Enable automatic pre-prod deploy after main merges

[iainherd]

Goal

Enable automatic deployment of merged main builds to the password-gated pre-prod site at https://lircap.pendragon.bot/, so preview updates are visible after issue PRs merge without a manual VPS sync.

Context

During the #7/#12/#13 sequence, GitHub CI passed and main advanced, but https://lircap.pendragon.bot/ continued serving the first skeleton bundle until a manual redeploy was run.

Current deploy state:

• .github/workflows/ci.yml verifies PRs and pushes to main.
• .github/workflows/deploy-preprod.yml is manual and currently builds/uploads dist/ only.
• Actual sync to the VPS is documented in docs/deploy/preprod-live.md and is manual:
  • build dist/
  • archive it
  • copy to backoffice via /root/.ssh/pendragon_hetzner_ed25519
  • extract to /opt/lircap-preprod/site
  • restart the Caddy Docker Compose service
• Pre-prod is password-gated by Caddy basic auth and must remain protected.

Delegate implementation profile

Primary implementation profile: agent:devops-deployer.

Required review profiles before merge:

• agent:code-security-reviewer
• agent:orchestrator
• optionally agent:browser-qa-reviewer for post-deploy smoke evidence

Acceptance criteria

• A GitHub Actions path deploys main automatically to lircap.pendragon.bot after the CI quality gate passes.
• Deployment only runs from trusted refs/events, not arbitrary fork PRs.
• SSH host, username, key, and any deploy paths/secrets are sourced from GitHub Actions secrets or repository/environment variables, not committed source.
• The workflow builds/verifies the static site before deployment, or depends on the existing successful CI gate before syncing.
• Deployment sync is atomic or near-atomic enough to avoid leaving an empty/broken site/ directory if transfer fails.
• Password gate, Caddy security headers, and static-only serving model remain intact.
• Post-deploy smoke checks verify at minimum:
  • unauthenticated / returns 401 with WWW-Authenticate;
  • authenticated /, /team/, /contact/, /robots.txt, and /sitemap.xml return expected content;
  • no secrets are printed in workflow logs.
• Documentation is updated with the auto-deploy model, required GitHub secrets/variables, rollback path, and how to trigger/re-run deploys.
• The old manual deploy workflow is either converted safely or clearly retained as a manual fallback.

Security constraints

• Do not print SSH keys, basic-auth credentials, password hashes, tokens, or secret values in logs, comments, PR bodies, or docs.
• Do not weaken the Caddy basic-auth gate.
• Do not expose lircap.pendragon.bot unauthenticated.
• Do not add third-party deployment services unless explicitly approved.
• Avoid disabling host-key checks unless a documented host-key pinning alternative is impossible; prefer a pinned known_hosts secret/variable.

Suggested implementation notes

• Consider using a dedicated GitHub Environment such as preprod with required secrets:
  • PREPROD_SSH_HOST
  • PREPROD_SSH_USER
  • PREPROD_SSH_KEY
  • PREPROD_SSH_KNOWN_HOSTS
  • optional PREPROD_SITE_PATH
• Prefer rsync or tar-over-ssh into a release directory, then swap a symlink or move into place to avoid partial deploys.
• Keep a manual workflow_dispatch redeploy path for emergency redeploy/rollback.
• Record real post-deploy smoke evidence in the PR or docs.

Verification

Before sign-off, run and report:

• GitHub Actions run URL for an automatic deploy from main.
• Workflow logs showing build/verify/deploy/smoke succeeded without secret leakage.
• External smoke evidence for unauthenticated 401.
• Authenticated route smoke evidence gathered without printing credentials.
• Repository docs updated and tests/build still passing.

[iainherd]

Auto-deploy is now verified on the real post-merge path.

Merged PR: #58
Merge commit: 1360f0cb1edda350fddd45d13eb7c9a672cba8a5

Post-merge GitHub Actions:

• CI on main: PASS — https://github.com/lircap/lircap-com/actions/runs/28322282349
• Deploy pre-prod triggered by workflow_run: PASS — https://github.com/lircap/lircap-com/actions/runs/28322295079

Deploy job evidence:

• Checkout trusted main commit: PASS
• Verify/build: PASS
• Tailscale join: PASS
• SSH deploy/release activation: PASS
• Password-gate and route smoke checks: PASS

External parent smoke after workflow completion:

• Unauthenticated /: 401 with WWW-Authenticate: Basic
• Authenticated /: home marker present
• Authenticated /team/: team marker present
• Authenticated /contact/: contact marker present
• Authenticated /robots.txt: sitemap reference present
• Authenticated /sitemap.xml: team canonical route present
• Active release symlink: /opt/lircap-preprod/releases/20260628T123122Z-28322295079-1-1360f0cb1edd

Environment setup completed:

• preprod Environment exists.
• Deployment branch policy restricted to main.
• Required secrets/vars configured without printing values.