Run the tests in CI before deploying, like BioSpex

.github/dependabot.yml

@@ -0,0 +1,37 @@
+# Weekly dependency update pull requests into development, grouped to keep them few.
+# Security updates are separate: Dependabot opens those against main as soon as an advisory appears.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: development
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+
+  - package-ecosystem: composer
+    directory: /
+    target-branch: development
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      composer-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /
+    target-branch: development
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      javascript-minor-and-patch:
+        update-types:
+          - minor
+          - patch

.github/known_hosts

@@ -0,0 +1,8 @@
+# SSH host keys for the deploy servers (production 3.142.169.134, development 3.138.217.206).
+# Regenerate with: ssh-keyscan -t ed25519,ecdsa,rsa <ip>, and check the fingerprints first.
+3.138.217.206 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEJl6SHNoIy2OY2LOcELcUdPaNPbB/bmgQ7IbjRIO1L60NAf3hdvFY/FAfSsOpSB+z8nrdW6nwwWFzuFXcTH1Z4=
+3.138.217.206 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPiwbRfFX9y1YWZnShLEdUj2ITY2F84XqOEVGTldAUNT
+3.138.217.206 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/6L95wPTNeegZmuwHg+494aIJqv7rMKpMVWMNJATel9+if0Jn3VMxCQHDeadTKAsIs6d6J3dGnixBGBWJHN0oWkgIc4vHhemt0ROGX1kMtkeyyQfowNb6JcKemrMItsQGK4PgtSTVghr5emFDex9T1cYN8+T1yDy9zM2h2vyldq3tI8GbFzdvP47VeqcsELTKmaRNttTTNFlZeo/MQfL20MkM69ggZVmreEHjcYLbqsKpqZqttynHIbLATJeYwCyY+dr20fpOcNq7FE4ctsOtfFjyVt/vczZw+W7Bg7Z5AHyyAI6oIYqrBO1R3+A9q9dS+L6SVyuOBr2MgHjk4VL9bTbjCNMTbIGpg2frR3z/oQ73eC3HIAfeRrWuyvEg5E+kRjumJbNQXmtVGp1Lxqxd3oD/3dgv3oRsqdnXrCUmnU5mfAo0iIN0yZYG4A4COHSnZIMFMtCq8KOd42QUK/GmwrvSzVmb5jZJJBPeMiJM4HRsPjfknZdBDmhgplzk/5s=
+3.142.169.134 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEGPgYtcd5CBDJncrj/7KWrWPC91kZLz5SqgTQ8zjrcMrNrnmPrzwWt8OAwxcpb77AJ7feu1OH6/udSqDi+/bS0=
+3.142.169.134 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPli28DWaiaDUrAf/gIfi9HSC10/CZl7C2e0EsgOuqsh
+3.142.169.134 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCZrRSWwNrkHZSJw1ssb/RfYP79CdF5qQUPZZiGD3FchlxK9wzwPgkJVoDYwVchlQZLPyhBAw/UGIa6O14xslevl1sdoKSIly2tQX024pzUnK7rndm9/2qtcBwLB5mtJeGThQbyDS5jp6stLHMho3vUGoKc5TyLJyBwUZD0/M5w8+cejNr7qyFltaOv6tgT2w3sqO0K4WMA9qoAh7wEe5Ye4x8qd8dWpu/8qL1VY2ukrJa/wXIA7LE5cpdiXA1hawYmqki4OuyNJTdkgLd9oyXaN4XEkL+hLIaQjrlVvpTBkW5zmGtuUupEVdrVkrd70vRr9iuJg5Mtq2glq31gpgb2WIXbnIFtgiAG+6KCbfLMMg8hQC2EnucAf5k4Vq9H3DUu1ByHIxqPAnIHNkjvS6YHg9Xnp6nZKAoiGNi1UZNX30gvIj2rS3zt/vFJUdvORXSVR+eW096EgK0aXRfbe5eVLscc7ZI5IxgxMTULosnPInwalPlszOgnxoryMh1ZOx8=

.github/workflows/deploy-environment.yml

@@ -0,0 +1,141 @@
+# Build and deploy one environment
+#
+# Called by deploy.yml for production and development. It builds the assets,
+# uploads the deployment package as an artifact, and runs Deployer, which
+# downloads that artifact on the server (deploy:ci-artifacts).
+
+name: Deploy environment
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        description: 'GitHub environment and Deployer host: production or development'
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Get Runner IP
+        id: ip
+        run: echo "ipv4=$(curl -s https://checkip.amazonaws.com)" >> "$GITHUB_OUTPUT"
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::147899039648:role/GitHubActionsDeployRole
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Whitelist Runner IP in AWS Security Group
+        run: |
+          aws ec2 authorize-security-group-ingress \
+            --region ${{ secrets.AWS_REGION }} \
+            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
+            --protocol tcp \
+            --port 22 \
+            --cidr ${{ steps.ip.outputs.ipv4 }}/32
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.5'
+          extensions: mbstring, xml, bcmath, ctype, json, tokenizer, pdo, pdo_mysql
+          coverage: none
+
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Composer downloads
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-composer-
+
+      - name: Create storage directories
+        run: |
+          mkdir -p storage/framework/cache/data
+          mkdir -p storage/framework/sessions
+          mkdir -p storage/framework/views
+          mkdir -p bootstrap/cache
+
+      - name: Install Composer dependencies for deployment runner
+        run: composer install --prefer-dist --no-progress --no-interaction --optimize-autoloader --no-scripts
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: 'yarn'
+
+      - name: Install Yarn dependencies
+        run: yarn install --frozen-lockfile --ignore-engines
+
+      - name: Build assets
+        run: npm run production
+
+      - name: Create deployment package
+        run: |
+          rm -rf deployment-package || true
+          TEMP_DIR=$(mktemp -d)
+          rsync -av \
+            --exclude=node_modules \
+            --exclude=.git \
+            --exclude=.github \
+            --exclude=tests \
+            --exclude=storage/logs \
+            --exclude=vendor \
+            . "$TEMP_DIR/"
+          cp -r public/css public/js public/fonts public/images public/svg public/mix-manifest.json "$TEMP_DIR/public/" || true
+          mv "$TEMP_DIR" deployment-package
+
+      - name: Upload deployment artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: digitizationacademy-${{ github.sha }}
+          path: deployment-package/
+          retention-days: 30
+
+      - name: Setup SSH key
+        uses: webfactory/ssh-agent@v0.10.0
+        with:
+          ssh-private-key: ${{ secrets.DEPLOY_PRIVATE_KEY }}
+
+      - name: Trust the deploy servers' SSH host keys
+        run: |
+          mkdir -p ~/.ssh
+          cat .github/known_hosts >> ~/.ssh/known_hosts  # append; ssh-agent may already have added entries
+          cat > ~/.ssh/config <<'EOF'
+          Host *
+            StrictHostKeyChecking yes
+          EOF
+          chmod 700 ~/.ssh
+          chmod 600 ~/.ssh/config ~/.ssh/known_hosts
+
+      - name: Deploy with Deployer
+        run: vendor/bin/dep deploy ${{ inputs.environment }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_REPO: ${{ github.repository }}
+
+      - name: Revoke Runner IP from AWS Security Group
+        if: always()
+        run: |
+          aws ec2 revoke-security-group-ingress \
+            --region ${{ secrets.AWS_REGION }} \
+            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
+            --protocol tcp \
+            --port 22 \
+            --cidr ${{ steps.ip.outputs.ipv4 }}/32