chore: align deployment pipeline with klz-2026 standards

- Add branch deployment support

- Switch build platform to linux/amd64

- Extract checks to turbo pipeline

- Add pre/post-deploy scripts & cms-sync

.gitea/workflows/deploy.yml

@@ -3,7 +3,7 @@ name: Build & Deploy
 on:
   push:
     branches:
-      - main
+      - "**"
     tags:
       - "v*"
   workflow_dispatch:
@@ -76,7 +76,11 @@ jobs:
               TRAEFIK_HOST="staging.${DOMAIN}"
             fi
           else
-            TARGET="skip"
+            TARGET="branch"
+            SLUG=$(echo "$REF" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//')
+            IMAGE_TAG="branch-${SLUG}-${SHORT_SHA}"
+            ENV_FILE=".env.branch-${SLUG}"
+            TRAEFIK_HOST="${SLUG}.branch.${DOMAIN}"
           fi
 
           if [[ "$TARGET" != "skip" ]]; then
@@ -97,20 +101,22 @@ jobs:
               echo "traefik_rule=$TRAEFIK_RULE"
               echo "next_public_url=https://$PRIMARY_HOST"
               echo "directus_url=https://cms.$PRIMARY_HOST"
-              echo "project_name=$PRJ-$TARGET"
+              if [[ "$TARGET" == "branch" ]]; then
+                echo "project_name=$PRJ-branch-$SLUG"
+              else
+                echo "project_name=$PRJ-$TARGET"
+              fi
               echo "short_sha=$SHORT_SHA"
             } >> "$GITHUB_OUTPUT"
 
             # ⏳ Wait for Upstream Packages/Images if Tagged
             if [[ "${{ github.ref_type }}" == "tag" ]]; then
               echo "🔎 Checking for @mintel dependencies in package.json..."
-              # Extract any @mintel/ version (they should be synced in monorepo)
               UPSTREAM_VERSION=$(grep -o '"@mintel/.*": "[^"]*"' package.json | head -1 | cut -d'"' -f4 | sed 's/\^//; s/\~//')
               TAG_TO_WAIT="v$UPSTREAM_VERSION"
               
               if [[ -n "$UPSTREAM_VERSION" && "$UPSTREAM_VERSION" != "workspace:"* ]]; then
                 echo "⏳ This release depends on @mintel v$UPSTREAM_VERSION. Waiting for upstream build..."
-                # Fetch script from monorepo (main)
                 curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
                   "https://git.infra.mintel.me/mmintel/at-mintel/raw/branch/main/packages/infra/scripts/wait-for-upstream.sh" > wait-for-upstream.sh
                 chmod +x wait-for-upstream.sh
@@ -123,7 +129,7 @@ jobs:
           fi
 
   # ──────────────────────────────────────────────────────────────────────────────
-  # JOB 2: QA (Lint, Build Test)
+  # JOB 2: QA (Lint, Typecheck, Test)
   # ──────────────────────────────────────────────────────────────────────────────
   qa:
     name: 🧪 QA
@@ -151,10 +157,7 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: 🧪 QA Checks
         if: github.event.inputs.skip_checks != 'true'
-        run: |
-          pnpm lint
-          pnpm --filter "@mintel/web" exec tsc --noEmit
-          pnpm --filter "@mintel/web" test
+        run: npx turbo run lint typecheck test
       - name: 🏗️ Build Test
         if: github.event.inputs.skip_checks != 'true'
         run: pnpm build
@@ -164,7 +167,7 @@ jobs:
   # ──────────────────────────────────────────────────────────────────────────────
   build:
     name: 🏗️ Build
-    needs: prepare
+    needs: [prepare, qa]
     if: needs.prepare.outputs.target != 'skip'
     runs-on: docker
     container:
@@ -181,7 +184,7 @@ jobs:
         with:
           context: .
           push: true
-          platforms: linux/arm64
+          platforms: linux/amd64
           build-args: |
             NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_url }}
             NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
@@ -217,7 +220,7 @@ jobs:
       DATABASE_URI: postgres://${{ env.postgres_DB_USER }}:${{ env.postgres_DB_PASSWORD }}@postgres-db:5432/${{ env.postgres_DB_NAME }}
       PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET || vars.PAYLOAD_SECRET || 'secret' }}
 
