ci: add notify-failure, deploy tagging, and coverage reporting

- lint.yml: add notify-failure Matrix alert job; add Tag deployed commit
  step to deploy job with deploy-YYYY.MM.DD-N tagging via Gitea API
- test.yml: add pytest-cov for coverage reporting
- .coveragerc: omit tests and site-packages from coverage

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.coveragerc

@@ -0,0 +1,7 @@
+[run]
+omit =
+    tests/*
+    */site-packages/*
+
+[report]
+show_missing = True

.gitea/workflows/lint.yml

@@ -34,11 +34,31 @@ jobs:
       - name: Run ESLint
         run: npx eslint --ext .js static/
 
+  notify-failure:
+    name: Notify on failure
+    runs-on: ubuntu-latest
+    needs: [python-lint, js-lint]
+    if: failure() && github.event_name == 'push'
+    steps:
+      - name: Send Matrix alert
+        env:
+          MATRIX_WEBHOOK_URL: ${{ secrets.MATRIX_WEBHOOK_URL }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.ref_name }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          if [ -z "$MATRIX_WEBHOOK_URL" ] || [ "$MATRIX_WEBHOOK_URL" = "CONFIGURE_ME" ]; then exit 0; fi
+          curl -sf -X POST "$MATRIX_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -d "{\"text\":\"CI FAILED: ${REPO} @ ${BRANCH} — ${RUN_URL}\"}"
+
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
     needs: [python-lint, js-lint]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
     steps:
       - name: Trigger webhook
         env:
@@ -53,3 +73,14 @@ jobs:
             -H "X-Gitea-Signature: ${SIG}" \
             -d "$PAYLOAD" \
             "http://10.10.10.61:9000/hooks/gandalf-deploy"
+
+      - name: Tag deployed commit
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="deploy-$(date -u +%Y.%m.%d)-${{ github.run_number }}"
+          curl -sf -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"${TAG}\",\"target\":\"${{ github.sha }}\",\"message\":\"Deployed to production\"}" \
+            "https://code.lotusguild.org/api/v1/repos/${{ github.repository }}/tags"

.gitea/workflows/test.yml

@@ -17,8 +17,8 @@ jobs:
         run: |
           apt-get update -qq
           apt-get install -y -qq python3 python3-pip
-          pip3 install pytest
+          pip3 install pytest pytest-cov
           pip3 install -r requirements.txt --quiet
 
-      - name: Run pytest
+      - name: Run pytest with coverage
-        run: python3 -m pytest tests/ -v
+        run: python3 -m pytest tests/ -v --cov=. --cov-report=term-missing --cov-config=.coveragerc