Deploy auf live: docs.tibicms.de per Repo-Token-Rsync

- Workflow auf master-only reduziert: build + rsync ./dist/ (kein Registry/Staging)
- rsync-Ziel ueber RSYNC_PATH=docs.tibicms.de (Docroot ab htdocs), User Repo+Subdomain-ID
- sshpass -e statt Passwort im Kommando
- astro site-URL auf https://docs.tibicms.de umgestellt (Sitemap/Canonical)
- docker-compose-staging.yml entfernt (Staging raus)

.gitea/workflows/deploy.yml

@@ -1,9 +1,14 @@
 name: Deploy tibi-docs
 
+# Statischer Starlight-Build, Auslieferung als Dateien über Apache.
+# Push auf master -> Build -> rsync nach htdocs/<RSYNC_PATH>/ auf ftp1.webmakers.de.
+# Auth: Repo-Token (github.token) + Basispanel-Subdomain docs.tibicms.de (ID 2216,
+# gitbaseRepository=cms/tibi-docs). Der rsync-User landet in htdocs des Kunden;
+# weiter runter kommt man nicht, deshalb ist RSYNC_PATH der Docroot-Pfad ab htdocs.
+
 on:
     push:
         branches:
-            - dev
             - master
 
 jobs:
@@ -12,78 +17,59 @@ jobs:
         runs-on: ubuntu-latest
         container:
             image: gitbase.de/actions/ubuntu:latest
-            volumes:
-                - /data:/data
         env:
             FORCE_COLOR: "true"
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
               with:
                   fetch-depth: 1
                   lfs: true
                   submodules: false
 
             - name: setup-node
-              uses: actions/setup-node@v3
+              uses: actions/setup-node@v4
               with:
                   node-version: 22
+                  cache: npm
 
             - name: install-dependencies
-              run: npm install
+              run: npm ci
 
             - name: build-static
               run: npm run build
 
-            - name: build-and-push-image
-              if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev'
-              env:
-                  REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
+            - name: check-static-build
               run: |
                   set -eu
-                  image="gitbase.de/${{ github.repository }}"
-
-                  if [ "${{ github.ref_name }}" = "dev" ]; then
-                      image="${image}:dev"
-                  fi
-
-                  echo "${REGISTRY_PASS}" | docker login gitbase.de -u tibibot --password-stdin
-                  docker build -t "$image" . --pull
-                  docker push "$image"
-
-            - name: deploy-staging
-              if: github.ref == 'refs/heads/dev'
-              env:
-                  COMPOSE_PROJECT_NAME: ${{ github.repository }}-${{ github.ref_name }}
-              run: |
-                  set -eu
-                  set -o allexport
-                  . ./.env
-                  set +o allexport
-
-                  COMPOSE_PROJECT_NAME=$(echo "$COMPOSE_PROJECT_NAME" | sed 's+/+-+g')
-
-                  docker compose -f docker-compose-staging.yml -p $COMPOSE_PROJECT_NAME up -d --build --remove-orphans
+                  test -f dist/index.html
+                  test -f dist/404.html
+                  test -d dist/pagefind
 
+            # .env ist gitignored -> Zielwerte stehen hier direkt (keine Secrets).
+            # RSYNC_USER = Repo + Basispanel-Subdomain-ID, RSYNC_PATH = Docroot ab htdocs.
             - name: deploy-live
-              if: github.ref == 'refs/heads/master'
               env:
-                  RSYNC_USER: ${{ github.repository }}
+                  RSYNC_USER: ${{ github.repository }},2216
                   RSYNC_PASS: ${{ github.token }}
+                  RSYNC_HOST: ftp1.webmakers.de
+                  RSYNC_PORT: "22223"
+                  RSYNC_PATH: docs.tibicms.de
               run: |
                   set -eu
-                  set -o allexport
-                  . ./.env
-                  set +o allexport
 
                   : "${RSYNC_USER:?RSYNC_USER missing}"
                   : "${RSYNC_PASS:?RSYNC_PASS missing}"
                   : "${RSYNC_HOST:?RSYNC_HOST missing}"
                   : "${RSYNC_PORT:?RSYNC_PORT missing}"
+                  : "${RSYNC_PATH:?RSYNC_PATH missing}"
 
-                  SSH_CMD="sshpass -p ${RSYNC_PASS} ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p ${RSYNC_PORT} -l ${RSYNC_USER}"
+                  echo "Deploying to ${RSYNC_HOST}:${RSYNC_PATH} on port ${RSYNC_PORT} as ${RSYNC_USER}"
+
+                  export SSHPASS="${RSYNC_PASS}"
+                  SSH_CMD="sshpass -e ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p ${RSYNC_PORT} -l ${RSYNC_USER}"
 
                   rsync -rlcgD --perms -i -u -v --stats --progress \
                       --delete \
                       -e "${SSH_CMD}" \
                       --exclude=.git \
-                      ./dist/ ${RSYNC_USER}@${RSYNC_HOST}:htdocs/
+                      ./dist/ "${RSYNC_HOST}":"./${RSYNC_PATH}/"