
           ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
             set -e
-            curl --fail --silent http://127.0.0.1:3001/health >/dev/null
-            curl --fail --silent http://127.0.0.1:3002/health >/dev/null
+            cd '${{ secrets.DEPLOY_PATH }}'
+            for attempt in \$(seq 1 30); do
+              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
+                exit 0
+              fi
+              sleep 2
+            done
+            echo 'deployment health verification failed' >&2
+            docker compose ps >&2
+            exit 1
           "