ci: deduplicate workflows using reusable test pipeline and stable tagging

- Introduce reusable-test workflow for Ruff + E2E tests
- Refactor CI to call reusable workflow (no duplicated steps)
- Add stable-tag workflow to promote version tags to stable after successful tests

https://chatgpt.com/share/694a7f81-d96c-800f-88cb-7b25b4cdfe1a

.github/workflows/ci.yml

@@ -5,61 +5,8 @@ on:
   pull_request:
 
 jobs:
-  lint-and-e2e:
+  test:
-    runs-on: ubuntu-latest
+    uses: ./.github/workflows/reusable-test.yml
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
     with:
       python-version: "3.12"
-          cache: "pip"
+      matomo-token-description: "ci-token"
-
-      - name: Install system deps (curl)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl
-
-      - name: Install Python deps
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e ".[e2e]"
-          pip install ruff
-
-      - name: Ruff
-        run: |
-          ruff check .
-          ruff format --check .
-
-      # Playwright needs browser binaries on the runner
-      - name: Install Playwright Chromium
-        run: |
-          python -m playwright install --with-deps chromium
-
-      # Run your full E2E cycle using the existing Makefile
-      - name: E2E (docker compose + installer + tests)
-        env:
-          MATOMO_URL: "http://127.0.0.1:8080"
-          MATOMO_ADMIN_USER: "administrator"
-          MATOMO_ADMIN_PASSWORD: "AdminSecret123!"
-          MATOMO_ADMIN_EMAIL: "administrator@example.org"
-          MATOMO_TOKEN_DESCRIPTION: "ci-token"
-        run: |
-          make e2e
-
-      # If E2E fails, this is helpful for debugging
-      - name: Docker logs (on failure)
-        if: failure()
-        run: |
-          docker compose -f tests/e2e/docker-compose.yml ps || true
-          docker compose -f tests/e2e/docker-compose.yml logs --no-color --tail=300 matomo || true
-          docker compose -f tests/e2e/docker-compose.yml logs --no-color --tail=300 db || true
-
-      - name: Cleanup (always)
-        if: always()
-        run: |
-          docker compose -f tests/e2e/docker-compose.yml down -v || true

.github/workflows/reusable-test.yml

@@ -0,0 +1,86 @@
+name: Reusable Test (ruff + e2e)
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        type: string
+        required: false
+        default: "3.12"
+      matomo-url:
+        type: string
+        required: false
+        default: "http://127.0.0.1:8080"
+      matomo-admin-user:
+        type: string
+        required: false
+        default: "administrator"
+      matomo-admin-password:
+        type: string
+        required: false
+        default: "AdminSecret123!"
+      matomo-admin-email:
+        type: string
+        required: false
+        default: "administrator@example.org"
+      matomo-token-description:
+        type: string
+        required: false
+        default: "ci-token"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ inputs.python-version }}
+          cache: "pip"
+
+      - name: Install system deps (curl)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y curl
+
+      - name: Install Python deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[e2e]"
+          pip install ruff
+
+      - name: Ruff
+        run: |
+          ruff check .
+          ruff format --check .
+
+      - name: Install Playwright Chromium
+        run: |
+          python -m playwright install --with-deps chromium
+
+      - name: E2E (docker compose + installer + tests)
+        env:
+          MATOMO_URL: ${{ inputs.matomo-url }}
+          MATOMO_ADMIN_USER: ${{ inputs.matomo-admin-user }}
+          MATOMO_ADMIN_PASSWORD: ${{ inputs.matomo-admin-password }}
+          MATOMO_ADMIN_EMAIL: ${{ inputs.matomo-admin-email }}
+          MATOMO_TOKEN_DESCRIPTION: ${{ inputs.matomo-token-description }}
+        run: |
+          make e2e
+
+      - name: Docker logs (on failure)
+        if: failure()
+        run: |
+          docker compose -f tests/e2e/docker-compose.yml ps || true
+          docker compose -f tests/e2e/docker-compose.yml logs --no-color --tail=300 matomo || true
+          docker compose -f tests/e2e/docker-compose.yml logs --no-color --tail=300 db || true
+
+      - name: Cleanup (always)
+        if: always()
+        run: |
+          docker compose -f tests/e2e/docker-compose.yml down -v || true

.github/workflows/stable-tag.yml

@@ -0,0 +1,42 @@
+name: Stable Tag
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  test:
+    uses: ./.github/workflows/reusable-test.yml
+    with:
+      python-version: "3.12"
+      matomo-token-description: "stable-ci-token"
+
+  tag-stable:
+    runs-on: ubuntu-latest
+    needs: test
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+      - name: Checkout (full history for tags)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Move stable tag to this version tag commit
+        run: |
+          set -euo pipefail
+
+          echo "Triggered by tag: ${GITHUB_REF_NAME}"
+          echo "Commit: ${GITHUB_SHA}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git fetch --tags --force
+
+          git tag -fa stable -m "stable -> ${GITHUB_REF_NAME} (${GITHUB_SHA})" "${GITHUB_SHA}"
+          git push --force origin stable