feat: add manual production deployment pipeline

.gitea/workflows/deploy-production.yml

@@ -0,0 +1,71 @@
+name: Deploy EG-BIM QA Production
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: qa-production
+  cancel-in-progress: false
+
+jobs:
+  deploy-production:
+    runs-on: ubuntu-latest
+    env:
+      DEPLOY_REF: ${{ gitea.ref }}
+      DEPLOY_COMMIT_SHA: ${{ gitea.sha }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.PROD_CLOUDFLARE_API_TOKEN }}
+      SESSION_SECRET: ${{ secrets.PROD_SESSION_SECRET }}
+      ABC_API_KEY: ${{ secrets.PROD_ABC_API_KEY }}
+      AUTH_CLIENT_ID: ${{ vars.PROD_AUTH_CLIENT_ID }}
+      ABC_API_BASE_URL: ${{ vars.PROD_ABC_API_BASE_URL }}
+      ABC_PROJECT_ID: ${{ vars.PROD_ABC_PROJECT_ID }}
+      ABC_CHANNEL_ID: ${{ vars.PROD_ABC_CHANNEL_ID }}
+      ORG_CONTEXT_ENABLED: ${{ vars.PROD_ORG_CONTEXT_ENABLED }}
+      ORG_CONTEXT_API_URL: ${{ vars.PROD_ORG_CONTEXT_API_URL }}
+      ORG_CONTEXT_SCOPE_MODE: ${{ vars.PROD_ORG_CONTEXT_SCOPE_MODE }}
+      ORG_CONTEXT_EXPOSURE: ${{ vars.PROD_ORG_CONTEXT_EXPOSURE }}
+      ORG_CONTEXT_TENANT_IDS: ${{ vars.PROD_ORG_CONTEXT_TENANT_IDS }}
+      ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.PROD_ORG_CONTEXT_CACHE_TTL_SECONDS }}
+      ORG_CONTEXT_KEY_ID: ${{ secrets.PROD_ORG_CONTEXT_KEY_ID }}
+      ORG_CONTEXT_KEY_SECRET: ${{ secrets.PROD_ORG_CONTEXT_KEY_SECRET }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Require main and the selected commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$DEPLOY_REF" = "refs/heads/main" || { echo "Production must be deployed from main"; exit 1; }
+          test "$(git rev-parse HEAD)" = "$DEPLOY_COMMIT_SHA" || { echo "Checkout does not match the selected commit"; exit 1; }
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Validate production settings
+        run: node scripts/deploy-production.mjs --validate-only
+
+      - name: Install dependencies
+        run: npm ci --no-fund --no-audit
+
+      - name: Check source and tests
+        run: npm run check && npm test
+
+      - name: Verify production organization API
+        run: npm run org:verify
+
+      - name: Build production Worker without deploying
+        run: npm run deploy:production -- --dry-run
+
+      - name: Upload this commit's static files
+        shell: bash
+        run: bash scripts/upload-r2.sh baron-qa-write wrangler.production.toml "releases/$DEPLOY_COMMIT_SHA"
+
+      - name: Deploy production Worker and secrets
+        run: npm run deploy:production
+
+      - name: Verify production HTTP endpoints
+        run: npm run production:verify