Keep workflows in ci-templates/ only; projects copy one in

.gitea/workflows/ci.yml

@@ -1,48 +0,0 @@
----
-# Homelab CI — Python lane + secret scan.
-# POLICY: lint and tests are HARD gates. Never add `|| true` to them.
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  python-ci:
-    runs-on: [homelab, self-hosted, linux, python]
-    container:
-      image: node:20-bookworm
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Python tooling
-        run: |
-          apt-get update -qq
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3 python3-pip python3-venv
-          python3 -m pip install --upgrade pip --break-system-packages
-          if [ -f requirements.txt ]; then pip install -r requirements.txt --break-system-packages; fi
-          if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt --break-system-packages; fi
-          pip install pytest ruff --break-system-packages
-
-      - name: Ruff lint (hard gate)
-        run: ruff check .
-
-      - name: Pytest (hard gate)
-        run: pytest -q
-
-      # Advisory-only scanners (allowed to be soft — they're noisy, not gates)
-      - name: Bandit (advisory)
-        run: pip install bandit --break-system-packages && bandit -r . -q || true
-
-  secret-scan:
-    runs-on: [homelab, self-hosted, linux, heavy]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Gitleaks
-        run: |
-          docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:latest \
-            detect --source /repo --config /repo/.gitleaks.toml --no-banner --redact