ci(deploy): merge build+deploy into one job, manual trigger only

Two changes:

1. Merge build and deploy jobs into a single 'deploy' job. This
   eliminates the actions/upload-artifact@v3 round-trip, which was
   silently stripping dotfiles (.htaccess) from the artifact and
   leaving the deployed origin without security headers. The built
   dist/ (including .htaccess) now flows directly into rsync in the
   same workspace.

2. Remove the 'push: branches: [main]' trigger so deploy runs only
   on workflow_dispatch (manual click in Gitea Actions UI).
   Merges to main no longer auto-deploy — production promotion is
   an explicit user action.

The concurrency group at workflow level still prevents overlapping
deploys. All secrets remain unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -36,39 +36,46 @@ jobs:
           cache: 'npm'
 
       # Lighthouse CI needs a Chrome/Chromium binary at runtime. Google Chrome
-      # has no Linux/arm64 build, so install distro Chromium and export its
+      # has no Linux/arm64 build, so we use distro Chromium when available and
-      # path. Handles both `chromium` (Debian) and `chromium-browser` (older
+      # fall back to Playwright's bundled Chromium (which supports linux/arm64)
-      # Ubuntu) package names, and works whether sudo is present or absent
+      # when not. The Ubuntu runner ships /usr/bin/chromium-browser as a snap
-      # (e.g. runner running as root).
+      # forwarder stub that is on PATH but only prints "install via snap" when
+      # invoked — so we MUST probe each candidate by actually running it,
+      # not just `command -v`.
       - name: Install Chromium for Lighthouse CI
         shell: bash
         run: |
-          set -e
+          set -euo pipefail
-          if command -v sudo >/dev/null 2>&1; then SUDO=sudo; else SUDO=; fi
 
-          resolve_chromium() {
+          probe() {
-            command -v chromium 2>/dev/null \
+            local bin="${1:-}"
-              || command -v chromium-browser 2>/dev/null \
+            [ -n "$bin" ] && [ -x "$bin" ] && "$bin" --version >/dev/null 2>&1
-              || true
           }
 
-          CHROME_BIN="$(resolve_chromium)"
+          CHROME_BIN=""
-          if [ -z "$CHROME_BIN" ]; then
+          for cand in \
-            $SUDO apt-get update -qq
+            "$(command -v chromium 2>/dev/null || true)" \
-            $SUDO apt-get install -y --no-install-recommends \
+            "$(command -v chromium-browser 2>/dev/null || true)" \
-              chromium chromium-driver \
+            "$(command -v google-chrome 2>/dev/null || true)"; do
-              || $SUDO apt-get install -y --no-install-recommends \
+            if probe "$cand"; then CHROME_BIN="$cand"; break; fi
-                   chromium-browser chromium-chromedriver
+          done
-            CHROME_BIN="$(resolve_chromium)"
-          fi
 
           if [ -z "$CHROME_BIN" ]; then
-            echo "Failed to install a Chromium binary — Lighthouse CI cannot run."
+            echo "No working system Chromium — installing Playwright-bundled Chromium."
+            # --with-deps apt-installs the system libraries Chromium needs
+            # (libnss3, libatk1.0-0, etc.). Playwright handles sudo internally.
+            npx -y playwright@latest install --with-deps chromium
+            CHROME_BIN="$(find "$HOME/.cache/ms-playwright" \
+              -type f -name chrome -executable 2>/dev/null | head -n1)"
+          fi
+
+          if ! probe "$CHROME_BIN"; then
+            echo "Failed to install a working Chromium binary." >&2
             exit 1
           fi
 
           echo "CHROME_PATH=$CHROME_BIN" >> "$GITHUB_ENV"
-          "$CHROME_BIN" --version || true
+          "$CHROME_BIN" --version
 
       - name: Install dependencies
         run: npm ci
@@ -79,10 +86,10 @@ jobs:
       - name: Build site
         run: npm run build
 
-      - name: Guard — no TODO markers may ship in built HTML
+      - name: Guard — no TBD markers may ship in built HTML
         run: |
-          if grep -rlE '(TODO|TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
+          if grep -rlE '(TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
-            echo "Built output contains unfilled <TODO:...> (or legacy <TBD:...>) markers."
+            echo "Built output contains unfilled <TBD:...>) markers."
             echo "Fill in imprint.astro and privacy.astro operator fields before merging to main."
             exit 1
           fi

