ci(deploy): merge build+deploy into one job, manual trigger only

Two changes:

1. Merge build and deploy jobs into a single 'deploy' job. This
   eliminates the actions/upload-artifact@v3 round-trip, which was
   silently stripping dotfiles (.htaccess) from the artifact and
   leaving the deployed origin without security headers. The built
   dist/ (including .htaccess) now flows directly into rsync in the
   same workspace.

2. Remove the 'push: branches: [main]' trigger so deploy runs only
   on workflow_dispatch (manual click in Gitea Actions UI).
   Merges to main no longer auto-deploy — production promotion is
   an explicit user action.

The concurrency group at workflow level still prevents overlapping
deploys. All secrets remain unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,9 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
-      PUBLIC_AUTH_SIGNIN_URL: ${{ vars.PUBLIC_AUTH_SIGNIN_URL }}
-      PUBLIC_AUTH_SIGNUP_URL: ${{ vars.PUBLIC_AUTH_SIGNUP_URL }}
-      PUBLIC_SALES_EMAIL: ${{ vars.PUBLIC_SALES_EMAIL }}
+      PUBLIC_AUTH_SIGNIN_URL: ${{ secrets.PUBLIC_AUTH_SIGNIN_URL }}
+      PUBLIC_AUTH_SIGNUP_URL: ${{ secrets.PUBLIC_AUTH_SIGNUP_URL }}
+      PUBLIC_SALES_EMAIL: ${{ secrets.PUBLIC_SALES_EMAIL }}
 
     steps:
       - uses: actions/checkout@v4
@@ -36,39 +36,46 @@ jobs:
           cache: 'npm'
 
       # Lighthouse CI needs a Chrome/Chromium binary at runtime. Google Chrome
-      # has no Linux/arm64 build, so install distro Chromium and export its
-      # path. Handles both `chromium` (Debian) and `chromium-browser` (older
-      # Ubuntu) package names, and works whether sudo is present or absent
-      # (e.g. runner running as root).
+      # has no Linux/arm64 build, so we use distro Chromium when available and
+      # fall back to Playwright's bundled Chromium (which supports linux/arm64)
+      # when not. The Ubuntu runner ships /usr/bin/chromium-browser as a snap
+      # forwarder stub that is on PATH but only prints "install via snap" when
+      # invoked — so we MUST probe each candidate by actually running it,
+      # not just `command -v`.
       - name: Install Chromium for Lighthouse CI
         shell: bash
         run: |
-          set -e
-          if command -v sudo >/dev/null 2>&1; then SUDO=sudo; else SUDO=; fi
+          set -euo pipefail
 
-          resolve_chromium() {
-            command -v chromium 2>/dev/null \
-              || command -v chromium-browser 2>/dev/null \
-              || true
+          probe() {
+            local bin="${1:-}"
+            [ -n "$bin" ] && [ -x "$bin" ] && "$bin" --version >/dev/null 2>&1
           }
 
-          CHROME_BIN="$(resolve_chromium)"
-          if [ -z "$CHROME_BIN" ]; then
-            $SUDO apt-get update -qq
-            $SUDO apt-get install -y --no-install-recommends \
-              chromium chromium-driver \
-              || $SUDO apt-get install -y --no-install-recommends \
-                   chromium-browser chromium-chromedriver
-            CHROME_BIN="$(resolve_chromium)"
-          fi
+          CHROME_BIN=""
+          for cand in \
+            "$(command -v chromium 2>/dev/null || true)" \
+            "$(command -v chromium-browser 2>/dev/null || true)" \
+            "$(command -v google-chrome 2>/dev/null || true)"; do
+            if probe "$cand"; then CHROME_BIN="$cand"; break; fi
+          done
 
           if [ -z "$CHROME_BIN" ]; then
-            echo "Failed to install a Chromium binary — Lighthouse CI cannot run."
+            echo "No working system Chromium — installing Playwright-bundled Chromium."
+            # --with-deps apt-installs the system libraries Chromium needs
+            # (libnss3, libatk1.0-0, etc.). Playwright handles sudo internally.
+            npx -y playwright@latest install --with-deps chromium
+            CHROME_BIN="$(find "$HOME/.cache/ms-playwright" \
+              -type f -name chrome -executable 2>/dev/null | head -n1)"
+          fi
+
+          if ! probe "$CHROME_BIN"; then
+            echo "Failed to install a working Chromium binary." >&2
             exit 1
           fi
 
           echo "CHROME_PATH=$CHROME_BIN" >> "$GITHUB_ENV"
-          "$CHROME_BIN" --version || true
+          "$CHROME_BIN" --version
 
