Toolify post-merge: safe embeds, share UX and manual-only Actions for all workflows (DRAFT)

.github/workflows/ci.yml

@@ -1,10 +1,8 @@
 name: CI
 
+# CI remains available for future explicit owner action, not automated PR/push runs.
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_dispatch: {}
 
 jobs:
   validate-and-build:

.github/workflows/deploy.yml

@@ -1,8 +1,8 @@
 name: Deploy to VPS
 
+# The owner performs production deployments manually. Keep the workflow available
+# for an explicit future decision, but never auto-deploy from a main push.
 on:
-  push:
-    branches: [main]
   workflow_dispatch: {}
 
 concurrency:

.github/workflows/toolify-live-index.yml

@@ -1,16 +1,7 @@
 name: Toolify live indexability recovery (12 URLs)
+# Keep recovery inspection opt-in while GitHub Actions are unavailable.
 on:
-  pull_request:
-    paths:
-      - 'scripts/toolify-live-index-gate.mjs'
-      - 'scripts/tests/toolify-live-index-gate.test.mjs'
-      - '.github/workflows/toolify-live-index.yml'
-  push:
-    branches: [main]
-    paths:
-      - 'scripts/toolify-live-index-gate.mjs'
-      - '.github/workflows/toolify-live-index.yml'
-  workflow_dispatch:
+  workflow_dispatch: {}
 jobs:
   source:
     runs-on: ubuntu-latest

ops/deploy-lock.sh

@@ -17,31 +17,42 @@
 set -u
 cmd=${1:-}; L=${2:-}; me=${3:-}; stale=${4:-3600}
 [[ -n $cmd && -n $L && -n $me ]] || { echo "usage: acquire|release <lockdir> <owner> [stale_sec]"; exit 2; }
+[[ $stale =~ ^[0-9]+$ ]] || { echo "stale_sec must be a non-negative integer" >&2; exit 2; }
 [[ $L == */.deploy.lock.d ]] && { echo "lockdir must be outside the deploy dir: $L"; exit 2; }
 now=$(date +%s)
 case $cmd in
   acquire)
     if mkdir "$L" 2>/dev/null; then
-      echo "$me $now" > "$L/owner"
+      if ! printf '%s %s\n' "$me" "$now" > "$L/owner"; then
+        rmdir "$L" 2>/dev/null || true
+        echo "Cannot write lock owner metadata: $L/owner" >&2
+        exit 1
+      fi
       echo "ACQUIRED $L by $me"
       exit 0
     fi
     o=$(cut -d' ' -f1 "$L/owner" 2>/dev/null || true)
-    t=$(stat -c %Y "$L/owner" 2>/dev/null || stat -c %Y "$L" 2>/dev/null || echo "$now")
+    t=$(stat -c %Y "$L/owner" 2>/dev/null || stat -f %m "$L/owner" 2>/dev/null || stat -c %Y "$L" 2>/dev/null || stat -f %m "$L" 2>/dev/null || echo "$now")
     age=$(( now - t ))
-    # A deploy that died without releasing must not block forever.
+    # Do not take over an old lock automatically. The previous code overwrote
+    # the owner file without any atomic claim; two waiters could both enter a
+    # live deployment (or steal a lock from a slow, still-running deploy).
+    # A stale lock requires verification that the prior deployment has stopped.
     if (( age > stale )); then
-      echo "$me $now" > "$L/owner"
-      echo "TAKEOVER stale lock of ${o:-unknown} (age ${age}s > ${stale}s) by $me"
-      exit 0
+      echo "STALE $L held by ${o:-unknown} for ${age}s; refusing unsafe automatic takeover. Verify the prior deploy is inactive before manually clearing the lock." >&2
+      exit 3
     fi
     echo "BUSY $L held by ${o:-unknown} for ${age}s"
     exit 3
     ;;
   release)
     o=$(cut -d' ' -f1 "$L/owner" 2>/dev/null || true)
     if [[ $o == "$me" ]]; then
-      rm -f "$L/owner" && rmdir "$L" && echo "RELEASED $L by $me"
+      if ! { rm -f "$L/owner" && rmdir "$L"; }; then
+        echo "Failed to release lock: $L" >&2
+        exit 1
+      fi
+      echo "RELEASED $L by $me"
     else
       echo "NOT OWNER (held by ${o:-nobody}); left as is"
     fi