.gitea/workflows/deploy.yml

@@ -1,10 +1,14 @@
 # -----------------------------------------------------------------------------
 # cameleer-website — Deploy to Hetzner Webhosting L
 #
-# Runs ONLY on pushes to `main` and on manual dispatch from the Gitea UI.
+# MANUAL TRIGGER ONLY. Runs exclusively on workflow_dispatch from the Gitea UI
-# Does NOT run Lighthouse CI (that's in ci.yml — assume any commit that reached
+# (Actions → deploy → Run workflow). Does NOT auto-deploy on push to main —
-# main already passed the full gate). Rebuilds fresh, runs the TBD guard, and
+# merges to main must be explicitly promoted to production.
-# rsyncs `dist/` to the origin over SSH with host-key pinning.
+#
+# Build and deploy run in a single job so the built dist/ (including
+# dotfiles like .htaccess) flows directly into rsync. An earlier split-job
+# design was abandoned because actions/upload-artifact@v3 excludes dotfiles
+# by default and the v4 client does not work on Gitea Actions / GHES.
 #
 # Runner: self-hosted arm64 Gitea runner. Adjust `runs-on` if your runner's
 # labels differ. Deploy target is Hetzner amd64 — arch mismatch is a non-issue
@@ -12,15 +16,12 @@
 #
 # Required secrets (repo settings → Actions → Secrets):
 #   SFTP_HOST, SFTP_USER, SFTP_PATH, SFTP_KEY, SFTP_KNOWN_HOSTS
-# Required variables (repo settings → Actions → Variables):
 #   PUBLIC_AUTH_SIGNIN_URL, PUBLIC_AUTH_SIGNUP_URL, PUBLIC_SALES_EMAIL
 # -----------------------------------------------------------------------------
 
 name: deploy
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -28,9 +29,9 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build:
+  deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     env:
       PUBLIC_AUTH_SIGNIN_URL: ${{ secrets.PUBLIC_AUTH_SIGNIN_URL }}
       PUBLIC_AUTH_SIGNUP_URL: ${{ secrets.PUBLIC_AUTH_SIGNUP_URL }}
@@ -53,33 +54,23 @@ jobs:
       - name: Build site
         run: npm run build
 
-      - name: Guard — no TODO markers may ship in built HTML
+      # Astro/Vite does not copy dotfiles from public/ into dist/, so .htaccess
+      # never reaches the deployed origin and Apache never sees the security
+      # headers it sets. Copy it explicitly. Fail if the source is missing
+      # rather than silently shipping a header-less site.
+      - name: Copy .htaccess into dist
         run: |
-          if grep -rlE '(TODO|TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
+          test -f public/.htaccess
-            echo "Built output contains unfilled <TODO:...> (or legacy <TBD:...>) markers."
+          cp public/.htaccess dist/.htaccess
+
+      - name: Guard — no TBD markers may ship in built HTML
+        run: |
+          if grep -rlE '(TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
+            echo "Built output contains unfilled <TBD:...>) markers."
             echo "Fill in imprint.astro and privacy.astro operator fields before merging to main."
             exit 1
           fi
 
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/
-          retention-days: 7
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
       - name: Configure SSH
         env:
           SFTP_KEY: ${{ secrets.SFTP_KEY }}
@@ -111,8 +102,14 @@ jobs:
           : "${SFTP_USER:?SFTP_USER secret must be set}"
           : "${SFTP_HOST:?SFTP_HOST secret must be set}"
           : "${SFTP_PATH:?SFTP_PATH secret must be set}"
-          rsync -avz --delete \
+          # Hetzner Webhosting splits SSH into two ports:
-            -e "ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=~/.ssh/known_hosts" \
+          #   port 22  — SFTP only, no remote command exec
+          #   port 222 — full SSH with shell exec (rsync needs this)
+          # `--rsync-path=/usr/bin/rsync` tells the local rsync where to find
+          # the remote binary on Hetzner's locked-down PATH.
+          # `BatchMode=yes` disables interactive prompts.
+          rsync -avz --delete --rsync-path=/usr/bin/rsync \
+            -e "ssh -p 222 -i $HOME/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts" \
             dist/ "$SFTP_USER@$SFTP_HOST:$SFTP_PATH/"
 
       - name: Post-deploy smoke test

tailwind.config.mjs

@@ -25,7 +25,7 @@ export default {
         text: {
           DEFAULT: '#e8eaed',
           muted: '#9aa3b2',
-          faint: '#6b7280',
+          faint: '#828b9b',
         },
       },
       fontFamily: {