-      # Secrets mapping (Mail)
+      # Mail
       MAIL_HOST: ${{ secrets.SMTP_HOST || vars.SMTP_HOST }}
       MAIL_PORT: ${{ secrets.SMTP_PORT || vars.SMTP_PORT || '587' }}
       MAIL_USERNAME: ${{ secrets.SMTP_USER || vars.SMTP_USER }}
@@ -254,7 +257,6 @@ jobs:
           GATEKEEPER_HOST: gatekeeper.${{ needs.prepare.outputs.traefik_host }}
           ENV_FILE: ${{ needs.prepare.outputs.env_file }}
         run: |
-          # Middleware & Auth Logic
           LOG_LEVEL=$( [[ "$TARGET" == "testing" || "$TARGET" == "development" ]] && echo "debug" || echo "info" )
           STD_MW="${PROJECT_NAME}-forward,compress"
 
@@ -262,15 +264,12 @@ jobs:
             AUTH_MIDDLEWARE="$STD_MW"
             COMPOSE_PROFILES=""
           else
-            # Order: Forward (Proto) -> Auth -> Compression
             AUTH_MIDDLEWARE="${PROJECT_NAME}-forward,${PROJECT_NAME}-auth,compress"
             COMPOSE_PROFILES="gatekeeper"
           fi
 
-          # Gatekeeper Origin
           GATEKEEPER_ORIGIN="$NEXT_PUBLIC_BASE_URL/gatekeeper"
 
-          # Generate Environment File
           cat > .env.deploy << EOF
           # Generated by CI - $TARGET
           IMAGE_TAG=$IMAGE_TAG
@@ -279,40 +278,29 @@ jobs:
           SENTRY_DSN=$SENTRY_DSN
           PROJECT_COLOR=$PROJECT_COLOR
           LOG_LEVEL=$LOG_LEVEL
-
-          # Payload DB
           postgres_DB_NAME=$postgres_DB_NAME
           postgres_DB_USER=$postgres_DB_USER
           postgres_DB_PASSWORD=$postgres_DB_PASSWORD
           DATABASE_URI=$DATABASE_URI
           PAYLOAD_SECRET=$PAYLOAD_SECRET
-
-          # Mail
           MAIL_HOST=$MAIL_HOST
           MAIL_PORT=$MAIL_PORT
           MAIL_USERNAME=$MAIL_USERNAME
           MAIL_PASSWORD=$MAIL_PASSWORD
           MAIL_FROM=$MAIL_FROM
           MAIL_RECIPIENTS=$MAIL_RECIPIENTS
-
-          # Authentication
           GATEKEEPER_PASSWORD=$GATEKEEPER_PASSWORD
           AUTH_COOKIE_NAME=$AUTH_COOKIE_NAME
           COOKIE_DOMAIN=$COOKIE_DOMAIN
-
-          # Analytics
           UMAMI_WEBSITE_ID=$UMAMI_WEBSITE_ID
           NEXT_PUBLIC_UMAMI_WEBSITE_ID=$UMAMI_WEBSITE_ID
           UMAMI_API_ENDPOINT=$UMAMI_API_ENDPOINT
-
-          # S3 Object Storage
           S3_ENDPOINT=$S3_ENDPOINT
           S3_ACCESS_KEY=$S3_ACCESS_KEY
           S3_SECRET_KEY=$S3_SECRET_KEY
           S3_BUCKET=$S3_BUCKET
           S3_REGION=$S3_REGION
           S3_PREFIX=$S3_PREFIX
-
           TARGET=$TARGET
           SENTRY_ENVIRONMENT=$TARGET
           PROJECT_NAME=$PROJECT_NAME
@@ -333,10 +321,17 @@ jobs:
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H alpha.mintel.me >> ~/.ssh/known_hosts 2>/dev/null
 
-          # Transfer and Restart
-          SITE_DIR="/home/deploy/sites/mintel.me"
-          ssh root@alpha.mintel.me "mkdir -p $SITE_DIR/directus/schema $SITE_DIR/directus/uploads $SITE_DIR/directus/extensions"
+          if [[ "$TARGET" == "production" ]]; then
+            SITE_DIR="/home/deploy/sites/mintel.me"
+          elif [[ "$TARGET" == "testing" ]]; then
+            SITE_DIR="/home/deploy/sites/testing.mintel.me"
+          elif [[ "$TARGET" == "staging" ]]; then
+            SITE_DIR="/home/deploy/sites/staging.mintel.me"
+          else
+            SITE_DIR="/home/deploy/sites/branch.mintel.me/${SLUG:-unknown}"
+          fi
 
