From ec6446420531650b6ac230b47d550757ac100587 Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Sat, 11 Jul 2026 11:49:38 -0500
Subject: [PATCH] Add Gitea workflow to sync runner checkout on master changes.

Keeps ~/Documents/repos/server-infra on the Act runner up to date after
direct pushes and merged PRs so CI deploy steps use current playbooks.
---
 .gitea/workflows/sync-checkout.yml | 36 ++++++++++++++++++++++++++++++
 IMPLEMENTATION.md                  |  5 +++++
 2 files changed, 41 insertions(+)
 create mode 100644 .gitea/workflows/sync-checkout.yml

diff --git a/.gitea/workflows/sync-checkout.yml b/.gitea/workflows/sync-checkout.yml
new file mode 100644
index 0000000..7a6233e
--- /dev/null
+++ b/.gitea/workflows/sync-checkout.yml
@@ -0,0 +1,36 @@
+name: Sync runner checkout
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    types: [closed]
+    branches: [master]
+
+jobs:
+  sync:
+    if: gitea.event_name == 'push' || gitea.event.pull_request.merged == true
+    runs-on: self-hosted
+    steps:
+      - name: Pull latest server-infra
+        run: |
+          set -euo pipefail
+          REPO="/home/westfarn/Documents/repos/server-infra"
+
+          if [[ ! -d "${REPO}/.git" ]]; then
+            echo "Missing git checkout at ${REPO}"
+            exit 1
+          fi
+
+          cd "${REPO}"
+
+          if ! git diff --quiet || ! git diff --cached --quiet; then
+            echo "Working tree is dirty; refusing to pull"
+            git status --short
+            exit 1
+          fi
+
+          git fetch origin master
+          git checkout master
+          git pull --ff-only origin master
+          git rev-parse --short HEAD
diff --git a/IMPLEMENTATION.md b/IMPLEMENTATION.md
index c071e93..e0e3d30 100644
--- a/IMPLEMENTATION.md
+++ b/IMPLEMENTATION.md
@@ -301,6 +301,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
 | `server-infra` checkout | Playbooks + inventory |
 | SSH key to adama + roslin | Deploy fan-out |
 
+On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
+fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
+runner so playbooks and inventory stay current without a manual `git pull`.
+
 ## SSH Keys for CI Deploy
 
 | Key | Used by | Purpose |
@@ -333,6 +337,7 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
 | 7 | Provision all: `./scripts/provision.sh` | Manual |
 | 8 | Deploy SSH key for Act runner | Future |
+| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
 | 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
 | 10 | Dockerize `company_site` | Future (separate ticket) |
 | 11 | Gitea container registry (optional) | Future |