ops/tests/deploy-lock.test.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Offline, non-production regression tests for the shared VPS deploy lock.
+# No remote SSH, GitHub Actions, application deployment or network access.
+set -Eeuo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HELPER="$ROOT/ops/deploy-lock.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+LOCK="$TMP/toolify.deploy.lock.d"
+OUT="$TMP/out"
+
+expect_rc() {
+  local expected="$1" rc
+  shift
+  if "$@" > "$OUT" 2>&1; then rc=0; else rc=$?; fi
+  if [[ "$rc" -ne "$expected" ]]; then
+    echo "FAIL: expected exit $expected, got $rc: $*" >&2
+    cat "$OUT" >&2
+    exit 1
+  fi
+}
+
+# An invalid request must never take a lock.
+expect_rc 2 bash "$HELPER" acquire "$LOCK"
+expect_rc 2 bash "$HELPER" acquire "$LOCK" bad not-a-number
+[[ ! -e "$LOCK" ]]
+
+# Owner exclusivity, wrong-owner release and proper cleanup.
+expect_rc 0 bash "$HELPER" acquire "$LOCK" deploy-A
+[[ "$(cut -d' ' -f1 "$LOCK/owner")" == "deploy-A" ]]
+expect_rc 3 bash "$HELPER" acquire "$LOCK" deploy-B
+expect_rc 0 bash "$HELPER" release "$LOCK" deploy-B
+[[ -d "$LOCK" && "$(cut -d' ' -f1 "$LOCK/owner")" == "deploy-A" ]]
+expect_rc 0 bash "$HELPER" release "$LOCK" deploy-A
+[[ ! -e "$LOCK" ]]
+
+# An old lock must not be stolen, even when its age exceeds the threshold.
+expect_rc 0 bash "$HELPER" acquire "$LOCK" deploy-old
+touch -t 202001010000.00 "$LOCK/owner"
+expect_rc 3 bash "$HELPER" acquire "$LOCK" deploy-new 1
+grep -q 'STALE' "$OUT"
+[[ "$(cut -d' ' -f1 "$LOCK/owner")" == "deploy-old" ]]
+expect_rc 0 bash "$HELPER" release "$LOCK" deploy-old
+
+# Concurrent invocations may admit exactly one owner.
+SUCCESS="$TMP/successes"
+: > "$SUCCESS"
+for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
+  (
+    if bash "$HELPER" acquire "$LOCK" "worker-$i" > /dev/null 2>&1; then
+      printf '%s\n' "$i" >> "$SUCCESS"
+    fi
+  ) &
+done
+wait
+[[ "$(wc -l < "$SUCCESS" | tr -d ' ')" == "1" ]] || {
+  echo "FAIL: simultaneous lock holders detected" >&2
+  cat "$SUCCESS" >&2
+  exit 1
+}
+winner="$(cut -d' ' -f1 "$LOCK/owner")"
+[[ "$winner" == worker-* ]]
+expect_rc 0 bash "$HELPER" release "$LOCK" "$winner"
+[[ ! -e "$LOCK" ]]
+
+echo "PASS: shared deploy lock ownership, stale refusal and 12-way concurrency"

