ci: align workflows with pipeline-actions composite actions

- haven-notify.yaml: replace hand-rolled build+deploy (broken
  docker/build-push-action remote-builder path) with pipeline-actions
  build-and-push + deploy-restart; full Gitea uses: URLs; ubuntu-amd64.
- main.yaml / test-automated-nfs-backup.yaml: runner label
  ubuntu-latest -> ubuntu-amd64.
- haven-notify/README.md: point to infra/haven-notify.yaml in the
  haven repo; fix secret name to discord-webhook/HAVEN_WEBHOOK_URL.

.gitea/workflows/haven-notify.yaml

@@ -10,80 +10,32 @@ on:
   workflow_dispatch: {}
 
 env:
-  REGISTRY_HOST: git.ivanch.me
-  REGISTRY_USERNAME: ivanch
-  IMAGE_NOTIFY: ${{ env.REGISTRY_HOST }}/ivanch/haven-notify
-  KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+  IMAGE: git.ivanch.me/ivanch/haven-notify
 
 jobs:
-  build_haven_notify:
+  build:
     name: Build Haven Notify Image
-    runs-on: ubuntu-22.04
-
+    runs-on: ubuntu-amd64
     steps:
       - name: Check out repository
-        uses: actions/checkout@v2
-
-      - name: Log in to Container Registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" \
-            | docker login "${{ env.REGISTRY_HOST }}" \
-                -u "${{ env.REGISTRY_USERNAME }}" \
-                --password-stdin
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: actions/checkout@v4
 
       - name: Build and Push Multi-Arch Image
-        uses: docker/build-push-action@v6
+        uses: https://git.ivanch.me/ivanch/pipeline-actions/build-and-push@main
         with:
-          push: true
-          context: haven-notify
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{ env.IMAGE_NOTIFY }}:latest
+          image: ${{ env.IMAGE }}
+          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
+          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}
+          build_context: haven-notify
 
-  deploy_haven_notify:
+  deploy:
     name: Deploy Haven Notify (internal)
     runs-on: ubuntu-amd64
-    needs: build_haven_notify
+    needs: build
     steps:
-      - name: Check KUBE_CONFIG validity
-        run: |
-          if [ -z "${KUBE_CONFIG}" ] || [ "${KUBE_CONFIG}" = "" ] || [ "${KUBE_CONFIG// }" = "" ]; then
-            echo "KUBE_CONFIG is not set or is empty."
-            exit 1
-          fi
-
-      - name: Check out repository
-        uses: actions/checkout@v2
-
-      - name: Download and install dependencies
-        run: |
-          apt-get update -y
-          apt-get install -y curl
-          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          install -m 0755 kubectl /usr/local/bin/kubectl
-          kubectl version --client
-
-      - name: Set up kubeconfig
-        run: |
-          cd haven-notify/deploy
-          echo "$KUBE_CONFIG" > kubeconfig.yaml
-        env:
-          KUBE_CONFIG: ${{ env.KUBE_CONFIG }}
-
-      - name: Check connection to cluster
-        run: |
-          cd haven-notify/deploy
-          kubectl --kubeconfig=kubeconfig.yaml cluster-info
-
-      - name: Apply haven-notify deployment
-        run: |
-          cd haven-notify/deploy
-          kubectl --kubeconfig=kubeconfig.yaml apply -f haven-notify.yaml
-
-      - name: Rollout restart haven-notify
-        run: |
-          cd haven-notify/deploy
-          kubectl --kubeconfig=kubeconfig.yaml rollout restart deployment/haven-notify
+      - name: Rollout Restart Haven Notify
+        uses: https://git.ivanch.me/ivanch/pipeline-actions/deploy-restart@main
+        with:
+          kube_config: ${{ secrets.KUBE_CONFIG }}
+          deployment_name: haven-notify
+          namespace: default