ci: migrate to rsync deploy, fix concurrency group, standardize excludes

.github/workflows/deploy.yml

@@ -5,10 +5,10 @@ on:
     branches: [ main ]
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
-  group: deploy-production
+  group: deploy-peptide-search-ai
   cancel-in-progress: true
 
 jobs:
@@ -62,9 +62,12 @@ jobs:
         run: |
           rsync -avz --delete \
             --exclude='.git' --exclude='.github' \
+            --exclude='tests' --exclude='phpunit.xml.dist' \
+            --exclude='composer.json' --exclude='composer.lock' \
+            --exclude='vendor' --exclude='.phpcs.xml.dist' \
             --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
             -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
-            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-search-ai/
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-search-ai/
       - name: Staging health check
         run: |
           sleep 5
@@ -82,91 +85,48 @@ jobs:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
 
-  sync-deploy-branch:
+  deploy-production:
-    name: Sync deploy branch
+    name: Deploy to Production
-    runs-on: ubuntu-latest
     needs: [test, validate, deploy-staging, smoke]
+    runs-on: ubuntu-latest
     environment: production
     steps:
       - uses: actions/checkout@v4
-        with:
+      - name: Setup SSH key
-          fetch-depth: 0
-      - name: Sync deploy branch
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git fetch origin deploy:deploy 2>/dev/null || true
-          if git rev-parse --verify deploy >/dev/null 2>&1; then
-            git checkout deploy
-          else
-            git checkout --orphan deploy
-            git rm -rf --cached . > /dev/null 2>&1 || true
-          fi
-          git rm -rf . > /dev/null 2>&1 || true
-          git checkout main -- \
-            assets/ \
-            includes/ \
-            peptide-search-ai.php \
-            readme.txt
-          git add -A
-          if git diff-index --quiet HEAD -- 2>/dev/null; then
-            echo "No changes to deploy."
-          else
-            git commit -m "Deploy ${GITHUB_SHA::7} from main"
-          fi
-          git push origin deploy
-
-  deploy:
-    name: Deploy to Hostinger
-    runs-on: ubuntu-latest
-    needs: sync-deploy-branch
-    environment: production
-    steps:
-      - name: Pull deploy branch on Hostinger
-        uses: appleboy/ssh-action@v1
-        with:
-          host: ${{ secrets.SSH_HOST }}
-          username: ${{ secrets.SSH_USERNAME }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          port: ${{ secrets.SSH_PORT }}
-          script_stop: true
-          envs: DEPLOY_KEY
-          script: |
           mkdir -p ~/.ssh
-            ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
-            if [ ! -f ~/.ssh/deploy_key ]; then
-              echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-            fi
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-            if ! grep -q "github.com" ~/.ssh/config 2>/dev/null; then
+      - name: Deploy via rsync → production
-              cat >> ~/.ssh/config <<'SSHEOF'
-            Host github.com
-              IdentityFile ~/.ssh/deploy_key
-              StrictHostKeyChecking no
-            SSHEOF
-              chmod 600 ~/.ssh/config
-            fi
-            PLUGIN_DIR="$HOME/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-search-ai"
-            REPO_URL="git@github.com:peptiderepo/peptide-search-ai.git"
-            if [ -d "$PLUGIN_DIR/.git" ]; then
-              cd "$PLUGIN_DIR"
-              git fetch origin deploy
-              git reset --hard origin/deploy
-            else
-              rm -rf "$PLUGIN_DIR"
-              git clone -b deploy "$REPO_URL" "$PLUGIN_DIR"
-            fi
-            echo "Deployed to $PLUGIN_DIR"
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
-      - name: HTTP health check
         run: |
-          STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 "https://peptiderepo.com/")
+          rsync -avz --delete \
-          if [ "$STATUS" -eq 200 ] || [ "$STATUS" -eq 403 ]; then
+            --exclude='.git' --exclude='.github' \
-            echo "✓ Production healthy (HTTP $STATUS)"
+            --exclude='tests' --exclude='phpunit.xml.dist' \
-          else
+            --exclude='composer.json' --exclude='composer.lock' \
-            echo "⚠ Unexpected HTTP $STATUS"; exit 1
+            --exclude='vendor' --exclude='.phpcs.xml.dist' \
+            --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
+            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }}" \
+            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-search-ai/
+      - name: Purge LiteSpeed Cache
+        run: |
+          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
+            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
+            "cd ~/domains/peptiderepo.com/public_html && \
+             wp litespeed-purge all 2>/dev/null || \
+             (find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null) || true"
+      - name: Production health check
+        run: |
+          sleep 5
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
+          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
+            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
+            exit 1
           fi
+          echo "Production healthy (HTTP $STATUS)"
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key
       - name: Deploy summary
         run: |
           echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY