fix(ci): full alignment with klz-2026 pipeline standard - remove redundant Build Test, add provenance:false, clean QA traps

.gitea/workflows/deploy.yml

@@ -13,6 +13,9 @@ on:
         required: false
         default: "false"
 
+env:
+  PUPPETEER_SKIP_DOWNLOAD: "true"
+
 concurrency:
   group: ${{ github.workflow }}-${{ (github.ref_type == 'tag' && !contains(github.ref_name, '-')) && 'prod' || (github.ref_name == 'main' && 'testing' || github.ref_name) }}
   cancel-in-progress: true
@@ -166,28 +169,14 @@ jobs:
           pnpm install --no-frozen-lockfile
           pnpm build
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+        run: |
+          pnpm store prune
+          pnpm install --no-frozen-lockfile
       - name: 🧪 QA Checks
         if: github.event.inputs.skip_checks != 'true'
-        run: |
-          pnpm exec turbo run lint typecheck test > turbo.log 2>&1 || {
-            echo "QA failed! Uploading log to alpha..."
-            mkdir -p ~/.ssh
-            echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
-            chmod 600 ~/.ssh/id_rsa
-            ssh-keyscan -H alpha.mintel.me >> ~/.ssh/known_hosts
-            scp turbo.log root@alpha.mintel.me:/root/mintel-me-qa-failure.log || true
-            cat turbo.log
-            exit 1
-          }
-      - name: 🏗️ Build Test
-        if: github.event.inputs.skip_checks != 'true'
-        run: |
-          pnpm build > build.log 2>&1 || {
-            curl -X POST "https://gotify.infra.mintel.me/message?token=${{ secrets.GOTIFY_TOKEN }}" \
-                 -F "title=❌ QA Build Crashed" -F "priority=8" -F "message=<build.log"
-            exit 1
-          }
+        env:
+          TURBO_TELEMETRY_DISABLED: "1"
+        run: pnpm exec turbo run lint typecheck test --cache-dir=".turbo"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 3: Build & Push
@@ -213,6 +202,7 @@ jobs:
         with:
           context: .
           push: true
+          provenance: false
           platforms: linux/amd64
           build-args: |
             NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_url }}