ci: load deploy secrets once

.gitea/workflows/deploy.yml

@@ -15,21 +15,8 @@ env:
   OPENBAO_ENV_FILE: .openbao-env
 
 jobs:
-  build-images:
+  deploy:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: admin-api
-            dockerfile: apps/admin-api/Dockerfile
-            image: git.itexp.me/bsodfather/crank-community-admin-api
-          - name: mcp-server
-            dockerfile: apps/mcp-server/Dockerfile
-            image: git.itexp.me/bsodfather/crank-community-mcp-server
-          - name: ui
-            dockerfile: apps/ui/Dockerfile
-            image: git.itexp.me/bsodfather/crank-community-ui
 
     steps:
       - name: Checkout
@@ -55,35 +42,26 @@ jobs:
           printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
             docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
 
-      - name: Build and push ${{ matrix.name }}
+      - name: Build and push images
         run: |
-          docker build -f '${{ matrix.dockerfile }}' \
-            -t '${{ matrix.image }}:${{ env.IMAGE_TAG }}' \
-            -t '${{ matrix.image }}:main' \
+          docker build -f apps/admin-api/Dockerfile \
+            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.ADMIN_API_IMAGE }}:main' \
             .
-          docker push '${{ matrix.image }}:${{ env.IMAGE_TAG }}'
-          docker push '${{ matrix.image }}:main'
-
-  deploy:
-    needs: build-images
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Verify OpenBao CLI
-        run: |
-          command -v bao
-          bao version
-
-      - name: Load deployment secrets from OpenBao
-        env:
-          BAO_ADDR: ${{ secrets.BAO_ADDR }}
-          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
-          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
-          OPENBAO_APP: crank
-        run: scripts/load-openbao-env.sh
+          docker build -f apps/mcp-server/Dockerfile \
+            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.MCP_SERVER_IMAGE }}:main' \
+            .
+          docker build -f apps/ui/Dockerfile \
+            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.UI_IMAGE }}:main' \
+            .
+          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.ADMIN_API_IMAGE }}:main'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:main'
+          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.UI_IMAGE }}:main'
 
       - name: Configure SSH key
         run: |