enforce source branch in CI: stage←dev, main←stage

Triggers on push to main and repository_dispatch for all three upstream
events. Installs El SDK from foundation-prod, builds el-ide-server by
concatenating el-lsp + el-plugin-host + el-ide-server vessel sources,
publishes to Gitea latest release and foundation-prod Artifact Registry.
No downstream dispatch (el-ide is an end product).

.gitea/workflows/ci-dev.yaml

@@ -0,0 +1,116 @@
+name: El IDE CI — dev
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    branches:
+      - dev
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y gcc libcurl4-openssl-dev
+
+      - name: Install El SDK from dev registry
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          apt-get install -y -qq apt-transport-https ca-certificates gnupg curl
+          curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+          echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq && apt-get install -y google-cloud-cli
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          mkdir -p /usr/local/bin /usr/local/lib/el
+
+          LATEST_VERSION=$(gcloud artifacts versions list \
+            --repository=foundation-dev \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el/elc \
+            --format="value(name)" 2>/dev/null | sort | tail -1 | sed 's|.*/||' || true)
+
+          if [ -n "${LATEST_VERSION}" ]; then
+            gcloud artifacts generic download \
+              --repository=foundation-dev \
+              --location=us-central1 \
+              --project=neuron-785695 \
+              --package=el/elc \
+              --version="${LATEST_VERSION}" \
+              --destination=/usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          else
+            echo "Falling back to Gitea latest release..."
+            curl -fsSL "https://git.neuralplatform.ai/neuron-technologies/el/releases/download/latest/elc" \
+              -o /usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          fi
+
+          RELEASE_BASE="https://git.neuralplatform.ai/neuron-technologies/el/releases/download/latest"
+          curl -fsSL "${RELEASE_BASE}/el_runtime.c" -o /usr/local/lib/el/el_runtime.c
+          curl -fsSL "${RELEASE_BASE}/el_runtime.h" -o /usr/local/lib/el/el_runtime.h
+
+          echo "El SDK installed:"; elc --version || true
+          rm -f /tmp/gcp-key.json
+
+      # Build el-ide-server (IDE backend vessel)
+      - name: Build el-ide-server
+        run: |
+          mkdir -p dist
+          # Build el-lsp and el-plugin-host as dependencies, then el-ide-server
+          cat vessels/el-lsp/src/main.el \
+              vessels/el-plugin-host/src/main.el \
+              vessels/el-ide-server/src/main.el \
+            > /tmp/el-ide-server-combined.el
+          elc /tmp/el-ide-server-combined.el > dist/el-ide-server.c
+          cc -std=c11 -O2 \
+            -I /usr/local/lib/el \
+            -o dist/el-ide-server \
+            dist/el-ide-server.c \
+            /usr/local/lib/el/el_runtime.c \
+            -lcurl -lpthread
+          chmod +x dist/el-ide-server
+          echo "Built dist/el-ide-server"
+          ls -lh dist/el-ide-server
+
+      - name: Run tests
+        run: |
+          if [ -f tests/run.sh ]; then
+            ELC=/usr/local/bin/elc bash tests/run.sh
+          elif [ -f spec/run.sh ]; then
+            ELC=/usr/local/bin/elc bash spec/run.sh
+          else
+            echo "No tests/run.sh or spec/run.sh — skipping"
+          fi
+
+      - name: Publish el-ide-server to Artifact Registry (dev)
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          VERSION="${GITEA_SHA:0:8}"
+          gcloud artifacts generic upload \
+            --repository=foundation-dev \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el-ide/el-ide-server \
+            --version="${VERSION}" \
+            --source=dist/el-ide-server
+
+          echo "Published el-ide-server version=${VERSION} to foundation-dev/el-ide/el-ide-server"
+          rm -f /tmp/gcp-key.json

