ci: add secret/vuln scanning + staging & production deploy pipelines

security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and pushes to main/develop (detective backstop to the pre-commit hook). deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated local staging stack (needs a self-hosted Windows runner). deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready to activate once the Linux server + its runner exist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-01 10:49:08 +02:00
parent 101deb9546
commit 87d44537b9
4 changed files with 136 additions and 0 deletions
@@ -0,0 +1,45 @@
+name: Deploy Production
+
+# Production promotion. The APPROVAL GATE is the git tag: production only ever
+# deploys a tagged release cut on main (see docs/WORKFLOW.md §5). Cutting the tag
+# is the deliberate, auditable "approve to go live" action — and the tag doubles
+# as the rollback target. workflow_dispatch adds a manual "Run workflow" button
+# for re-deploys/rollbacks.
+#
+# STATUS: inactive until (a) the Linux production server exists and (b) a
+# self-hosted Gitea runner is registered on it with labels [self-hosted, production].
+# Tag pushes before then will queue harmlessly. This file is the wiring, ready to
+# switch on — review the deploy step for your server before first use.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Tag or commit to deploy (e.g. v1.2.0)'
+        required: true
+
+jobs:
+  deploy:
+    runs-on: [self-hosted, production]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Deploy the exact tag that triggered the run (immutable), or the
+          # ref given to a manual dispatch.
+          ref: ${{ github.event.inputs.ref || github.ref_name }}
+          fetch-depth: 0
+
+      - name: Deploy release to production
+        run: |
+          echo "Deploying ${{ github.event.inputs.ref || github.ref_name }} to production"
+          # deploy/.env lives on the server (never in git). up.sh validates it,
+          # builds the Linux images, applies EF migrations on boot, and starts
+          # the stack behind the nginx reverse proxy.
+          ./deploy/up.sh --proxy
+
+      - name: Smoke check
+        run: |
+          sleep 5
+          curl -fsS http://localhost/ >/dev/null && echo "Prod responding on :80" || \
+            { echo "Smoke check failed"; exit 1; }