ci(monitor): only flag drift when undeployed commits touch deployable files

Compare prod-deployment SHA to main and ignore changes confined to .github/,
tests/, and docs/build files (which the deploy excludes) — so infra-only commits
don't trip a false 'prod behind main' alert every day.

Agent-Session: cto monitor-drift-filter

.github/workflows/deploy-app.yml

@@ -0,0 +1,128 @@
+name: Reusable Deploy (staging → smoke → production)
+
+# Single shared deploy pipeline for every peptiderepo plugin and the theme.
+# Callers pass `target_path` + `secrets: inherit`; deploy logic lives HERE so a
+# fix lands once instead of in six copy-pasted deploy.yml files.
+#
+# Hardened against the documented Hostinger behaviour of rate-limiting concurrent
+# GitHub-runner IPs (connection timeouts, exit 255): the rsync is retried with
+# backoff, and the plugin-inventory guard is best-effort so a throttled count
+# check never fails an otherwise-good deploy.
+
+on:
+  workflow_call:
+    inputs:
+      target_path:
+        description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
+        required: true
+        type: string
+      run_smoke:
+        description: "Run the staging smoke suite (informational; never gates prod)"
+        required: false
+        default: true
+        type: boolean
+    secrets:
+      SSH_PRIVATE_KEY: {required: true}
+      SSH_HOST: {required: true}
+      SSH_PORT: {required: true}
+      SSH_USERNAME: {required: true}
+      STAGING_WP_ADMIN_USER: {required: false}
+      STAGING_WP_ADMIN_PASSWORD: {required: false}
+
+permissions:
+  contents: read
+
+jobs:
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy via rsync → staging (retry-on-throttle)
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
+          SSHOPT="-i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
+          n=0
+          until [ "$n" -ge 4 ]; do
+            rsync -avz --delete \
+              --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
+              --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+              --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+              --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+              --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+              -e "ssh $SSHOPT" \
+              ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/staging/${{ inputs.target_path }}/" && break
+            n=$((n+1)); echo "staging rsync failed (attempt $n/4) — Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
+          done
+          [ "$n" -lt 4 ] || { echo "::error::staging rsync failed after 4 attempts"; exit 1; }
+      - name: Staging health check
+        run: |
+          sleep 5
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    if: ${{ inputs.run_smoke }}
+    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    secrets:
+      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
+      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
+
+  deploy-production:
+    name: Deploy to Production
+    needs: [deploy-staging]
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy via rsync → production (retry + inventory guard)
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
+          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
+          SSHOPT="-i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
+          PRE=$(ssh $SSHOPT "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
+          echo "Pre-deploy active plugins (best-effort): $PRE"
+          n=0
+          until [ "$n" -ge 4 ]; do
+            rsync -avz --delete \
+              --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
+              --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+              --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+              --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+              --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+              -e "ssh $SSHOPT" \
+              ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/${{ inputs.target_path }}/" && break
+            n=$((n+1)); echo "prod rsync failed (attempt $n/4) — retrying in 25s..."; sleep 25
+          done
+          [ "$n" -lt 4 ] || { echo "::error::production rsync failed after 4 attempts"; exit 1; }
+          POST=$(ssh $SSHOPT "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
+          echo "Post-deploy active plugins (best-effort): $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
+          fi
+      - name: Production health check
+        run: |
+          sleep 5
+          S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+          if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
+          echo "Production healthy (HTTP $S)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+      - name: Deploy summary
+        run: |
+          echo "## Deployment complete" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Target:** ${{ inputs.target_path }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/deploy-health.yml

