Trigger Dokploy from workflow secret

.gitea/workflows/build-and-deploy.yml

@@ -33,6 +33,32 @@ jobs:
           docker buildx inspect --bootstrap
           docker buildx build --push --provenance=false --tag "$IMAGE_SHA" --tag "$IMAGE_LATEST" .
 
+      - name: Skip stale deployment
+        run: |
+          set -euo pipefail
+          latest_sha="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+          if [ "$latest_sha" = "${GITHUB_SHA}" ]; then
+            touch .deploy-current
+          else
+            echo "A newer main commit exists: $latest_sha. Skipping deploy for ${GITHUB_SHA}."
+          fi
+
+      - name: Trigger Dokploy deploy webhook
+        run: |
+          set -euo pipefail
+          [ -f .deploy-current ] || exit 0
+          payload=$(cat <<JSON
+          {"ref":"refs/heads/main","after":"$GITHUB_SHA","commits":[{"id":"$GITHUB_SHA","message":"$SERVICE_NAME #${GITHUB_RUN_NUMBER:-0} ${GITHUB_SHA:0:7}","modified":["Dockerfile"]}]}
+          JSON
+          )
+          response_file="$(mktemp)"
+          status_code="$(curl -sS -o "$response_file" -w "%{http_code}" -X POST "${{ secrets.DOKPLOY_DEPLOY_WEBHOOK }}" \
+            -H "x-gitea-event: push" \
+            -H "Content-Type: application/json" \
+            -d "$payload")"
+          cat "$response_file"
+          [ "$status_code" = "200" ]
+
       - name: Prune shared BuildKit cache
         run: |
           set -euo pipefail