Add Go demo with isolated CI and manual production release

.gitea/workflows/ci.yaml

@@ -0,0 +1,22 @@
+name: Demo CI
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+concurrency:
+  group: demo-cicd
+  cancel-in-progress: false
+jobs:
+  check:
+    runs-on: demo-build
+    timeout-minutes: 30
+    services:
+      buildkit:
+        image: mirror.gcr.io/moby/buildkit@sha256:f8a833b2de9d68e27f0815e4a737abdfaf8a2e4c615650557df11025101557b4
+    steps:
+      - name: Clean checkout and isolated Go checks
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          SOURCE_SHA: ${{ gitea.sha }}
+        run: python3 /opt/ci/pipeline.py check

.gitea/workflows/release.yaml

@@ -0,0 +1,51 @@
+name: Demo Release
+on:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Release selected Git ref, or roll back to a verified revision
+        type: choice
+        options: [release, rollback]
+        default: release
+        required: true
+      target_revision:
+        description: Full 40-character previously released commit, required only for rollback
+        type: string
+        required: false
+concurrency:
+  group: demo-cicd
+  cancel-in-progress: false
+jobs:
+  build:
+    if: ${{ inputs.operation == 'release' }}
+    runs-on: demo-build
+    timeout-minutes: 30
+    services:
+      buildkit:
+        image: mirror.gcr.io/moby/buildkit@sha256:f8a833b2de9d68e27f0815e4a737abdfaf8a2e4c615650557df11025101557b4
+    steps:
+      - name: Build and publish private immutable candidate
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          SOURCE_SHA: ${{ gitea.sha }}
+          REGISTRY_TOKEN: ${{ secrets.DEMO_REGISTRY_PUSH_TOKEN }}
+        run: python3 /opt/ci/pipeline.py build
+  deploy:
+    needs: [build]
+    if: ${{ always() && ((inputs.operation == 'release' && needs.build.result == 'success') || inputs.operation == 'rollback') }}
+    runs-on: demo-deploy
+    timeout-minutes: 15
+    steps:
+      - name: Verify actual runtime image and deploy
+        env:
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          SOURCE_SHA: ${{ gitea.sha }}
+          TARGET_REVISION: ${{ inputs.target_revision }}
+          OPERATION: ${{ inputs.operation }}
+        run: |
+          case "$OPERATION" in
+            release) python3 /opt/ci/pipeline.py deploy ;;
+            rollback) python3 /opt/ci/pipeline.py rollback ;;
+            *) exit 1 ;;
+          esac