fix(docker): repair the Coolify preview deployment

docker/preview/* was never updated for the native-auth cutover (#1317) or the Java
webhook receiver (#1300, #1306), and had drifted far enough that no stack could boot.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/cicd.yml

@@ -64,23 +64,53 @@ jobs:
     if: github.event_name == 'pull_request'
     permissions:
       statuses: write
-    timeout-minutes: 1
+    timeout-minutes: 2
+    # Identifiers of the Coolify instance this repo previews on. Not secrets; the API token is.
+    env:
+      COOLIFY_URL: ${{ vars.COOLIFY_URL || 'https://coolify.hephaestus.aet.cit.tum.de' }}
+      COOLIFY_PROJECT_UUID: ${{ vars.COOLIFY_PROJECT_UUID || 'lc8sows0ok8g880sg4o4o84w' }}
+      COOLIFY_ENVIRONMENT_UUID: ${{ vars.COOLIFY_ENVIRONMENT_UUID || 'ek8o8800g4wks84c8w8wcckc' }}
+      COOLIFY_APP_UUID: ${{ vars.COOLIFY_APP_UUID || 'wg44k0ccsoscsgcco8swc4ks' }}
     steps:
       - name: Post Coolify preview link
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
-            const sha = context.payload.pull_request.head.sha;
+            const { COOLIFY_URL, COOLIFY_PROJECT_UUID, COOLIFY_ENVIRONMENT_UUID, COOLIFY_APP_UUID } = process.env;
             await github.rest.repos.createCommitStatus({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              sha: sha,
+              sha: context.payload.pull_request.head.sha,
               state: 'success',
-              target_url: 'https://coolify.hephaestus.aet.cit.tum.de/project/lc8sows0ok8g880sg4o4o84w/environment/ek8o8800g4wks84c8w8wcckc/application/wg44k0ccsoscsgcco8swc4ks/preview-deployments',
+              target_url: `${COOLIFY_URL}/project/${COOLIFY_PROJECT_UUID}/environment/${COOLIFY_ENVIRONMENT_UUID}/application/${COOLIFY_APP_UUID}/preview-deployments`,
               description: 'Click Details to view Coolify preview deployments',
               context: 'Preview / Coolify'
             });
 
+      # Coolify's preview switch is all-or-nothing: enabled, it deploys every open PR. It stays
+      # disabled, and previews are created per PR from the Coolify UI. This keeps the ones that
+      # exist current: the deploy API only accepts a PR that already has a preview and answers
+      # "not found" for any other, so a PR without one is a no-op. Forks carry no secrets and are
+      # skipped — a preview runs with production credentials.
+      - name: Update an existing preview deployment
+        if: github.event.action == 'synchronize' && github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          COOLIFY_TOKEN: ${{ secrets.COOLIFY_API_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COOLIFY_TOKEN}" ]; then
+            echo "COOLIFY_API_TOKEN is not configured; skipping."
+            exit 0
+          fi
+          response=$(curl -sS -X POST \
+            -H "Authorization: Bearer ${COOLIFY_TOKEN}" \
+            "${COOLIFY_URL}/api/v1/deploy?uuid=${COOLIFY_APP_UUID}&pr=${PR_NUMBER}")
+          echo "${response}"
+          if echo "${response}" | grep -q "not found"; then
+            echo "PR #${PR_NUMBER} has no preview deployment; nothing to update."
+          fi
+
   Quality:
     uses: ./.github/workflows/ci-quality-gates.yml
     needs: [detect-changes]