       - name: Install dependencies
         run: npm ci
@@ -81,8 +88,8 @@ jobs:
 
       - name: Guard — no TBD markers may ship in built HTML
         run: |
-          if grep -rl 'TBD:' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
-            echo "Built output contains unfilled <TBD:...> markers."
+          if grep -rlE '(TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
+            echo "Built output contains unfilled <TBD:...>) markers."
             echo "Fill in imprint.astro and privacy.astro operator fields before merging to main."
             exit 1
           fi

.gitea/workflows/deploy.yml

@@ -1,10 +1,14 @@
 # -----------------------------------------------------------------------------
 # cameleer-website — Deploy to Hetzner Webhosting L
 #
-# Runs ONLY on pushes to `main` and on manual dispatch from the Gitea UI.
-# Does NOT run Lighthouse CI (that's in ci.yml — assume any commit that reached
-# main already passed the full gate). Rebuilds fresh, runs the TBD guard, and
-# rsyncs `dist/` to the origin over SSH with host-key pinning.
+# MANUAL TRIGGER ONLY. Runs exclusively on workflow_dispatch from the Gitea UI
+# (Actions → deploy → Run workflow). Does NOT auto-deploy on push to main —
+# merges to main must be explicitly promoted to production.
+#
+# Build and deploy run in a single job so the built dist/ (including
+# dotfiles like .htaccess) flows directly into rsync. An earlier split-job
+# design was abandoned because actions/upload-artifact@v3 excludes dotfiles
+# by default and the v4 client does not work on Gitea Actions / GHES.
 #
 # Runner: self-hosted arm64 Gitea runner. Adjust `runs-on` if your runner's
 # labels differ. Deploy target is Hetzner amd64 — arch mismatch is a non-issue
@@ -12,15 +16,12 @@
 #
 # Required secrets (repo settings → Actions → Secrets):
 #   SFTP_HOST, SFTP_USER, SFTP_PATH, SFTP_KEY, SFTP_KNOWN_HOSTS
-# Required variables (repo settings → Actions → Variables):
 #   PUBLIC_AUTH_SIGNIN_URL, PUBLIC_AUTH_SIGNUP_URL, PUBLIC_SALES_EMAIL
 # -----------------------------------------------------------------------------
 
 name: deploy
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -28,13 +29,13 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build:
+  deploy:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 25
     env:
-      PUBLIC_AUTH_SIGNIN_URL: ${{ vars.PUBLIC_AUTH_SIGNIN_URL }}
-      PUBLIC_AUTH_SIGNUP_URL: ${{ vars.PUBLIC_AUTH_SIGNUP_URL }}
-      PUBLIC_SALES_EMAIL: ${{ vars.PUBLIC_SALES_EMAIL }}
+      PUBLIC_AUTH_SIGNIN_URL: ${{ secrets.PUBLIC_AUTH_SIGNIN_URL }}
+      PUBLIC_AUTH_SIGNUP_URL: ${{ secrets.PUBLIC_AUTH_SIGNUP_URL }}
+      PUBLIC_SALES_EMAIL: ${{ secrets.PUBLIC_SALES_EMAIL }}
 
     steps:
       - uses: actions/checkout@v4
@@ -53,33 +54,23 @@ jobs:
       - name: Build site
         run: npm run build
 
+      # Astro/Vite does not copy dotfiles from public/ into dist/, so .htaccess
+      # never reaches the deployed origin and Apache never sees the security
+      # headers it sets. Copy it explicitly. Fail if the source is missing
+      # rather than silently shipping a header-less site.
+      - name: Copy .htaccess into dist
+        run: |
+          test -f public/.htaccess
+          cp public/.htaccess dist/.htaccess
+
       - name: Guard — no TBD markers may ship in built HTML
         run: |
-          if grep -rl 'TBD:' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
-            echo "Built output contains unfilled <TBD:...> markers."
+          if grep -rlE '(TBD):' dist 2>/dev/null | grep -E '\.(html|svg)$'; then
+            echo "Built output contains unfilled <TBD:...>) markers."
             echo "Fill in imprint.astro and privacy.astro operator fields before merging to main."
             exit 1
           fi
 
