33413cf678
The peptide-starter-theme v1.5.2 release added peptide_starter_is_cloudflare_peer() — a CF-peer IP validator that correctly rejects direct-to-origin requests as non-Cloudflare traffic with HTTP 403. The deploy workflow's post-deploy health check makes exactly such a request from a GHA runner IP, so it now reliably receives 403 even on successful deploys. Two deploys today (peptide-starter-theme v1.5.2, prautoblogger Commit 1a) both succeeded but reported workflow failure due to this. The actual deploys (rsync + cache purge) ran clean; site verified HTTP 200 from real traffic both times. Fix: accept either 200 (normal healthy response) or 403 (validator actively rejecting non-CF origin — itself a positive liveness signal) in the health check. Reject only on 5xx, 4xx-other, or connection failure. Reverting this fix is correct only if we either (a) bypass the validator for our own health-check user-agent, or (b) route the health check through Cloudflare. Both are larger changes for a later release. Agent-Session: cowork-deploy-healthcheck-fix-20260415 Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>
108 lines
3.9 KiB
YAML
Executable File
108 lines
3.9 KiB
YAML
Executable File
name: Deploy PRAutoBlogger to Hostinger
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate Code Quality
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup PHP
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: '8.1'
|
|
tools: composer, phpcs
|
|
coverage: none
|
|
|
|
- name: PHP Lint Check
|
|
run: |
|
|
find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
|
|
test ${PIPESTATUS[0]} -eq 0
|
|
|
|
- name: Install Composer dependencies
|
|
run: composer install --no-interaction --prefer-dist
|
|
|
|
- name: Install WordPress Coding Standards
|
|
run: |
|
|
# Composer 2.2+ blocks plugins by default. The WPCS installer needs
|
|
# dealerdirect/phpcodesniffer-composer-installer to wire standards
|
|
# into PHPCS. Allow it globally before requiring WPCS.
|
|
composer global config --no-plugins allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
|
composer global require "wp-coding-standards/wpcs:^3.0" "phpcsstandards/phpcsutils:^1.0" --no-interaction
|
|
phpcs --config-set installed_paths "$(composer global config home)/vendor/wp-coding-standards/wpcs"
|
|
|
|
- name: Run PHPCS (WordPress standards)
|
|
run: |
|
|
phpcs --standard=WordPress-Core \
|
|
--extensions=php \
|
|
--ignore=vendor/*,tests/*,node_modules/* \
|
|
--warning-severity=0 \
|
|
--report=summary \
|
|
includes/ prautoblogger.php uninstall.php || true
|
|
|
|
- name: Run PHPUnit
|
|
run: vendor/bin/phpunit --testdox
|
|
|
|
deploy:
|
|
needs: validate
|
|
name: Deploy to Production
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: Deploy via rsync
|
|
run: |
|
|
rsync -avz --delete \
|
|
--exclude '.git' \
|
|
--exclude '.github' \
|
|
--exclude 'tests' \
|
|
--exclude 'phpunit.xml.dist' \
|
|
--exclude 'composer.json' \
|
|
--exclude 'composer.lock' \
|
|
--exclude 'vendor' \
|
|
--exclude '.distignore' \
|
|
--exclude 'ARCHITECTURE.md' \
|
|
--exclude 'CONVENTIONS.md' \
|
|
-e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }}" \
|
|
./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/wp-content/plugins/prautoblogger/
|
|
|
|
- name: Purge LiteSpeed Cache
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
|
|
${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
|
|
"cd ~/domains/peptiderepo.com/public_html && find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true"
|
|
|
|
- name: Health check
|
|
run: |
|
|
sleep 5
|
|
STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
|
|
# 200 = normal healthy response.
|
|
# 403 = peptide-starter-theme v1.5.2 CF-peer validator rejecting this
|
|
# GHA-runner direct-to-origin request as non-Cloudflare traffic.
|
|
# That rejection is the validator working — itself a positive
|
|
# liveness signal. Real user traffic via Cloudflare gets 200.
|
|
if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
|
|
echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
|
|
exit 1
|
|
fi
|
|
echo "Site is responsive (HTTP $STATUS)"
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
run: rm -f ~/.ssh/deploy_key
|