ci check #0

README.md

@@ -42,16 +42,35 @@ Gitea Actions variables:
 - `STACK_NAME` — optional, defaults to `progcode`.
 - `TRAEFIK_NETWORK` — optional, defaults to `traefik-public`.
 - `TRAEFIK_ENTRYPOINT` — optional, defaults to `websecure`.
-- `PUSH_LATEST` — optional, set to `true` to also push `${IMAGE_REPO}:latest`.
+- The workflow also pushes `${IMAGE_REPO}:latest` automatically.
 
 Gitea Actions secrets:
 
-- `REGISTRY_USER`
+- `REGISTRY_USERNAME`
 - `REGISTRY_PASSWORD`
-- `DEPLOY_SSH_KEY` — only when deploying to a remote Swarm manager over SSH.
+- `SWARM_MANAGER_HOST`
+- `SWARM_SSH_USER`
+- `SWARM_SSH_PORT` — optional, defaults to `22`.
 
-Remote Swarm deploy variables:
+The workflow follows the same SSH model as `ohuello`: the deploy SSH private key is not stored in Gitea secrets. It must be created on the Gitea runner host and mounted into job containers as `/root/.ssh:ro`, including `known_hosts`.
 
-- `DEPLOY_HOST`
-- `DEPLOY_USER`
-- `DEPLOY_PORT` — optional, defaults to `22`.
+Example account or organization variables:
+
+```text
+REGISTRY=git.example.com
+IMAGE_REPO=git.example.com/huncode/progcode
+DOMAIN=progcode.example.com
+STACK_NAME=progcode
+TRAEFIK_NETWORK=traefik-public
+TRAEFIK_ENTRYPOINT=websecure
+```
+
+Example account or organization secrets:
+
+```text
+REGISTRY_USERNAME=<gitea-user-or-token-user>
+REGISTRY_PASSWORD=<gitea-token>
+SWARM_MANAGER_HOST=<swarm-manager-origin-ip-or-ssh-host>
+SWARM_SSH_USER=deploy
+SWARM_SSH_PORT=22
+```