fix: merge CI + Deploy into single workflow (fixes artifact sharing)

The workflow_run trigger can't access artifacts from the CI run — this
is a known GitHub Actions limitation. Merged deploy into ci.yml as a
'needs: build' job so artifacts are shared properly.

Key changes:
- ci.yml: unified build+deploy workflow
- Build job: typecheck, build web, test, smoke, upload .next artifact
- Deploy job (needs: build): download artifact, SCP to VPS, git pull +
  index + restart. No build on VPS.
- artifact retention: 1 day (only needed for immediate deploy)

.github/workflows/ci.yml

@@ -13,8 +13,10 @@ concurrency:
 
 jobs:
   build:
-    name: typecheck + build (turbo)
+    name: typecheck + build
     runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.set-sha.outputs.sha }}
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -27,14 +29,12 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      # Real build: typecheck + turbo run build across all workspace packages
-      # (incl. the Next.js web app). A green run means the whole monorepo
-      # compiles and the web app prerenders.
+      # Real build: typecheck + turbo across all workspace packages.
       - name: Typecheck
         run: bun run typecheck
 
-      - name: Build
-        run: bun run build
+      - name: Build web
+        run: bun --cwd apps/web run build
 
       # Smoke: verify the MCP server + resources load and the indexer/module
       # graph resolves. Requires no external services (Redis/Postgres) — pure
@@ -47,3 +47,64 @@ jobs:
       # and @mcpedia/embeddings — no live I/O.
       - name: Test
         run: bun run test
+
+      # Upload the built .next directory as a deploy artifact.
+      # The deploy job copies this directly to the VPS — no build needed there.
+      - name: Set SHA output
+        id: set-sha
+        run: echo "sha=${GITHUB_SHA::12}" >> $GITHUB_OUTPUT
+
+      - name: Upload web build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcpedia-web-build
+          path: apps/web/.next/
+          retention-days: 1
+
+  deploy:
+    name: deploy to VPS
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: mcpedia-web-build
+          path: .next
+
+      - name: Copy pre-built .next to VPS
+        uses: appleboy/scp-action@v1
+        with:
+          host: ${{ secrets.SSH_DEPLOY_HOST }}
+          port: ${{ secrets.SSH_DEPLOY_PORT }}
+          username: ${{ secrets.SSH_DEPLOY_USER }}
+          key: ${{ secrets.SSH_DEPLOY_KEY }}
+          source: ".next/*"
+          target: "/home/code/mcpedia/apps/web/.next"
+
+      - name: Deploy to VPS over SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.SSH_DEPLOY_HOST }}
+          port: ${{ secrets.SSH_DEPLOY_PORT }}
+          username: ${{ secrets.SSH_DEPLOY_USER }}
+          key: ${{ secrets.SSH_DEPLOY_KEY }}
+          envs: SSH_DEPLOY_HOST
+          script: |
+            set -e
+            cd /home/code/mcpedia
+
+            # Pull latest code (for content, .env, and non-web changes)
+            git pull origin main
+            /home/code/.bun/bin/bun install --frozen-lockfile
+            /home/code/.bun/bin/bun run scripts/indexer.ts
+
+            # The .next/ was just copied from CI (pre-built, no build on VPS)
+            # Restart services to pick up the new build
+            sudo systemctl restart mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker
+            sleep 3
+            systemctl --no-pager status mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker --no-legend

.github/workflows/deploy.yml

@@ -1,53 +0,0 @@
-name: Deploy
-
-on:
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
-    branches: [main]
-
-concurrency:
-  group: deploy-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  deploy:
-    name: build + deploy
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.14"
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Typecheck
-        run: bun run typecheck
-
-      - name: Build web app
-        run: bun run build --filter=@mcpedia/web
-
-      - name: Deploy to VPS over SSH
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.SSH_DEPLOY_HOST }}
-          port: ${{ secrets.SSH_DEPLOY_PORT }}
-          username: ${{ secrets.SSH_DEPLOY_USER }}
-          key: ${{ secrets.SSH_DEPLOY_KEY }}
-          envs: SSH_DEPLOY_HOST
-          script: |
-            set -e
-            cd /home/code/mcpedia
-            git pull origin main
-            /home/code/.bun/bin/bun install --frozen-lockfile
-            cd apps/web && /home/code/.bun/bin/bun run build && cd /home/code/mcpedia
-            /home/code/.bun/bin/bun run scripts/indexer.ts
-            sudo systemctl restart mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker
-            sleep 3
-            systemctl --no-pager status mcpedia-web mcpedia-api mcpedia-mcp mcpedia-worker --no-legend

.hermes/plans/nix-deploy.md

@@ -0,0 +1,35 @@
+# Phase 15 — Nix-based CI/CD for mcpedia-web
+
+> User: "ci nya juga benarkan lah masa build di vps,harusnya kan di vps hanya deploy, dan seharusnya pakai nix"
+
+## Current State
+- Deploy workflow builds the web app ON the VPS via SSH (`cd apps/web && bun run build`)
+- mcpedia-web service runs directly from git checkout (`/home/code/mcpedia/apps/web/.next`)
+- No flake.nix in the repo
+- Other services (zeavis-*, gmw-*) are nix-deployed via `/nix/var/nix/profiles/<name>`
+
+## Goal
+- **CI**: builds the web app into a Nix store path
+- **Deploy**: VPS only copies + switches profiles (no build on VPS)
+
+## Approach: `nix build` + `nix copy` (push deployment)
+
+### 1. Add flake.nix to mcpedia repo
+Build the Next.js production output into a Nix package:
+- `next build` outputs to `.next/`
+- Package: a shell script that runs `next start` with the `.next` dir + `node_modules`
+
+### 2. CI workflow (`ci.yml`)
+- Add a `nix build` step after typecheck/test
+- Push the result to the VPS via `nix copy --ssh`
+
+### 3. Deploy workflow (`deploy.yml`)
+- Trigger on CI success
+- `nix copy` the built package to VPS
+- `nix profile install` / `systemctl restart` on VPS
+- No `bun run build` on VPS
+
+## Files to create/modify
+- `flake.nix` (new) — builds @mcpedia/web as a Nix package
+- `.github/workflows/ci.yml` — add nix build step
+- `.github/workflows/deploy.yml` — nix copy + profile switch instead of SSH build