.gitea/workflows/ci-stage.yaml

@@ -0,0 +1,124 @@
+name: El IDE CI — stage
+
+on:
+  push:
+    branches:
+      - stage
+  pull_request:
+    branches:
+      - stage
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Enforce source branch (stage ← dev only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "dev" ]; then
+            echo "ERROR: Stage branch only accepts PRs from 'dev'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → stage"
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y gcc libcurl4-openssl-dev
+
+      - name: Install El SDK from stage registry
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          apt-get install -y -qq apt-transport-https ca-certificates gnupg curl
+          curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+          echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq && apt-get install -y google-cloud-cli
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          mkdir -p /usr/local/bin /usr/local/lib/el
+
+          LATEST_VERSION=$(gcloud artifacts versions list \
+            --repository=foundation-stage \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el/elc \
+            --format="value(name)" 2>/dev/null | sort | tail -1 | sed 's|.*/||' || true)
+
+          if [ -n "${LATEST_VERSION}" ]; then
+            gcloud artifacts generic download \
+              --repository=foundation-stage \
+              --location=us-central1 \
+              --project=neuron-785695 \
+              --package=el/elc \
+              --version="${LATEST_VERSION}" \
+              --destination=/usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          else
+            echo "Falling back to Gitea latest release..."
+            curl -fsSL "https://git.neuralplatform.ai/neuron-technologies/el/releases/download/latest/elc" \
+              -o /usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          fi
+
+          RELEASE_BASE="https://git.neuralplatform.ai/neuron-technologies/el/releases/download/latest"
+          curl -fsSL "${RELEASE_BASE}/el_runtime.c" -o /usr/local/lib/el/el_runtime.c
+          curl -fsSL "${RELEASE_BASE}/el_runtime.h" -o /usr/local/lib/el/el_runtime.h
+
+          echo "El SDK installed:"; elc --version || true
+          rm -f /tmp/gcp-key.json
+
+      - name: Build el-ide-server
+        run: |
+          mkdir -p dist
+          cat vessels/el-lsp/src/main.el \
+              vessels/el-plugin-host/src/main.el \
+              vessels/el-ide-server/src/main.el \
+            > /tmp/el-ide-server-combined.el
+          elc /tmp/el-ide-server-combined.el > dist/el-ide-server.c
+          cc -std=c11 -O2 \
+            -I /usr/local/lib/el \
+            -o dist/el-ide-server \
+            dist/el-ide-server.c \
+            /usr/local/lib/el/el_runtime.c \
+            -lcurl -lpthread
+          chmod +x dist/el-ide-server
+          echo "Built dist/el-ide-server"
+          ls -lh dist/el-ide-server
+
+      - name: Run tests
+        run: |
+          if [ -f tests/run.sh ]; then
+            ELC=/usr/local/bin/elc bash tests/run.sh
+          elif [ -f spec/run.sh ]; then
+            ELC=/usr/local/bin/elc bash spec/run.sh
+          else
+            echo "No tests/run.sh or spec/run.sh — skipping"
+          fi
+
+      - name: Publish el-ide-server to Artifact Registry (stage)
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          VERSION="${GITEA_SHA:0:8}"
+          gcloud artifacts generic upload \
+            --repository=foundation-stage \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el-ide/el-ide-server \
+            --version="${VERSION}" \
+            --source=dist/el-ide-server
+
+          echo "Published el-ide-server version=${VERSION} to foundation-stage/el-ide/el-ide-server"
+          rm -f /tmp/gcp-key.json