@@ -0,0 +1,86 @@
+name: Deploy Health Monitor
+
+# Daily drift + deploy-failure check across all peptiderepo app repos.
+# Runs on GitHub's scheduler (independent of the local board cron that died).
+# Opens ONE de-duplicated 'deploy-health' issue here when something is off.
+
+on:
+  schedule:
+    - cron: '0 13 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  actions: read
+
+jobs:
+  check:
+    name: Check prod-vs-main drift + last deploy status
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = 'peptiderepo';
+            const repos = [
+              'prautoblogger','peptide-repo-core','peptide-search-ai',
+              'peptide-news-plugin','peptide-reconstitution-calculator','peptide-starter-theme'
+            ];
+            const short = s => s ? String(s).substring(0,7) : '—';
+            const problems = [];
+            for (const repo of repos) {
+              try {
+                const main = (await github.rest.repos.getBranch({owner, repo, branch:'main'})).data.commit.sha;
+                let runConc = 'none', runSha = '';
+                try {
+                  const runs = (await github.rest.actions.listWorkflowRuns({owner, repo, workflow_id:'deploy.yml', per_page:1})).data.workflow_runs;
+                  if (runs.length) { runConc = runs[0].conclusion || runs[0].status; runSha = runs[0].head_sha; }
+                } catch (e) { runConc = 'no-deploy-workflow'; }
+                let prodSha = null, prodState = 'none';
+                const deps = (await github.rest.repos.listDeployments({owner, repo, environment:'production', per_page:1})).data;
+                if (deps.length) {
+                  prodSha = deps[0].sha;
+                  const sts = (await github.rest.repos.listDeploymentStatuses({owner, repo, deployment_id: deps[0].id, per_page:1})).data;
+                  if (sts.length) prodState = sts[0].state;
+                }
+                if (runConc === 'failure') problems.push(`**${repo}**: latest deploy run failed (\`${short(runSha)}\`)`);
+                if (prodSha && prodSha !== main) {
+                  // Only real drift if undeployed commits touch DEPLOYABLE files
+                  // (ignore .github/, tests/, and docs/build files the deploy excludes).
+                  try {
+                    const cmp = (await github.rest.repos.compareCommits({owner, repo, base: prodSha, head: main})).data;
+                    const deployable = (cmp.files || []).some(f => {
+                      const x = f.filename;
+                      if (x.startsWith('.github/') || x.startsWith('tests/')) return false;
+                      if (/^(ARCHITECTURE|CONVENTIONS|CHANGELOG|README)\.md$/.test(x)) return false;
+                      if (/^(composer\.(json|lock)|phpunit\.xml(\.dist)?|\.?phpcs\.xml\.dist)$/.test(x)) return false;
+                      return true;
+                    });
+                    if (deployable) problems.push(`**${repo}**: prod behind main — prod=\`${short(prodSha)}\` vs main=\`${short(main)}\` (undeployed code changes)`);
+                  } catch (e) {
+                    problems.push(`**${repo}**: prod sha != main sha (could not diff: ${e.message})`);
+                  }
+                }
+                if (prodSha && prodState !== 'success') problems.push(`**${repo}**: last production deployment state is \`${prodState}\``);
+                core.info(`${repo}: main=${short(main)} lastRun=${runConc} prodDeploy=${short(prodSha)}/${prodState}`);
+              } catch (e) {
+                problems.push(`**${repo}**: monitor error — ${e.message}`);
+              }
+            }
+            const summary = problems.length
+              ? `### ⚠️ Deploy health: ${problems.length} issue(s)\n\n` + problems.map(p=>`- ${p}`).join('\n')
+              : `### ✅ All app repos current; last deploy healthy`;
+            await core.summary.addRaw(summary).write();
+            if (problems.length) {
+              const existing = (await github.rest.issues.listForRepo({owner, repo: context.repo.repo, labels:'deploy-health', state:'open'})).data;
+              if (existing.length === 0) {
+                await github.rest.issues.create({ owner, repo: context.repo.repo,
+                  title: `Deploy health: ${problems.length} issue(s) detected`,
+                  body: summary + `\n\n_Opened by deploy-health.yml. Close once resolved; the monitor won't reopen while this stays open._`,
+                  labels: ['deploy-health'] });
+                core.warning(`Opened deploy-health issue (${problems.length} problems)`);
+              } else {
+                core.warning(`${problems.length} problems; deploy-health issue already open (#${existing[0].number})`);
+              }
+            }

global.setup.ts

@@ -33,8 +33,18 @@ setup('authenticate as WP admin', async ({ page }) => {
   await page.fill('#user_pass', password);
   await page.click('#wp-submit');
 
-  // Wait for successful redirect to wp-admin dashboard
-  await expect(page).toHaveURL(/wp-admin/, { timeout: 20_000 });
+  // Wait for any post-login navigation. The site may redirect successful logins
+  // to the homepage (via a login_redirect filter) rather than to wp-admin —
+  // staging does this. So we don't assert the post-submit URL; instead, we
+  // verify we're no longer ON wp-login.php (which would indicate a credential
+  // rejection or 2FA prompt) and then navigate explicitly to wp-admin.
+  await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
+    timeout: 20_000,
+  });
+
+  // Navigate explicitly into wp-admin to capture the authenticated admin session.
+  await page.goto('/wp-admin/');
+  await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });
   await expect(page.locator('#wpadminbar')).toBeVisible();
 
   // Persist session cookies + localStorage to disk

tests/00-homepage.spec.ts

@@ -29,7 +29,7 @@ test.describe('Homepage', () => {
 
   test('renders site name in page title', async ({ page }) => {
     await page.goto('/');
-    await expect(page).toHaveTitle(/peptiderepo/i);
+    await expect(page).toHaveTitle(/peptide ?repo/i);
   });
 
   test('wp-admin bar present (logged-in session)', async ({ page }) => {

tests/01-reconstitution-calculator.spec.ts

@@ -14,7 +14,7 @@
 
 import { test, expect } from '@playwright/test';
 
-const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/reconstitution-calculator/';
+const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/calculator/';
 
 test.describe('Reconstitution Calculator', () => {
   test.beforeEach(async ({ page }) => {

tests/03-admin-plugins.spec.ts

@@ -25,7 +25,7 @@ const REQUIRED_PLUGINS = [
   'peptide-search-ai',
   'peptide-repo-core',
   'peptide-reconstitution-calculator',
-  'pr-autoblogger',
+  'prautoblogger',
   'peptide-starter-theme', // theme, shown differently — checked separately
 ];