Route deploy-staging, deploy-production, and smoke jobs through the
org self-hosted runner [self-hosted, peptide-vps] on KVM8 VPS.
This fixes the Hostinger SSH throttle: Azure eastus2/ncus ranges are
blocked at :65002; the VPS has a stable, allowlisted IP.
Callers' CI/validate jobs remain on ubuntu-latest (GitHub-hosted).
Bumps to v1.7.1.
Agent-Session: deploy-self-hosted-20260617
deploy-production now needs smoke; a smoke FAILURE blocks prod while a skipped
smoke (run_smoke:false) still allows it. Automated functional gate replacing
the removed human approval gate — hands-off but safe.
Agent-Session: cto gate-smoke
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Compare prod-deployment SHA to main and ignore changes confined to .github/,
tests/, and docs/build files (which the deploy excludes) — so infra-only commits
don't trip a false 'prod behind main' alert every day.
Agent-Session: cto monitor-drift-filter
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
* ci(deploy): retry rsync on Hostinger runner-IP throttle + best-effort inventory guard
Pilot surfaced an exit-255 SSH connection timeout (documented Hostinger
rate-limiting of concurrent runner IPs). rsync now retries 4x/25s; the plugin
count guard is best-effort so a throttled check can't fail a good deploy.
Agent-Session: cto harden-deploy
* ci: add daily Deploy Health Monitor (drift + deploy-failure)
Scheduled GitHub Actions check (runs on GitHub infra, not the dead local cron):
for each app repo, compares the latest production deployment SHA to main and
flags failed deploy runs. Opens one de-duplicated 'deploy-health' issue when
something is off — the alarm that was missing when deploys silently broke.
Agent-Session: cto deploy-health-monitor
---------
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
Single staging→smoke→production pipeline callable by every plugin/theme repo
via workflow_call. Replaces six copy-pasted per-repo deploy.yml files so deploy
logic is fixed once. Includes the pre/post active-plugin-count guard, LiteSpeed
purge, and health checks. Callers pass target_path + secrets: inherit.
Agent-Session: cto reusable-deploy
Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
When smoke.yml runs via workflow_call from another repo (peptide-repo-core,
peptide-starter-theme, etc.), GitHub Actions checks out the CALLER's repo
by default. The caller has no package-lock.json, so setup-node's npm cache
lookup fails with 'Some specified paths were not resolved'.
Fix: add repository/ref to the checkout step so we always fetch peptide-e2e
regardless of who calls the workflow. This ensures npm ci and Playwright
have the correct test code and dependency lockfile.
