Document GitHub Actions deployment secrets

.github/workflows/ci.yml

@@ -21,9 +21,9 @@ jobs:
       NEXT_PUBLIC_SERVER_URL: http://localhost:3000
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Use Node.js 22
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: npm
@@ -50,7 +50,7 @@ jobs:
       IMAGE: git.maro.run/maro/anouma
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Log in to registry
         uses: docker/login-action@v3
         with:

DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # ANOUMA — Deployment
 
-Production deployment is fully CI/CD-driven via Gitea Actions. There is no `update.sh` and the production server never builds anything — it only ever pulls a tested image from the registry.
+Production deployment is fully CI/CD-driven via Gitea or GitHub Actions. There is no `update.sh` and the production server never builds anything — it only ever pulls a tested image from the registry.
 
 ```text
 Developer → git push main → Gitea Actions (CI)
@@ -59,10 +59,11 @@ Nothing runs on the server yet at this point — no release has been built. Push
 
 ```bash
 git tag v1.0.0
-git push origin v1.0.0
+git push github v1.0.0   # GitHub Actions
+# alternativ: git push origin v1.0.0   # Gitea Actions
 ```
 
-Gitea Actions takes it from there (see below). Once it's live, seed the original content once: `ssh anouma-deploy@<host>` won't work (the key is restricted — see Security), so run it directly on the server instead: `cd /opt/anouma && docker compose run --rm app npm run seed`.
+The selected CI provider takes it from there (see below). Once it's live, seed the original content once: `ssh anouma-deploy@<host>` won't work (the key is restricted — see Security), so run it directly on the server instead: `cd /opt/anouma && docker compose run --rm app npm run seed`.
 
 ## Gitea Actions
 
@@ -82,6 +83,33 @@ Triggered by pushing a tag matching `v*` (e.g. `v1.2.0`):
 
 Production always runs a specific version tag — `latest` is pushed for convenience/reference only (and always points at the most recently *released* build, not just the newest commit on `main`), `deploy.sh` never uses it.
 
+## GitHub Actions
+
+The GitHub repository is `whitehai11/anouma`; the workflows live in
+`.github/workflows/ci.yml` and `.github/workflows/release.yml`. In GitHub go to
+**Settings → Secrets and variables → Actions → Repository secrets** and create:
+
+| Secret | Required | Value |
+| --- | --- | --- |
+| `REGISTRY_USERNAME` | yes | Gitea Container-Registry username, normally `maro` |
+| `REGISTRY_PASSWORD` | yes | Gitea access token/password with permission to push/pull `git.maro.run/maro/anouma` |
+| `DEPLOY_HOST` | yes | Public IP or hostname of the production server |
+| `DEPLOY_PORT` | yes | SSH port, normally `22` |
+| `DEPLOY_USER` | yes | `anouma-deploy` |
+| `DEPLOY_SSH_KEY` | yes | Private key generated by `setup.sh` for the restricted deploy user |
+| `DEPLOY_HOST_KEY` | no | Complete SSH host-key line from a trusted `ssh-keyscan`; safer than first-connect trust |
+
+Es werden keine zusätzlichen GitHub-Variables benötigt; Registry und Image
+sind im Workflow fest auf `git.maro.run/maro/anouma` gesetzt. Runtime-Secrets
+wie `PAYLOAD_SECRET`, `MEETING_SESSION_SECRET`, `LIVEKIT_API_SECRET` und
+`DATABASE_URI` gehören ausschließlich in `/opt/anouma/.env` auf dem Server und
+nicht in GitHub Actions.
+
+Wichtig: Für Releases nur einen CI-Anbieter verwenden, damit nicht beide
+Systeme dasselbe Image parallel bauen oder deployen. Für dieses GitHub-Setup
+ist GitHub Actions die empfohlene Quelle; Gitea kann als Spiegel bestehen
+bleiben.
+
 ## `deploy.sh` (server-side, `/opt/anouma/deploy.sh`)
 
 Not a manual tool — it's invoked exclusively by Gitea Actions over SSH. What it does for `deploy.sh deploy vX.Y.Z`: