Merge branch 'chore/remove-ci'

There's no Actions runner (no machine that can run Docker), so every push
left a run stuck on "Waiting". Tests and lint are run by hand before a
release, and releases are deployed with scripts/deploy.sh on the server.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,129 +0,0 @@
-# Checks every push and pull request: backend tests, frontend lint/typecheck/build, and
-# the Playwright end-to-end tests. Pushing a version tag (v1.2.3) also deploys, once the
-# DEPLOY_* secrets are set (Repository → Settings → Actions → Secrets).
-#
-# Needs a Gitea Actions runner with the "ubuntu-latest" label (Docker), e.g. act_runner:
-# https://docs.gitea.com/usage/actions/act-runner
-name: CI
-
-on:
-  push:
-    branches: ["**"]
-    tags: ["v*"]
-  pull_request:
-
-env:
-  NODE_VERSION: "20"
-  # Throwaway values for the test database and tokens — never production secrets.
-  JWT_SECRET: ci-only-jwt-secret-not-for-production
-  DATABASE_URL: postgresql://postgres:postgres@postgres:5432/events_ci
-  E2E_DATABASE_URL: postgresql://postgres:postgres@postgres:5432/events_ci_e2e
-
-jobs:
-  backend:
-    name: Backend tests
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:16
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: events_ci
-        options: >-
-          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-          cache-dependency-path: backend/package-lock.json
-      - run: npm ci
-        working-directory: backend
-      - name: Migrations apply cleanly
-        run: npx prisma migrate deploy
-        working-directory: backend
-      - run: npm test
-        working-directory: backend
-
-  frontend:
-    name: Frontend lint, typecheck, build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-      - run: npm ci
-        working-directory: frontend
-      - run: npx eslint src
-        working-directory: frontend
-      - run: npx tsc --noEmit -p .
-        working-directory: frontend
-      - run: npm run build
-        working-directory: frontend
-        env:
-          NEXT_PUBLIC_API_URL: http://localhost:5000
-          NEXT_TELEMETRY_DISABLED: "1"
-
-  e2e:
-    name: End-to-end tests
-    runs-on: ubuntu-latest
-    needs: [backend, frontend]
-    services:
-      postgres:
-        image: postgres:16
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: events_ci
-        options: >-
-          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-      - run: npm ci
-      - run: npm ci
-        working-directory: backend
-      - run: npm ci
-        working-directory: frontend
-      - run: npx playwright install --with-deps chromium
-      - run: npx playwright test
-        env:
-          CI: "true"
-      - name: Keep the report when tests fail
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: playwright-report
-          path: |
-            e2e/report
-            e2e/test-results
-          retention-days: 7
-
-  deploy:
-    name: Deploy tagged release
-    runs-on: ubuntu-latest
-    needs: [backend, frontend, e2e]
-    if: startsWith(github.ref, 'refs/tags/v')
-    steps:
-      - name: Deploy over SSH (skipped until DEPLOY_HOST is set)
-        env:
-          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          if [ -z "$DEPLOY_HOST" ]; then
-            echo "DEPLOY_HOST isn't set — skipping the deploy."
-            exit 0
-          fi
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$DEPLOY_USER@$DEPLOY_HOST" \
-            "cd '${DEPLOY_PATH:-~/hope-events}' && bash scripts/deploy.sh '$TAG'"

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.46.1] - 2026-10-28
+
+### Removed
+
+- The Gitea CI workflow (`.gitea/workflows/ci.yml`). There's no Actions runner, so every push
+  left a run stuck on "Waiting". Tests and lint are run by hand before a release, and releases
+  are deployed with `scripts/deploy.sh` on the server.
+
 ## [1.46.0] - 2026-10-28
 
 ### Added

DEPLOYMENT.md

@@ -310,24 +310,6 @@ and goes back to the previous version if anything fails first. `backend/.env`,
 `frontend/.env.production`, `ecosystem.config.js` and the nginx/frpc configs are not in git, so
 updates keep your changes from this guide.
 
-### Deploying from CI over SSH
-
-The Gitea workflow deploys on a `v*` tag by SSHing to `DEPLOY_HOST`. Behind frp, that needs an
-SSH tunnel too, e.g. in `frpc.ini`:
-
-```ini
-[hope-events-ssh]
-type = tcp
-local_ip = 127.0.0.1
-local_port = 22
-remote_port = 6022
-```
-
-Then use the VPS as `DEPLOY_HOST`. The workflow's `ssh` call (`.gitea/workflows/ci.yml`) doesn't
-take a port yet, so add `-p 6022` there (or a `DEPLOY_PORT` secret) before relying on it. Only
-open this if you need it: it exposes this server's SSH on the VPS. Use key-only login. Deploying
-by hand (above) needs none of this.
-
 ## Troubleshooting
 
 | Symptom | Likely cause |

FEATURES.md

@@ -789,11 +789,9 @@ can't start, the same jobs run on in-process timers.
   frontend against a separate, freshly seeded database: public pages, free and paid
   registration through to check-in and cashup, multi-day check-in, the attendance
   register and certificates, the event wizard, the kiosk, and the admin jobs page.
-- **CI** — `.gitea/workflows/ci.yml` runs the backend tests, frontend lint/typecheck/
-  build and the end-to-end tests on every push (needs a Gitea Actions runner). A `v*`
-  tag also deploys over SSH with `scripts/deploy.sh` once the `DEPLOY_*` secrets are set:
-  it backs up the database, checks out the tag, migrates, builds and reloads PM2, and
-  goes back to the previous version if a step fails before the reload.
+- **Deploy script** — `scripts/deploy.sh [tag]`, run on the server, backs up the
+  database, checks out the release, migrates, builds and reloads PM2, and goes back to
+  the previous version if a step fails before the reload.
 - Versioning via git tags and [CHANGELOG.md](./CHANGELOG.md).
 
 ---

README.md

@@ -92,9 +92,9 @@ Documentation: see Frontend README for environment and scripts.
     `E2E_DATABASE_URL` — which is dropped, recreated and seeded on every run. Your own dev
     servers and database aren't touched. The database user needs permission to create
     databases.
-- CI: `.gitea/workflows/ci.yml` runs all of the above on every push once a Gitea Actions
-  runner is registered. Pushing a `v*` tag also deploys with `scripts/deploy.sh` when the
-  `DEPLOY_HOST`, `DEPLOY_USER`, `DEPLOY_SSH_KEY` (and optional `DEPLOY_PATH`) secrets are set.
+- There's no CI: run these yourself, plus `npx eslint .` in `frontend/`, before tagging a
+  release (the deploy's `next build` fails on any lint error). Releases are deployed by hand
+  with `scripts/deploy.sh` (see [DEPLOYMENT.md](./DEPLOYMENT.md)).
 
 ## Deployment
 

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.46.0",
+      "version": "1.46.1",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-28, after **1.46.0** (and Hub 1.1.0). The plan itself is in
+Last updated: 2026-10-28, after **1.46.1** (and Hub 1.1.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -15,6 +15,7 @@ encrypted settings unreadable or break existing installs.
 | Version | What |
 |---------|------|
 | 1.46.0 | **Volunteer rosters** (§5): serving roles per event or session, anyone signs up (or supervisors assign), day-before reminders, "can't make it" swaps that happen on accept (notify recipients emailed), self check-in with the event's QR code or by staff, kids-room roles count as leaders on duty, free volunteer ticket off by default, roster sheet and hours served. Also fixes the 1.45.0 kids ticket being offered publicly |
+| 1.46.1 | Removed the Gitea CI workflow (no runner): test, lint and deploy by hand |
 | 1.45.1 | Privacy notice (built-in text) and terms of use brought up to date with kids check-in, sessions, certificates, campuses, the Hub heartbeat and where data is stored. Installs with a published notice must publish a new version themselves |
 | 1.45.0 | **Kids check-in** (§4), fully digital: families/children/authorised adults kept between events (My account → Kids), staff desk with pickup codes and a "write on the sticker" panel, rooms with age ranges and ratios, room screen (on duty, call parent, alerts), check-out by code (wrong code alerts, override with reason), offline desk with reserved codes, attendance through a free kids ticket; 6-month retention rule for children |
 | 1.44.0 | **Campus-scoped staff** (§12 part 2): Admin → Users "Limit to campuses"; `utils/campusScope.js` on every staff/supervisor route (and owner-or-staff routes), lists filtered, scanner names the other campus, church-wide events view/scan/door-only for scoped staff; route test `tests/campusScopeRoutes.test.js` |
@@ -98,9 +99,9 @@ a test server (both done 2026-10-28).
 - **Careful with ad-hoc scripts against a dev/test database that has SMTP set up:**
   registrations and check-ins send real email/WhatsApp. Use made-up `@test.local`
   people only.
-- CI: `.gitea/workflows/ci.yml` runs everything once a Gitea Actions runner is
-  registered (none yet). Tag deploys need the `DEPLOY_HOST`, `DEPLOY_USER`,
-  `DEPLOY_SSH_KEY` (+ optional `DEPLOY_PATH`) secrets.
+- No CI: the Gitea workflow was removed (no machine to run a Docker runner). Run the
+  backend tests, frontend eslint and e2e tests yourself before tagging, and deploy by
+  hand with `scripts/deploy.sh <tag>` on the server.
 
 ## Where the multi-day code lives
 

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.46.0",
+      "version": "1.46.1",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.46.0",
+      "version": "1.46.1",
       "license": "ISC",
       "devDependencies": {
         "@playwright/test": "^1.64.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",

scripts/deploy.sh

@@ -6,7 +6,6 @@
 # Usage (on the server, from the repo folder):
 #   bash scripts/deploy.sh            # the latest main
 #   bash scripts/deploy.sh v1.37.3    # a tagged release
-# CI runs it with the tag over SSH when a v* tag is pushed (see .gitea/workflows/ci.yml).
 #
 # PM2 uses this install's own ecosystem.config.js (app names, ports). It isn't in git, so
 # deploys never change it; the first deploy creates it from ecosystem.config.example.js.