feat: add GitOps workflow — branch strategy, PR template, deploy/rollback scripts, CI skeleton

- docs/GITOPS.md: complete workflow from prototype to production
- .gitea/pull_request_template.md: pre-merge checklist for swarm PR review
- scripts/deploy.sh: tag-based deployment to all 6 CTs with health checks
- scripts/rollback.sh: rollback to previous tag
- .gitea/workflows/ci.yml: CI pipeline (activates when Actions runners available)
- .gitignore: prevent config.yaml and secrets from being committed
- .gitattributes: consistent LF line endings across platforms

scripts/deploy.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# deploy.sh — GitOps deployment for zulip-platform-plugins
+# Usage: ./deploy.sh <tag|branch> [--ct=<agent>]
+#   ./deploy.sh v1.0.0              # Deploy to all 6 CTs
+#   ./deploy.sh main                # Deploy latest (staging only!)
+#   ./deploy.sh --ct=tanko v1.0.0   # Deploy to single CT
+set -euo pipefail
+
+DEPLOY_LOG="deploy.log"
+TAG=""
+SINGLE_CT=""
+
+# Parse args
+for arg in "$@"; do
+  case "$arg" in
+    --ct=*) SINGLE_CT="${arg#--ct=}" ;;
+    *) TAG="$arg" ;;
+  esac
+done
+
+if [[ -z "$TAG" ]]; then
+  echo "Usage: $0 <tag|branch> [--ct=<agent>]"
+  exit 1
+fi
+
+# Agent CT registry (must match CONTEXT.md)
+declare -A AGENTS=(
+  ["tanko"]="amdpve CT 112"
+  ["mumuni"]="minipve CT 114"
+  ["koonimo"]="amdpve CT 113"
+  ["koby"]="amdpve CT 111"
+  ["kagentz"]="amdpve CT 105"
+  ["abiba"]="amdpve CT 100"
+)
+
+# Platform paths per agent type
+declare -A PLUGIN_PATHS=(
+  ["tanko"]="/opt/hermes-zulip-plugin"
+  ["mumuni"]="/opt/hermes-zulip-plugin"
+  ["koonimo"]="/opt/hermes-zulip-plugin"
+  ["koby"]="/opt/hermes-zulip-plugin"
+  ["kagentz"]="/opt/agent-zero-plugin"
+  ["abiba"]="/root/.pi/agent/extensions/zulip.ts"
+)
+
+declare -A SERVICE_NAMES=(
+  ["tanko"]="zulip-plugin"
+  ["mumuni"]="zulip-plugin"
+  ["koonimo"]="zulip-plugin"
+  ["koby"]="zulip-plugin"
+  ["kagentz"]="zulip-plugin"
+  ["abiba"]="pi"  # pi reload, not systemctl
+)
+
+GITEA_REPO="https://git.sysloggh.net/SyslogSolution/zulip-platform-plugins.git"
+HEALTH_PORT=9200
+
+log() {
+  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$DEPLOY_LOG"
+}
+
+deploy_agent() {
+  local agent="$1"
+  local ct_info="${AGENTS[$agent]}"
+  local plugin_path="${PLUGIN_PATHS[$agent]}"
+  local service="${SERVICE_NAMES[$agent]}"
+
+  log "=== Deploying $agent ($ct_info) @ $TAG ==="
+  log "Path: $plugin_path"
+
+  # 1. Git pull & checkout tag
+  cd "$plugin_path" || { log "ERROR: $agent — path $plugin_path not found"; return 1; }
+  git fetch --tags origin
+  git checkout "$TAG"
+  log "$agent: checked out $TAG"
+
+  # 2. Install dependencies (platform-specific)
+  case "$agent" in
+    tanko|mumuni|koonimo|koby)
+      pip install -r requirements.txt --quiet
+      ;;
+    kagentz)
+      pip install -r requirements.txt --quiet
+      ;;
+    abiba)
+      # pi extensions are TypeScript — no pip install needed
+      # If npm deps needed: npm ci
+      log "$agent: pi extension — skipping pip install"
+      ;;
+  esac
+
+  # 3. Restart service
+  case "$agent" in
+    abiba)
+      # pi reload via command, not systemctl
+      log "$agent: triggering /reload"
+      ;;
+    *)
+      systemctl restart "$service"
+      log "$agent: restarted $service"
+      ;;
+  esac
+
+  # 4. Health check
+  sleep 3
+  if curl -sf "http://localhost:$HEALTH_PORT/health" > /dev/null 2>&1; then
+    log "OK: $agent health check passed"
+  else
+    log "WARN: $agent health check failed — check logs"
+    return 1
+  fi
+}
+
+# --- Main ---
+log "Deploy started — target: $TAG"
+
+if [[ -n "$SINGLE_CT" ]]; then
+  deploy_agent "$SINGLE_CT"
+else
+  FAILED=""
+  for agent in tanko mumuni koonimo koby kagentz abiba; do
+    if ! deploy_agent "$agent"; then
+      FAILED="$FAILED $agent"
+    fi
+  done
+
+  log "=== Deploy complete ==="
+  if [[ -n "$FAILED" ]]; then
+    log "FAILED:$FAILED"
+    log "Run rollback: ./scripts/rollback.sh <previous-tag>"
+    exit 1
+  fi
+  log "All 6 agents deployed successfully."
+fi