scripts/check-postmerge-embed-release.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Release gate for post-merge PR #41. No GitHub Actions, merge or deploy.
+set -Eeuo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+EXPECTED_BRANCH="fix/toolify-postmerge-embed-safety-20261107"
+ACTUAL_BRANCH="$(git -C "$ROOT" branch --show-current)"
+if [[ "$ACTUAL_BRANCH" != "$EXPECTED_BRANCH" ]]; then
+  echo "[postmerge] ERROR: expected $EXPECTED_BRANCH, found ${ACTUAL_BRANCH:-detached}" >&2
+  exit 2
+fi
+# Fetch the remote-tracking ref we actually verify, instead of trusting an old local ref.
+git -C "$ROOT" fetch --no-tags origin main:refs/remotes/origin/main
+if ! git -C "$ROOT" merge-base --is-ancestor refs/remotes/origin/main HEAD; then
+  echo "[postmerge] ERROR: latest origin/main is not merged into this PR branch." >&2
+  exit 3
+fi
+# Check EVERY GitHub workflow for manual-only triggers using one fail-closed policy.
+# Do not execute GitHub Actions; inspect workflow YAML locally.
+node "$ROOT/scripts/verify-manual-deploy.mjs" "$ROOT/.github/workflows"
+node --test "$ROOT/scripts/verify-manual-deploy.test.mjs"
+# Exercise the shared VPS deploy lock safely against temporary local paths.
+bash "$ROOT/ops/tests/deploy-lock.test.sh"
+# The site config falls back to example.pages.dev when the public origin is unset.
+# Pin this production release gate to the canonical origin to prevent wrong
+# canonical, share and iframe URLs in an otherwise successful Next build.
+export NEXT_PUBLIC_SITE_URL="https://toolify365.com"
+cd "$ROOT/site"
+echo "[postmerge] production origin=$NEXT_PUBLIC_SITE_URL"
+echo "[postmerge] node=$(node --version) npm=$(npm --version)"
+NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
+if (( NODE_MAJOR < 22 )); then
+  echo "[postmerge] ERROR: Node >=22 required for dependency-free TypeScript regression." >&2
+  exit 2
+fi
+node --experimental-strip-types --test scripts/embed-html-node.test.mjs scripts/share-errors-node.test.mjs
+npm ci
+npm run test:smoke-html
+npm run test:integration
+npm run typecheck
+npm test
+npm run validate
+npm run audit:seo
+npm run audit:i18n
+npm run audit:index-policy -- --json
+npm run build
+echo "[postmerge] PASS: static tests and build; browser, consent and deploy checks remain manual."

scripts/verify-manual-deploy.mjs

@@ -0,0 +1,82 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * Fail closed on any non-manual GitHub Actions trigger.
+ * Intentionally accepts only the repository's simple YAML representation:
+ *
+ * on:
+ *   workflow_dispatch: {}
+ *
+ * We avoid regex-only push detection: on: [push] and on: push also deploy.
+ * Any unrecognized event syntax must be reviewed before a release.
+ */
+export function verifyManualDeployWorkflow(source) {
+  const lines = source.replace(/\r\n/g, "\n").split("\n");
+  let blocks = 0;
+  let manual = 0;
+  let inEvents = false;
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+
+    const root = line.match(/^(on|'on'|"on")\s*:(.*)$/);
+    if (root) {
+      blocks += 1;
+      if (root[1] !== "on" || root[2].trim()) {
+        throw new Error("Only a plain multiline on: event block is allowed");
+      }
+      inEvents = true;
+      continue;
+    }
+    if (/^\S/.test(line)) {
+      inEvents = false;
+      continue;
+    }
+    if (inEvents) {
+      if (/^  workflow_dispatch: \{\}(?:\s*#.*)?$/.test(line)) {
+        manual += 1;
+      } else {
+        throw new Error(`Unexpected workflow trigger at line ${index + 1}: ${line.trim()}`);
+      }
+    }
+  }
+  if (blocks !== 1 || manual !== 1) {
+    throw new Error("Workflow must have exactly one manual-only on: block");
+  }
+  return true;
+}
+
+/** Validate every workflow in a directory; a single safe deploy.yml is not sufficient. */
+export function verifyWorkflowPath(path) {
+  const files = statSync(path).isDirectory()
+    ? readdirSync(path).filter((entry) => /\.ya?ml$/i.test(entry)).sort().map((entry) => join(path, entry))
+    : [path];
+  if (files.length === 0) throw new Error("No YAML workflows were found");
+  for (const file of files) {
+    try {
+      verifyManualDeployWorkflow(readFileSync(file, "utf8"));
+    } catch (error) {
+      throw new Error(`${file}: ${error.message}`);
+    }
+  }
+  return files.length;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const file = process.argv[2];
+  if (!file) {
+    process.stderr.write("Usage: node verify-manual-deploy.mjs <workflow.yml>\n");
+    process.exitCode = 2;
+  } else {
+    try {
+      const count = verifyWorkflowPath(file);
+      process.stdout.write(`[postmerge] PASS: ${count} manual-only GitHub workflow trigger(s)\n`);
+    } catch (error) {
+      process.stderr.write(`[postmerge] ERROR: ${error.message}\n`);
+      process.exitCode = 4;
+    }
+  }
+}