.gitea/workflows/release.yaml

@@ -0,0 +1,175 @@
+name: El IDE Release
+
+on:
+  push:
+    branches:
+      - main
+  repository_dispatch:
+    types:
+      - el-sdk-updated
+      - ui-updated
+      - elp-updated
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Enforce source branch (main ← stage only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "stage" ]; then
+            echo "ERROR: Main branch only accepts PRs from 'stage'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → main"
+
+      - name: Install build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y gcc libcurl4-openssl-dev
+
+      # Install El SDK — try GCP Artifact Registry prod first, fall back to Gitea release
+      - name: Install El SDK
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          RELEASE_BASE: https://git.neuralplatform.ai/neuron-technologies/el/releases/download/latest
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          apt-get install -y -qq apt-transport-https ca-certificates gnupg curl
+          curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+          echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq && apt-get install -y google-cloud-cli
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          mkdir -p /usr/local/bin /usr/local/lib/el
+
+          LATEST_VERSION=$(gcloud artifacts versions list \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el/elc \
+            --format="value(name)" 2>/dev/null | sort | tail -1 | sed 's|.*/||' || true)
+
+          if [ -n "${LATEST_VERSION}" ]; then
+            gcloud artifacts generic download \
+              --repository=foundation-prod \
+              --location=us-central1 \
+              --project=neuron-785695 \
+              --package=el/elc \
+              --version="${LATEST_VERSION}" \
+              --destination=/usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          else
+            echo "Falling back to Gitea latest release..."
+            curl -fsSL "${RELEASE_BASE}/elc" -o /usr/local/bin/elc
+            chmod +x /usr/local/bin/elc
+          fi
+
+          curl -fsSL "${RELEASE_BASE}/el_runtime.c" -o /usr/local/lib/el/el_runtime.c
+          curl -fsSL "${RELEASE_BASE}/el_runtime.h" -o /usr/local/lib/el/el_runtime.h
+
+          echo "El SDK installed:"; elc --version || true
+          rm -f /tmp/gcp-key.json
+
+      # Build el-ide-server (IDE backend vessel)
+      - name: Build el-ide-server
+        run: |
+          mkdir -p dist
+          # Build el-lsp and el-plugin-host as dependencies, then el-ide-server
+          cat vessels/el-lsp/src/main.el \
+              vessels/el-plugin-host/src/main.el \
+              vessels/el-ide-server/src/main.el \
+            > /tmp/el-ide-server-combined.el
+          elc /tmp/el-ide-server-combined.el > dist/el-ide-server.c
+          cc -std=c11 -O2 \
+            -I /usr/local/lib/el \
+            -o dist/el-ide-server \
+            dist/el-ide-server.c \
+            /usr/local/lib/el/el_runtime.c \
+            -lcurl -lpthread
+          chmod +x dist/el-ide-server
+          echo "Built dist/el-ide-server"
+          ls -lh dist/el-ide-server
+
+      - name: Run tests
+        run: |
+          if [ -f tests/run.sh ]; then
+            ELC=/usr/local/bin/elc bash tests/run.sh
+          elif [ -f spec/run.sh ]; then
+            ELC=/usr/local/bin/elc bash spec/run.sh
+          else
+            echo "No tests/run.sh or spec/run.sh — skipping"
+          fi
+
+      # Publish / update the `latest` release
+      - name: Publish latest release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_API: https://git.neuralplatform.ai/api/v1
+          REPO: neuron-technologies/el-ide
+        run: |
+          EXISTING_ID=$(curl -sf \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            "${GITEA_API}/repos/${REPO}/releases/tags/latest" \
+            | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['id'])" 2>/dev/null || true)
+
+          if [ -n "${EXISTING_ID}" ]; then
+            echo "Deleting existing release id=${EXISTING_ID}"
+            curl -sf -X DELETE \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              "${GITEA_API}/repos/${REPO}/releases/${EXISTING_ID}"
+          fi
+
+          curl -sf -X DELETE \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            "${GITEA_API}/repos/${REPO}/tags/latest" || true
+
+          RELEASE_ID=$(curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_API}/repos/${REPO}/releases" \
+            -d "{
+              \"tag_name\": \"latest\",
+              \"name\": \"El IDE (latest)\",
+              \"body\": \"Latest El IDE build from commit ${GITHUB_SHA}.\nBuilt $(date -u +%Y-%m-%dT%H:%M:%SZ).\",
+              \"draft\": false,
+              \"prerelease\": false
+            }" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+
+          echo "Created release id=${RELEASE_ID}"
+
+          curl -sf -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -F "attachment=@dist/el-ide-server;filename=el-ide-server" \
+            "${GITEA_API}/repos/${REPO}/releases/${RELEASE_ID}/assets"
+
+          echo "Release published successfully"
+
+      # Publish artifact to GCP Artifact Registry (prod)
+      - name: Publish el-ide to Artifact Registry (prod)
+        env:
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+        run: |
+          echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
+          gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
+          gcloud config set project neuron-785695
+
+          VERSION="${GITEA_SHA:0:8}"
+          gcloud artifacts generic upload \
+            --repository=foundation-prod \
+            --location=us-central1 \
+            --project=neuron-785695 \
+            --package=el-ide/el-ide-server \
+            --version="${VERSION}" \
+            --source=dist/el-ide-server
+
+          echo "Published el-ide-server version=${VERSION} to foundation-prod/el-ide/el-ide-server"
+          rm -f /tmp/gcp-key.json
+
+      # el-ide is an end product — no downstream dispatch needed