Add reusable deploy file for new projects

[itineris-milos]

No description provided.

[Copilot]

Pull request overview

Adds a new reusable GitHub Actions workflow intended to deploy a WordPress site to Kinsta over SSH (with Tailscale), including build steps and post-deploy smoke checks. This lives in the central .github repo so other projects can call it via workflow_call.

Changes:

• Introduces a reusable deploy-wp.yml workflow that installs dependencies, builds the theme, and rsyncs a release to a remote host.
• Adds remote release management (uploads/.env symlinks, promote release, rollback on failure, cleanup old releases).
• Adds optional smoke testing (with/without basic auth) and WP language pack installation/purging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[itineris-milos]

Update: rebased, review addressed, OPcache purge added

Rebased onto main — all 21 commits replayed and re-signed (e4fdaca → 6781961), then three new commits:

Commit	What
8d37bd4	Review fixes: guard uploads symlink against a real directory, skip rollback relink on first deploys (but still clean up the failed release), quote WP_LANG, rename the Wordfence step to Copy + skip when the shared file doesn't exist yet
23beeca	Reset OPcache after promoting the release — same architecture as trellis-deploy.yml@0.9 (org secrets via secrets: inherit, X-Opcache-Purge header, SHA-256 fingerprint verified server-side by the itineris-opcache-purge mu-plugin). Fail-safe: warns, never fails a deploy; skips silently if the secret is absent. Sends basic auth when the site is protected
96a4861	Unique release dir per attempt (sha + run_id + run_attempt): keying on the sha alone reused — and on a failed re-run of the live commit, deleted — the directory production was serving from

(An earlier commit sharing wflogs across releases was dropped — Lee already solved the Wordfence WAF issue with the cp approach; the log folder was never the problem.)

Copilot review verdicts (inline replies on each thread): accepted the uploads-symlink guard, first-deploy rollback guard, WP_LANG quoting, and the release-dir-reuse fix; declined the workflow_call.secrets declaration (all callers use secrets: inherit — verified) and the auto-create-.deployignore suggestion (failing loudly beats silently deploying node_modules; the file is guaranteed by WordPressStarter).

⚠️ Reminder: callers pin @add-blocktheme-deployment-file, so these changes are live on the next deploy of any hybrid project. Everything is fail-safe by design, but test on a staging deploy (momentumcharity) before merge + tag.

Per-site follow-ups (not this PR): each hybrid project needs the itineris-opcache-purge mu-plugin + the OPCACHE_PURGE_TOKEN_HASH define before the purge confirms — until then the step logs a warning and moves on.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

.github/workflows/deploy-wp.yml:191

• On a first Kinsta deployment, ~/public is a real web-root directory. ln -sfn TARGET ~/public does not replace that directory; it creates a link inside it, so the web root is never promoted. Remove only an empty non-symlink directory first (and fail safely when migration is required) before creating the release symlink.

        run: ssh ${{ inputs.SSH_USER }}@${{ inputs.SSH_HOST }} -p ${{ vars.SSH_PORT }} 'ln -sfn ~/deploy/releases/${{ github.sha }} ~/public'

.github/workflows/deploy-wp.yml:222

• This failure handler is evaluated before the cache purge, plugin/theme language installation, and cleanup steps. A failure in any of those later steps therefore leaves the new release promoted (and potentially partially modified) while the workflow reports failure. Place the rollback handler after all fallible post-promotion steps, or explicitly make non-critical post-deployment tasks non-failing.

      - name: Rollback deployment on failure
        if: failure()

.github/workflows/deploy-wp.yml:196

• The secret is interpolated directly into shell syntax, so a valid basic-auth password containing a double quote, backtick, or command-substitution characters can break or alter this test. Pass the secret through the step environment and test the environment variable instead.

          if [ -n "${{ secrets.BASIC_AUTH_PASSWORD }}" ]; then