ci: gate Coolify deploys on verified revisions

.github/workflows/deploy.yml

@@ -5,37 +5,94 @@ on:
     workflows: ["CI"]
     types: [completed]
     branches: [main]
-  workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
   group: deploy-coolify
-  cancel-in-progress: true
+  cancel-in-progress: false
+
+env:
+  NODE_VERSION: 22.19.0
+  PNPM_VERSION: 9.15.9
 
 jobs:
   deploy:
-    name: Trigger Coolify webhook
+    name: Exact SHA · Coolify · Production smoke
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      (github.event.workflow_run.event == 'push' ||
+       github.event.workflow_run.event == 'workflow_dispatch')
     runs-on: ubuntu-latest
-    # Only deploy when CI finished successfully (or on manual dispatch).
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    timeout-minutes: 40
 
     steps:
-      - name: Trigger Coolify deploy
+      - name: Checkout verified CI revision
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          persist-credentials: false
+
+      - name: Validate cutover interlock
         env:
-          COOLIFY_WEBHOOK_URL: ${{ secrets.COOLIFY_WEBHOOK_URL }}
-          COOLIFY_WEBHOOK_TOKEN: ${{ secrets.COOLIFY_WEBHOOK_TOKEN }}
+          COOLIFY_CD_ENABLED: ${{ vars.COOLIFY_CD_ENABLED }}
         run: |
-          if [ -z "$COOLIFY_WEBHOOK_URL" ]; then
-            echo "COOLIFY_WEBHOOK_URL secret is not set — skipping deploy."
-            exit 0
-          fi
-          if [ -n "$COOLIFY_WEBHOOK_TOKEN" ]; then
-            curl --fail --silent --show-error \
-              -X POST "$COOLIFY_WEBHOOK_URL" \
-              -H "Authorization: Bearer $COOLIFY_WEBHOOK_TOKEN"
-          else
-            curl --fail --silent --show-error -X POST "$COOLIFY_WEBHOOK_URL"
-          fi
-          echo "Coolify deploy triggered."
+          case "$COOLIFY_CD_ENABLED" in
+            true|false) ;;
+            *) echo "COOLIFY_CD_ENABLED must be exactly true or false" >&2; exit 1 ;;
+          esac
+
+      - name: Mint dedicated production-ref token
+        id: deploy-ref-token
+        if: vars.COOLIFY_CD_ENABLED == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.DEPLOY_REF_APP_ID }}
+          private-key: ${{ secrets.DEPLOY_REF_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: AgoraHub
+          permission-contents: write
+
+      - name: Setup pnpm
+        if: vars.COOLIFY_CD_ENABLED == 'true'
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+
+      - name: Setup Node
+        if: vars.COOLIFY_CD_ENABLED == 'true'
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install frozen dependencies
+        if: vars.COOLIFY_CD_ENABLED == 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: Deploy exact verified revision
+        if: vars.COOLIFY_CD_ENABLED == 'true'
+        id: deployment
+        env:
+          VERIFIED_SHA: ${{ github.event.workflow_run.head_sha }}
+          GITHUB_TOKEN: ${{ steps.deploy-ref-token.outputs.token }}
+          COOLIFY_CD_ENABLED: ${{ vars.COOLIFY_CD_ENABLED }}
+          COOLIFY_API_BASE_URL: ${{ vars.COOLIFY_API_BASE_URL }}
+          COOLIFY_WEBHOOK_URL: ${{ vars.COOLIFY_WEBHOOK_URL }}
+          COOLIFY_APP_UUID: ${{ vars.COOLIFY_APP_UUID }}
+          COOLIFY_DEPLOY_BRANCH: ${{ vars.COOLIFY_DEPLOY_BRANCH }}
+          COOLIFY_READ_TOKEN: ${{ secrets.COOLIFY_READ_TOKEN }}
+          COOLIFY_WEBHOOK_SECRET: ${{ secrets.COOLIFY_WEBHOOK_SECRET }}
+          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID }}
+          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}
+        run: pnpm exec tsx scripts/deploy-coolify.ts
+
+      - name: Verify deployed production protocols
+        if: steps.deployment.outputs.deployed == 'true'
+        env:
+          BASE_URL: https://agorahub.dev
+        run: pnpm release:smoke