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: dist
-          path: dist/
-          retention-days: 7
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-
       - name: Configure SSH
         env:
           SFTP_KEY: ${{ secrets.SFTP_KEY }}
@@ -111,8 +102,14 @@ jobs:
           : "${SFTP_USER:?SFTP_USER secret must be set}"
           : "${SFTP_HOST:?SFTP_HOST secret must be set}"
           : "${SFTP_PATH:?SFTP_PATH secret must be set}"
-          rsync -avz --delete \
-            -e "ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=~/.ssh/known_hosts" \
+          # Hetzner Webhosting splits SSH into two ports:
+          #   port 22  — SFTP only, no remote command exec
+          #   port 222 — full SSH with shell exec (rsync needs this)
+          # `--rsync-path=/usr/bin/rsync` tells the local rsync where to find
+          # the remote binary on Hetzner's locked-down PATH.
+          # `BatchMode=yes` disables interactive prompts.
+          rsync -avz --delete --rsync-path=/usr/bin/rsync \
+            -e "ssh -p 222 -i $HOME/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts" \
             dist/ "$SFTP_USER@$SFTP_HOST:$SFTP_PATH/"
 
       - name: Post-deploy smoke test

OPERATOR-CHECKLIST.md

@@ -70,11 +70,15 @@ Add these under Repository settings → Actions → Secrets (or variables):
 | `SFTP_PATH` | secret | Absolute path to document root (e.g., `/usr/home/cameleer/public_html/www.cameleer.io`) |
 | `SFTP_KEY` | secret | Contents of `~/.ssh/cameleer-website-deploy` (private key, PEM) |
 | `SFTP_KNOWN_HOSTS` | secret | Contents of `hetzner-known-hosts.txt` (captured via `ssh-keyscan`) |
-| `PUBLIC_AUTH_SIGNIN_URL` | variable | `https://auth.cameleer.io/sign-in` |
-| `PUBLIC_AUTH_SIGNUP_URL` | variable | `https://auth.cameleer.io/sign-in?first_screen=register` |
-| `PUBLIC_SALES_EMAIL` | variable | `sales@cameleer.io` (or whatever sales alias you set up) |
+| `PUBLIC_AUTH_SIGNIN_URL` | secret | `https://auth.cameleer.io/sign-in` |
+| `PUBLIC_AUTH_SIGNUP_URL` | secret | `https://auth.cameleer.io/sign-in?first_screen=register` |
+| `PUBLIC_SALES_EMAIL` | secret | `sales@cameleer.io` (or whatever sales alias you set up) |
 
-## 4. Content TBD — before go-live
+These three are not actually secret (they end up in the built HTML), but Gitea's
+Actions UI puts them in the **Secrets** tab alongside the SFTP credentials. The
+workflows read them via the `${{ secrets.* }}` context.
+
+## 4. Content TODO — before go-live
 
 - [ ] Fill in `src/pages/imprint.astro` `operator` object with real legal details.
 - [ ] Fill in `operatorContact` in `src/pages/privacy.astro`.

src/pages/imprint.astro

@@ -4,7 +4,7 @@ import SiteHeader from '../components/SiteHeader.astro';
 import SiteFooter from '../components/SiteFooter.astro';
 
 // Imprint (Impressum) per TMG §5 / DDG §5.
-// Values prefixed "<TBD:" MUST be replaced with real operator data before go-live.
+// Values prefixed "<TODO:" MUST be replaced with real operator data before go-live.
 // See docs/superpowers/specs/2026-04-24-cameleer-website-design.md §6.4.
 const operator = {
   legalName: '<TODO:legal name of operating entity>',

tailwind.config.mjs

@@ -25,7 +25,7 @@ export default {
         text: {
           DEFAULT: '#e8eaed',
           muted: '#9aa3b2',
-          faint: '#6b7280',
+          faint: '#828b9b',
         },
       },
       fontFamily: {