chore(workflows): add deploy stage to GitHub Actions workflow

Add a new deploy stage to the GitHub Actions workflow. This stage runs
on ubuntu-latest and triggers only on the main branch. It includes steps
for setting up Earthly, checking out the repository, and using Tailscale.
The deployment uses Earthly to set operator, agent, and module tags, and
syncs the staging application with the specified secrets and environment
variables.

.github/workflows/main.yml

@@ -112,4 +112,56 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.NUMARY_GITHUB_TOKEN }}
           SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
           FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+
+  Deploy:
+    runs-on: "ubuntu-latest"
+    if: github.ref == 'refs/heads/main'
+    environment: staging
+    needs:
+      - GoReleaser
+      - Tests
+    steps:
+      - uses: earthly/actions-setup@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          version: "latest"
+      - uses: 'actions/checkout@v4'
+        with:
+          fetch-depth: 0
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: tag:ci
+      - name: "staging-regions: Sset Operator, Agent, Modules tags"
+        env:
+          # Only Region deployment need the token in order to deploy with argocd
+          ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
+          # Only for module
+          STAGING_CLUSTER_KUBECONTEXT_NAME: ${{ secrets.STAGING_CLUSTER_KUBECONTEXT_NAME }}
+          STAGING_CLUSTER_NAME: ${{ secrets.STAGING_CLUSTER_NAME }}
+          STAGING_CLUSTER_REGION: ${{ secrets.STAGING_CLUSTER_REGION }}
+          TAG: ${{ github.sha }}
+        run: >
+          earthly  
+          --no-output 
+          --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN
+          +staging-application-set
+          --TAG=$TAG
+
+      - name: "staging-regions: Sync"
+        env:
+          # Only Region deployment need the token in order to deploy with argocd
+          ARGOCD_REGION_AUTH_TOKEN: ${{ secrets.ARGOCD_REGION_AUTH_TOKEN }}
+          STAGING_CLUSTER_KUBECONTEXT_NAME: ${{ secrets.STAGING_CLUSTER_KUBECONTEXT_NAME }}
+          STAGING_CLUSTER_NAME: ${{ secrets.STAGING_CLUSTER_NAME }}
+          STAGING_CLUSTER_REGION: ${{ secrets.STAGING_CLUSTER_REGION }}
+          TAG: ${{ github.sha }}
+        run: >
+          earthly  
+          --no-output 
+          --secret AUTH_TOKEN=$ARGOCD_REGION_AUTH_TOKEN
+          +staging-application-sync
+          --TAG=$TAG