CI: publish the builds as a download site, deploy via Coolify

The deployed image is now a small nginx site instead of a bare app
tree: the Linux app (with its runtime), a universal jar, the Android
APK, SHA256SUMS and a landing page showing the commit and build date.

- desktop: universalJar bundles the Skiko natives for Linux, macOS and
  Windows (Compose's own jar only carries the building OS's).
- Dockerfile: the build stage runs tests and builds every artifact;
  site/assemble.sh lays them out; the final stage is nginx:alpine.
- .ci: after the image is built, `main` calls the beta Coolify hook and
  `release` the production one; other branches only build.
- .dockerignore keeps local.properties and secrets out of the build.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2 files changed, 43 insertions, 3 deletions

diff --git a/.ci/ci.cjs b/.ci/ci.cjs
index f7a5dec..f903738 100755
--- a/.ci/ci.cjs
+++ b/.ci/ci.cjs
@@ -5019,6 +5019,16 @@ var isPipeline = (t) => (0, import_pengueno3.isObject)(t) && "serialJobs" in t &
 var REGISTRY = "img.liz.coffee";
 var NAMESPACE = "emprespresso";
 var IMG = "rookery";
+var getReleaseDeployment = (branch) => {
+  switch (branch) {
+    case "release":
+      return "https://plane.liz.coffee/api/v1/deploy?uuid=vzhqmprh2hqbjjcqrzxwkzww&force=false";
+    case "main":
+      return "https://plane.liz.coffee/api/v1/deploy?uuid=0hgnqywenjjcfltl6hoxmro0&force=false";
+    default:
+      return null;
+  }
+};
 var getPipeline = () => {
   const gitHookPipeline = new DefaultGitHookPipelineBuilder();
   const branch = gitHookPipeline.getBranch();
@@ -5038,6 +5048,14 @@ var getPipeline = () => {
     }
   };
   gitHookPipeline.addStage({ parallelJobs: [build] });
+  const webhookUrl = getReleaseDeployment(branch);
+  if (webhookUrl === null)
+    return gitHookPipeline.build();
+  const deploy = {
+    type: "coolify_webhook.js",
+    arguments: { webhookUrl }
+  };
+  gitHookPipeline.addStage({ parallelJobs: [deploy] });
   return gitHookPipeline.build();
 };
 var main = () => {
diff --git a/.ci/ci.ts b/.ci/ci.ts
index 7908462..c0c8597 100644
--- a/.ci/ci.ts
+++ b/.ci/ci.ts
@@ -1,14 +1,27 @@
 #!/usr/bin/env node
 
-import { BuildDockerImageJob, DefaultGitHookPipelineBuilder } from "@emprespresso/ci_model";
+import { BuildDockerImageJob, CoolifyWebhookJob, DefaultGitHookPipelineBuilder } from "@emprespresso/ci_model";
 
 const REGISTRY = "img.liz.coffee";
 const NAMESPACE = "emprespresso";
 const IMG = "rookery";
 
+/** Coolify deploy hooks: `release` is the public download site, `main` is the beta one. Other branches only build. */
+const getReleaseDeployment = (branch: string) => {
+  switch (branch) {
+    case "release":
+      return "https://plane.liz.coffee/api/v1/deploy?uuid=vzhqmprh2hqbjjcqrzxwkzww&force=false";
+    case "main":
+      return "https://plane.liz.coffee/api/v1/deploy?uuid=0hgnqywenjjcfltl6hoxmro0&force=false";
+    default:
+      return null;
+  }
+};
+
 /**
- * Every push: build the Dockerfile's `rookery` target, which runs the whole test suite
- * (`gradlew check`) and packages the desktop app. A failing test fails the image build.
+ * Every push builds the Dockerfile's `rookery` target: the test suite runs, the apps are built, and the
+ * result is a small web server with a download page (a failing test fails the image build). Pushes to
+ * `main` and `release` then tell Coolify to pull the new image.
  */
 const getPipeline = () => {
   const gitHookPipeline = new DefaultGitHookPipelineBuilder();
@@ -30,6 +43,15 @@ const getPipeline = () => {
   };
   gitHookPipeline.addStage({ parallelJobs: [build] });
 
+  const webhookUrl = getReleaseDeployment(branch);
+  if (webhookUrl === null) return gitHookPipeline.build();
+
+  const deploy: CoolifyWebhookJob = {
+    type: "coolify_webhook.js",
+    arguments: { webhookUrl },
+  };
+  gitHookPipeline.addStage({ parallelJobs: [deploy] });
+
   return gitHookPipeline.build();
 };