From e22eded2bfa6e6674eb6c2bca17fc3111875c3bd Mon Sep 17 00:00:00 2001
From: Steppenstreuner <jazz.h@gmx.net>
Date: Tue, 1 Sep 2026 18:12:22 +0200
Subject: [PATCH] add(ci): pull and recreate the wordarr container after a
 successful push

---
 .gitea/workflows/build.yml | 30 ++++++++++++++++++++++++++----
 README.md                  |  4 +++-
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 9a826c6..d59c55a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -8,6 +8,9 @@ on:
 jobs:
   image:
     runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-latest
+      options: -v /home/jazz/stacks:/deploy-target -v /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -20,18 +23,37 @@ jobs:
 
       - name: Image bauen und pushen
         env:
-          # GITEA_TOKEN reicht, wenn der Runner Packages schreiben darf;
-          # sonst ein PAT mit package:write als Secret REGISTRY_TOKEN hinterlegen.
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REGISTRY_USER: ${{ vars.REGISTRY_USER }}
+          ACTOR: ${{ gitea.actor }}
         run: |
           command -v docker >/dev/null || { apt-get update -qq && apt-get install -y -qq docker.io; }
           sha=$(git rev-parse --short HEAD)
           image=gitea.steppencloud.de/admin/wordarr
           token=${REGISTRY_TOKEN:-$GITEA_TOKEN}
-          echo "$token" | docker login gitea.steppencloud.de -u "${{ gitea.actor }}" --password-stdin
-          # der sha landet als Build-Stempel neben der Version im UI
+          echo "$token" | docker login gitea.steppencloud.de -u "${REGISTRY_USER:-$ACTOR}" --password-stdin
           docker build --build-arg WORDARR_BUILD="$sha" -t "$image:$sha" -t "$image:latest" .
           docker push "$image:$sha"
           docker push "$image:latest"
           echo "Gepusht: $image:latest ($sha)"
+
+      - name: wordarr im arr-Stack neu ziehen
+        run: |
+          mountpoint -q /deploy-target || {
+            echo "::error::/deploy-target ist nicht gemountet - valid_volumes im act_runner pruefen"
+            exit 1
+          }
+          if docker compose version >/dev/null 2>&1; then
+            compose="docker compose"
+          elif command -v docker-compose >/dev/null 2>&1; then
+            compose="docker-compose"
+          else
+            apt-get update -qq && apt-get install -y -qq docker-compose-v2
+            compose="docker compose"
+          fi
+          cd /deploy-target/arr
+          $compose pull wordarr     # ohne pull bleibt :latest das alte Image
+          $compose up -d wordarr
+          echo "Laeuft:"
+          docker inspect -f '{{.Config.Image}} seit {{.State.StartedAt}}' wordarr
diff --git a/README.md b/README.md
index aee95a9..2f093c6 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,9 @@ between them and remembers the choice. Without one, the browser language decides
 builds and pushes `gitea.steppencloud.de/admin/wordarr` as `:latest` and
 `:<short sha>`, passing that sha as `WORDARR_BUILD`. It logs in with
 `REGISTRY_TOKEN` if the secret exists, otherwise with the runner's own
-`GITEA_TOKEN`. Rolling the new image out stays a manual step (dockhand).
+`GITEA_TOKEN`. The last step pulls the fresh image on the host and recreates
+just the wordarr container of the arr stack, so the version in the header is the
+commit that was pushed.
 
 ## Usage