ci: add shared reusable deploy workflow (deploy-app.yml)

Single staging→smoke→production pipeline callable by every plugin/theme repo
via workflow_call. Replaces six copy-pasted per-repo deploy.yml files so deploy
logic is fixed once. Includes the pre/post active-plugin-count guard, LiteSpeed
purge, and health checks. Callers pass target_path + secrets: inherit.

Agent-Session: cto reusable-deploy

.github/workflows/deploy-app.yml

@@ -0,0 +1,126 @@
+name: Reusable Deploy (staging → smoke → production)
+
+# Single shared deploy pipeline for every peptiderepo plugin and the theme.
+# Callers pass `target_path` (the wp-content subpath) and `secrets: inherit`,
+# and the deploy logic lives HERE — fix it once instead of in six copy-pasted
+# per-repo deploy.yml files (the drift that broke every deploy in May 2026).
+#
+# Staging deploy → smoke (informational) → production deploy (env-gated) with a
+# pre/post active-plugin-count guard (the 2026-04-23 WP-core-clobber tripwire),
+# LiteSpeed purge, and a health check.
+
+on:
+  workflow_call:
+    inputs:
+      target_path:
+        description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger or wp-content/themes/peptide-starter"
+        required: true
+        type: string
+      run_smoke:
+        description: "Run the staging smoke suite (informational; never gates prod)"
+        required: false
+        default: true
+        type: boolean
+    secrets:
+      SSH_PRIVATE_KEY:
+        required: true
+      SSH_HOST:
+        required: true
+      SSH_PORT:
+        required: true
+      SSH_USERNAME:
+        required: true
+      STAGING_WP_ADMIN_USER:
+        required: false
+      STAGING_WP_ADMIN_PASSWORD:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy via rsync → staging
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
+            ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/staging/${{ inputs.target_path }}/"
+      - name: Staging health check
+        run: |
+          sleep 5
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    if: ${{ inputs.run_smoke }}
+    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    secrets:
+      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
+      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
+
+  deploy-production:
+    name: Deploy to Production
+    needs: [deploy-staging]   # smoke is informational; not a prod gate
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy via rsync → production (plugin-inventory guard)
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
+          SSHC="ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}"
+          PRE=$($SSHC "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" || echo 0)
+          echo "Pre-deploy active plugins: $PRE"
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
+            ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/${{ inputs.target_path }}/"
+          POST=$($SSHC "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" || echo 0)
+          echo "Post-deploy active plugins: $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "ERROR: active plugin count dropped ${PRE} -> ${POST} after deploy — aborting as failed."
+            exit 1
+          fi
+          $SSHC "cd $BASE && find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true"
+          echo "LiteSpeed cache purged."
+      - name: Production health check
+        run: |
+          sleep 5
+          S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+          if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "ERROR: site returned HTTP $S"; exit 1; fi
+          echo "Production healthy (HTTP $S)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+      - name: Deploy summary
+        run: |
+          echo "## Deployment complete" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Target:** ${{ inputs.target_path }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> "$GITHUB_STEP_SUMMARY"

global.setup.ts

@@ -33,8 +33,18 @@ setup('authenticate as WP admin', async ({ page }) => {
   await page.fill('#user_pass', password);
   await page.click('#wp-submit');
 
-  // Wait for successful redirect to wp-admin dashboard
-  await expect(page).toHaveURL(/wp-admin/, { timeout: 20_000 });
+  // Wait for any post-login navigation. The site may redirect successful logins
+  // to the homepage (via a login_redirect filter) rather than to wp-admin —
+  // staging does this. So we don't assert the post-submit URL; instead, we
+  // verify we're no longer ON wp-login.php (which would indicate a credential
+  // rejection or 2FA prompt) and then navigate explicitly to wp-admin.
+  await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
+    timeout: 20_000,
+  });
+
+  // Navigate explicitly into wp-admin to capture the authenticated admin session.
+  await page.goto('/wp-admin/');
+  await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });
   await expect(page.locator('#wpadminbar')).toBeVisible();
 
   // Persist session cookies + localStorage to disk

tests/00-homepage.spec.ts

@@ -29,7 +29,7 @@ test.describe('Homepage', () => {
 
   test('renders site name in page title', async ({ page }) => {
     await page.goto('/');
-    await expect(page).toHaveTitle(/peptiderepo/i);
+    await expect(page).toHaveTitle(/peptide ?repo/i);
   });
 
   test('wp-admin bar present (logged-in session)', async ({ page }) => {

tests/01-reconstitution-calculator.spec.ts

@@ -14,7 +14,7 @@
 
 import { test, expect } from '@playwright/test';
 
-const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/reconstitution-calculator/';
+const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/calculator/';
 
 test.describe('Reconstitution Calculator', () => {
   test.beforeEach(async ({ page }) => {

tests/03-admin-plugins.spec.ts

@@ -25,7 +25,7 @@ const REQUIRED_PLUGINS = [
   'peptide-search-ai',
   'peptide-repo-core',
   'peptide-reconstitution-calculator',
-  'pr-autoblogger',
+  'prautoblogger',
   'peptide-starter-theme', // theme, shown differently — checked separately
 ];