From d9d2dc246a908e970e9b09cc4d51a960a5ffaee6 Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Sat, 11 Jul 2026 09:58:14 -0700
Subject: [PATCH] Add Gitea workflow to sync runner checkout on master changes
 (#2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Implements #1: Gitea Act workflow that fast-forward pulls `~/Documents/repos/server-infra` on the self-hosted runner whenever `master` changes.

- Adds `.gitea/workflows/sync-checkout.yml`
- Triggers on direct push to `master` and on merged PRs targeting `master`
- Refuses to pull if the working tree is dirty
- Documents the workflow in `IMPLEMENTATION.md`

## Test plan

- [ ] Merge PR → workflow runs on self-hosted runner
- [ ] Runner checkout at `/home/westfarn/Documents/repos/server-infra` advances to latest `master` commit
- [ ] Dirty working tree on runner causes workflow to fail (no silent overwrite)
- [ ] Direct push to `master` also triggers sync

Closes #1

Reviewed-on: https://git.aimloperations.com/ai_ml_operations/server-infra/pulls/2
---
 .gitea/workflows/sync-checkout.yml | 36 ++++++++++++++++++++++++++++++
 IMPLEMENTATION.md                  |  5 +++++
 2 files changed, 41 insertions(+)
 create mode 100644 .gitea/workflows/sync-checkout.yml

diff --git a/.gitea/workflows/sync-checkout.yml b/.gitea/workflows/sync-checkout.yml
new file mode 100644
index 0000000..7a6233e
--- /dev/null
+++ b/.gitea/workflows/sync-checkout.yml
@@ -0,0 +1,36 @@
+name: Sync runner checkout
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    types: [closed]
+    branches: [master]
+
+jobs:
+  sync:
+    if: gitea.event_name == 'push' || gitea.event.pull_request.merged == true
+    runs-on: self-hosted
+    steps:
+      - name: Pull latest server-infra
+        run: |
+          set -euo pipefail
+          REPO="/home/westfarn/Documents/repos/server-infra"
+
+          if [[ ! -d "${REPO}/.git" ]]; then
+            echo "Missing git checkout at ${REPO}"
+            exit 1
+          fi
+
+          cd "${REPO}"
+
+          if ! git diff --quiet || ! git diff --cached --quiet; then
+            echo "Working tree is dirty; refusing to pull"
+            git status --short
+            exit 1
+          fi
+
+          git fetch origin master
+          git checkout master
+          git pull --ff-only origin master
+          git rev-parse --short HEAD
diff --git a/IMPLEMENTATION.md b/IMPLEMENTATION.md
index c071e93..e0e3d30 100644
--- a/IMPLEMENTATION.md
+++ b/IMPLEMENTATION.md
@@ -301,6 +301,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
 | `server-infra` checkout | Playbooks + inventory |
 | SSH key to adama + roslin | Deploy fan-out |
 
+On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
+fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
+runner so playbooks and inventory stay current without a manual `git pull`.
+
 ## SSH Keys for CI Deploy
 
 | Key | Used by | Purpose |
@@ -333,6 +337,7 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
 | 7 | Provision all: `./scripts/provision.sh` | Manual |
 | 8 | Deploy SSH key for Act runner | Future |
+| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
 | 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
 | 10 | Dockerize `company_site` | Future (separate ticket) |
 | 11 | Gitea container registry (optional) | Future |