From 517bbdf77c11786af0c03c3b68c7e1535908be93 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Wed, 22 Jul 2026 12:18:36 -0700
Subject: [PATCH] Add dev-branch flow: build.yml workflow_call + pr-build.yml +
 deploy-dev.yml (LAN dev)

---
 .forgejo/workflows/build.yml      | 11 +++++-
 .forgejo/workflows/deploy-dev.yml | 62 +++++++++++++++++++++++++++++++
 .forgejo/workflows/pr-build.yml   | 28 ++++++++++++++
 3 files changed, 99 insertions(+), 2 deletions(-)
 create mode 100644 .forgejo/workflows/deploy-dev.yml
 create mode 100644 .forgejo/workflows/pr-build.yml

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index b6ce42a..99b9adf 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -12,12 +12,19 @@ name: Build check
 # gap, not silently skipped. Full pytest-suite migration is separate,
 # deferred follow-up work too, same category as thermograph-copy's deferred
 # vendoring.
+#
+# workflow_call added alongside `dev` on both push/pull_request filters
+# (dev-branch flow, mirroring the monorepo's build.yml): pr-build.yml (PRs
+# into dev) and deploy-dev.yml (pushes to dev) both `uses:` this file as
+# their shared build gate, same build-only behavior either way -- direct
+# push/PR-to-main triggers are unchanged.
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
-    branches: [main]
+    branches: [main, dev]
+  workflow_call: {}
 
 jobs:
   build:
diff --git a/.forgejo/workflows/deploy-dev.yml b/.forgejo/workflows/deploy-dev.yml
new file mode 100644
index 0000000..fe19fa2
--- /dev/null
+++ b/.forgejo/workflows/deploy-dev.yml
@@ -0,0 +1,62 @@
+name: Deploy to LAN dev server
+
+# Fires on every push to `dev` -- a direct push, or the real merge commit a
+# native "auto merge when checks succeed" produces (see pr-build.yml). Mirrors
+# the monorepo's .forgejo/workflows/deploy-dev.yml, split to roll only the
+# frontend service.
+#
+# INERT until the LAN dev box is reprovisioned: deploy-dev.sh does not live in
+# this repo's checkout -- it lives in the INFRA checkout at
+# $HOME/thermograph-dev on that box (and self-updates there via its own `git
+# reset` against thermograph-infra), the same way the monorepo's deploy-dev.sh
+# is invoked. That box is currently provisioned as a thermograph (monorepo)
+# checkout, not a thermograph-infra one, so until it's reprovisioned this
+# job's deploy step has nothing to run against and will fail at the shell
+# call below -- expected, not a bug in this workflow.
+
+on:
+  push:
+    branches: [dev]
+  workflow_dispatch: {}
+
+jobs:
+  build:
+    name: build
+    # Fixed (unparameterized) group, same convention as the deploy job's
+    # below: if two pushes to dev land close together, the newer push's
+    # build cancels the older's still-running one rather than letting both
+    # run to completion on the single physical runner -- the older push's
+    # result would just be thrown away once needs:build gates its deploy
+    # against a stale build anyway. Safe to cancel mid-run: build.yml only
+    # proves the Dockerfile builds, nothing persisted.
+    concurrency:
+      group: dev-push-build
+      cancel-in-progress: true
+    uses: ./.forgejo/workflows/build.yml
+
+  deploy:
+    needs: build
+    # NOT [self-hosted, thermograph-lan] -- GitHub implicitly tags every
+    # self-hosted runner with "self-hosted" automatically; Forgejo's runner
+    # has only the labels it was explicitly registered with ("docker" +
+    # "thermograph-lan", no "self-hosted"). The array form would silently
+    # make this job unschedulable on every push, same gotcha the monorepo's
+    # deploy-dev.yml documents and fixes the same way.
+    runs-on: thermograph-lan
+    # Only needs to read the repo to compute the SHA tag.
+    permissions:
+      contents: read
+    concurrency:
+      group: dev-lan-deploy
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute image tag
+        id: tag
+        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
+
+      - name: Deploy to the LAN dev server
+        run: |
+          SERVICE=frontend FRONTEND_IMAGE_TAG=${{ steps.tag.outputs.tag }} \
+            bash "$HOME/thermograph-dev/deploy/deploy-dev.sh"
diff --git a/.forgejo/workflows/pr-build.yml b/.forgejo/workflows/pr-build.yml
new file mode 100644
index 0000000..435b8e9
--- /dev/null
+++ b/.forgejo/workflows/pr-build.yml
@@ -0,0 +1,28 @@
+name: PR build (required check)
+
+# Every PR into `dev` runs the build check. Mirrors the monorepo's
+# .forgejo/workflows/pr-build.yml -- Forgejo has native branch protection +
+# auto-merge, so this workflow's only job is to BE the required status check;
+# there is no custom merge step here.
+#
+# One-time web UI setup (not expressible in this file):
+#   Settings -> Branches -> add a protected-branch rule for `dev`
+#     -> enable "Enable Status Check", list this job's name ("build")
+#     -> merge style: squash
+#   Then on a ready PR: "Auto merge when checks succeed".
+#
+# A native auto-merge is a real git merge, so it fires deploy-dev.yml's push
+# trigger naturally -- no separate deploy job needed here.
+
+on:
+  pull_request:
+    branches: [dev]
+
+concurrency:
+  group: dev-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build
+    uses: ./.forgejo/workflows/build.yml