ci: fix service names (mosaic-stack not mosaic_stack)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

.woodpecker/ci.yml

@@ -337,3 +337,44 @@ steps:
       - security-trivy-api
       - security-trivy-orchestrator
       - security-trivy-web
+
+  # ─── Deploy to Docker Swarm (main only) ─────────────────────
+
+  # ─── Deploy to Docker Swarm via Portainer (main only) ─────────────────────
+
+  deploy-swarm:
+    image: alpine:3
+    environment:
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      SSH_KNOWN_HOSTS:
+        from_secret: ssh_known_hosts
+      PORTAINER_URL:
+        from_secret: portainer_url
+      PORTAINER_API_KEY:
+        from_secret: portainer_api_key
+    commands:
+      - apk add --no-cache curl openssh-client
+      - |
+        set -e
+        echo "🚀 Deploying to Docker Swarm..."
+
+        # Setup SSH for fallback
+        mkdir -p ~/.ssh
+        echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
+        chmod 600 ~/.ssh/known_hosts
+        echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
+        chmod 600 ~/.ssh/id_ed25519
+
+        # Force service updates (images are pulled from public registry)
+        ssh -o StrictHostKeyChecking=no localadmin@10.1.1.45 \
+          "docker service update --with-registry-auth --force mosaic-stack-api && \
+           docker service update --with-registry-auth --force mosaic-stack-web && \
+           docker service update --with-registry-auth --force mosaic-stack-orchestrator && \
+           docker service update --with-registry-auth --force mosaic-stack-coordinator && \
+           echo '✅ All services updated'"
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - link-packages