ci: migrate to rsync deploy, fix concurrency group, add smoke gate

.github/workflows/deploy.yml

@@ -5,10 +5,10 @@ on:
     branches: [ main ]
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
-  group: deploy-production
+  group: deploy-peptide-news-plugin
   cancel-in-progress: true
 
 jobs:
@@ -36,9 +36,11 @@ jobs:
           rsync -avz --delete \
             --exclude='.git' --exclude='.github' \
             --exclude='tests' --exclude='phpunit.xml.dist' \
+            --exclude='composer.json' --exclude='composer.lock' \
+            --exclude='vendor' --exclude='.phpcs.xml.dist' \
             --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
             -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-news-plugin/
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-news-plugin/
       - name: Staging health check
         run: |
           sleep 5
@@ -48,81 +50,54 @@ jobs:
         if: always()
         run: rm -f ~/.ssh/deploy_key
 
-  sync-deploy-branch:
+  smoke:
-    name: Sync deploy branch
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
+    secrets:
+      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
+      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
+
+  deploy-production:
+    name: Deploy to Production
+    needs: [test, deploy-staging, smoke]
     runs-on: ubuntu-latest
-    needs: [test, deploy-staging]
     environment: production
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Sync deploy branch
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git fetch origin deploy:deploy 2>/dev/null || true
-          if git rev-parse --verify deploy >/dev/null 2>&1; then
-            git checkout deploy
-          else
-            git checkout --orphan deploy
-            git rm -rf --cached . > /dev/null 2>&1 || true
-          fi
-          git rm -rf . > /dev/null 2>&1 || true
-          git checkout main -- \
-            admin/ \
-            includes/ \
-            languages/ \
-            public/ \
-            peptide-news-plugin.php
-          git add -A
-          if git diff-index --quiet HEAD -- 2>/dev/null; then
-            echo "No changes to deploy."
-          else
-            git commit -m "Deploy ${GITHUB_SHA::7} from main"
-          fi
-          git push origin deploy
-
-  deploy:
-    name: Deploy to Hostinger
-    runs-on: ubuntu-latest
-    needs: sync-deploy-branch
-    environment: production
-    steps:
-      - name: Checkout deploy branch
-        uses: actions/checkout@v4
-        with:
-          ref: deploy
       - name: Setup SSH key
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          if [ -n "${{ secrets.KNOWN_HOSTS }}" ]; then
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-            echo "${{ secrets.KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+      - name: Deploy via rsync → production
-          else
-            ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-          fi
-      - name: Deploy via rsync
         run: |
           rsync -avz --delete \
-            --exclude='.git' \
+            --exclude='.git' --exclude='.github' \
-            --exclude='.github' \
+            --exclude='tests' --exclude='phpunit.xml.dist' \
-            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
+            --exclude='composer.json' --exclude='composer.lock' \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-news-plugin/
+            --exclude='vendor' --exclude='.phpcs.xml.dist' \
+            --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }}" \
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-news-plugin/
       - name: Purge LiteSpeed Cache
-        if: success()
         run: |
-          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new \
+          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
-            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
+            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
-            CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
+            "cd ~/domains/peptiderepo.com/public_html && \
-            if [ -d "$CACHE_DIR" ]; then
+             wp litespeed-purge all 2>/dev/null || \
-              rm -rf "$CACHE_DIR"/*
+             (find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null) || true"
-              echo "LiteSpeed cache purged."
+      - name: Production health check
-            fi
+        run: |
-            touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
+          sleep 5
-          ENDSSH
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
-      - name: Cleanup SSH key
+          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
+            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
+            exit 1
+          fi
+          echo "Production healthy (HTTP $STATUS)"
+      - name: Cleanup
         if: always()
         run: rm -f ~/.ssh/deploy_key
       - name: Deploy summary