+          ssh root@alpha.mintel.me "mkdir -p $SITE_DIR/directus/schema $SITE_DIR/directus/uploads $SITE_DIR/directus/extensions"
           scp .env.deploy root@alpha.mintel.me:$SITE_DIR/$ENV_FILE
           scp docker-compose.yml root@alpha.mintel.me:$SITE_DIR/docker-compose.yml
 
@@ -344,7 +339,10 @@ jobs:
           ssh root@alpha.mintel.me "cd $SITE_DIR && docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' pull"
           ssh root@alpha.mintel.me "cd $SITE_DIR && docker compose -p '${{ needs.prepare.outputs.project_name }}' --env-file '$ENV_FILE' up -d --remove-orphans"
 
-
+          # Migration Sanitization
+          DB_CONTAINER="${{ needs.prepare.outputs.project_name }}-postgres-db-1"
+          echo "🔧 Sanitizing payload_migrations table..."
+          ssh root@alpha.mintel.me "docker exec $DB_CONTAINER psql -U $postgres_DB_USER -d $postgres_DB_NAME -c \"DELETE FROM payload_migrations WHERE batch = -1;\" 2>/dev/null || true"
 
           ssh root@alpha.mintel.me "docker system prune -f --filter 'until=24h'"
 
@@ -353,37 +351,42 @@ jobs:
         run: docker builder prune -f --filter "until=1h"
 
   # ──────────────────────────────────────────────────────────────────────────────
-  # JOB 5: Health Check
+  # JOB 5: Post-Deploy Verification
   # ──────────────────────────────────────────────────────────────────────────────
-  healthcheck:
-    name: 🩺 Health Check
+  post_deploy_checks:
+    name: 🧪 Post-Deploy Verification
     needs: [prepare, deploy]
     if: needs.deploy.result == 'success'
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
     steps:
-      - name: 🔍 Smoke Test
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: 🏥 CMS Deep Health Check
+        env:
+          DEPLOY_URL: ${{ needs.prepare.outputs.next_public_url }}
         run: |
-          URL="${{ needs.prepare.outputs.next_public_url }}"
-          echo "Checking health of $URL..."
-          for i in {1..12}; do
-            if curl -s -f "$URL" > /dev/null; then
-              echo "✅ Health check passed!"
-              exit 0
-            fi
-            echo "Waiting for service to be ready... ($i/12)"
-            sleep 10
-          done
-          echo "❌ Health check failed after 2 minutes."
-          exit 1
+          echo "Waiting for app to start..."
+          sleep 10
+          curl -sf "$DEPLOY_URL/api/health/cms" || { echo "❌ CMS health check failed"; exit 1; }
+          echo "✅ CMS health OK"
+      - name: 🚀 OG Image Check
+        env:
+          TEST_URL: ${{ needs.prepare.outputs.next_public_url }}
+        run: npx tsx apps/web/scripts/check-og-images.ts
+      - name: 📝 E2E Smoke Test
+        env:
+          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
+          GATEKEEPER_PASSWORD: ${{ env.GATEKEEPER_PASSWORD }}
+        run: npx tsx apps/web/scripts/check-forms.ts
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 6: Notifications
   # ──────────────────────────────────────────────────────────────────────────────
   notifications:
     name: 🔔 Notify
-    needs: [prepare, deploy, healthcheck]
+    needs: [prepare, deploy, post_deploy_checks]
     if: always()
     runs-on: docker
     container:
@@ -391,11 +394,20 @@ jobs:
     steps:
       - name: 🔔 Gotify
         run: |
-          STATUS="${{ needs.deploy.result }}"
-          TITLE="mintel.me: $STATUS"
-          [[ "$STATUS" == "success" ]] && PRIORITY=5 || PRIORITY=8
+          DEPLOY="${{ needs.deploy.result }}"
+          SMOKE="${{ needs.post_deploy_checks.result }}"
+          TARGET="${{ needs.prepare.outputs.target }}"
+          VERSION="${{ needs.prepare.outputs.image_tag }}"
+
+          if [[ "$DEPLOY" == "success" && "$SMOKE" == "success" ]]; then
+            PRIORITY=5
+            EMOJI="✅"
+          else
+            PRIORITY=8
+            EMOJI="🚨"
+          fi
 
           curl -s -k -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
-            -F "title=$TITLE" \
-            -F "message=Deploy to ${{ needs.prepare.outputs.target }} finished with status $STATUS.\nVersion: ${{ needs.prepare.outputs.image_tag }}" \
+            -F "title=$EMOJI mintel.me $VERSION -> $TARGET" \
+            -F "message=Deploy: $DEPLOY | Smoke: $SMOKE" \
             -F "priority=$PRIORITY" || true