ci: add staging deploy step + production approval gate

.github/workflows/deploy.yml

@@ -7,69 +7,82 @@ on:
 permissions:
   contents: write
 
-# Cancel previous deploys if a new push arrives while one is running.
 concurrency:
   group: deploy-production
   cancel-in-progress: true
 
 jobs:
-  # -- Run tests first --
   test:
     name: Pre-deploy tests
     uses: ./.github/workflows/ci.yml
 
-  # -- Push clean plugin files to the deploy branch --
+  deploy-staging:
+    name: Deploy to Staging
+    needs: test
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - name: Deploy via rsync → staging
+        run: |
+          rsync -avz --delete \
+            --exclude='.git' --exclude='.github' \
+            --exclude='tests' --exclude='phpunit.xml.dist' \
+            --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-news-plugin/
+      - name: Staging health check
+        run: |
+          sleep 5
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.peptiderepo.com/ || echo "000")
+          echo "Staging responded: HTTP $STATUS"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
+
   sync-deploy-branch:
     name: Sync deploy branch
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, deploy-staging]
     environment: production
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
       - name: Sync deploy branch
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Fetch the remote deploy branch (may not exist on first run).
           git fetch origin deploy:deploy 2>/dev/null || true
-
-          # If deploy branch exists, check it out; otherwise create it.
           if git rev-parse --verify deploy >/dev/null 2>&1; then
             git checkout deploy
           else
             git checkout --orphan deploy
             git rm -rf --cached . > /dev/null 2>&1 || true
           fi
-
-          # Remove all tracked files so we start clean each time.
           git rm -rf . > /dev/null 2>&1 || true
-
-          # Checkout only the plugin runtime files from main.
           git checkout main -- \
             admin/ \
             includes/ \
             languages/ \
             public/ \
             peptide-news-plugin.php
-
-          # Commit only if there are actual changes.
           git add -A
           if git diff-index --quiet HEAD -- 2>/dev/null; then
             echo "No changes to deploy."
           else
             git commit -m "Deploy ${GITHUB_SHA::7} from main"
           fi
-
-          # Normal push (fast-forward).
           git push origin deploy
 
-  # -- Deploy to Hostinger via rsync --
-  # Rsync the deploy branch content from the GH Actions runner directly
-  # to the plugin directory on Hostinger (avoids needing git access on server).
   deploy:
     name: Deploy to Hostinger
     runs-on: ubuntu-latest
@@ -80,7 +93,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: deploy
-
       - name: Setup SSH key
         run: |
           mkdir -p ~/.ssh
@@ -91,7 +103,6 @@ jobs:
           else
             ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
           fi
-
       - name: Deploy via rsync
         run: |
           rsync -avz --delete \
@@ -99,7 +110,6 @@ jobs:
             --exclude='.github' \
             -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
             ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-news-plugin/
-
       - name: Purge LiteSpeed Cache
         if: success()
         run: |
@@ -111,18 +121,12 @@ jobs:
               echo "LiteSpeed cache purged."
             fi
             touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
-            echo "Cache purge signal sent."
           ENDSSH
-
       - name: Cleanup SSH key
         if: always()
         run: rm -f ~/.ssh/deploy_key
-
       - name: Deploy summary
         run: |
           echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Branch:** \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
           echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
-          echo "- **Method:** rsync from deploy branch to Hostinger" >> $GITHUB_STEP_SUMMARY
+          echo "- **Deployed to:** peptiderepo.com" >> $GITHUB_STEP_SUMMARY
-          echo "- **Deployed to:** ${{ secrets.WP_SITE_URL || 'peptiderepo.com' }}" >> $GITHUB_STEP_SUMMARY