ci: QA suite (repo+live), Gitea Actions workflow, app config-as-code

- qa/site-qa.sh: repo structure/link checks + full live crawl (routes,
  links, assets, canonical-https)
- .gitea/workflows/qa.yml: repo QA on push, nightly live QA
- app/: config-as-code for the deployed sync job, scheduler entry,
  and Grav system.yaml (reverse-proxy HTTPS detection)
- local pre-push hook runs repo QA

https://projects.knownelement.com/issues/928

.gitea/workflows/qa.yml

@@ -0,0 +1,24 @@
+name: QA
+on:
+  push:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 9 * * *'   # 09:00 UTC nightly live QA
+
+jobs:
+  repo-qa:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Repo checks (structure, frontmatter, link targets)
+        run: ./qa/site-qa.sh
+
+  live-qa:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Live checks (Rogue site routes, links, canonical)
+        run: ./qa/site-qa.sh -l https://roguetechnologies.net

README.md

@@ -7,3 +7,19 @@ found fully compromised (see Discourse topic 345).
 
 Commits from the site (Git Sync) are authored by **VpEngOps**.
 Related: https://projects.knownelement.com/issues/928
+
+## QA / CI / deployment process
+
+- `qa/site-qa.sh` — repo checks (structure, frontmatter, internal link targets).
+  Run before every push; also enforced by the local pre-push hook.
+- `.gitea/workflows/qa.yml` — Gitea Actions: repo QA on every push, nightly
+  live QA (full route crawl + link/asset check + HTTPS-canonical check).
+- Deployment: the site container runs `app/git-sync-job.sh` (config-as-code
+  copy here) every 15 minutes via the Grav scheduler
+  (`app/scheduler/git-sync.job.yaml`): pulls upstream, clears the Grav cache,
+  verifies `/` and `/shop` answer 200 — **rolls back to the previous commit
+  automatically if verification fails** — and pushes local content edits
+  (authored VpEngOps).
+- Site management: edit here (gitea web UI works fine) and the site follows
+  within 15 minutes. There is no /admin UI: Grav 2 ships without one and this
+  deployment is git-first by design.

app/git-sync-job.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# git-sync-job.sh v2 - deploy upstream, verify, roll back on failure.
+# Pull: if upstream moved -> deploy + clearcache + verify key routes; rollback on failure.
+# Push: if local pages edits exist -> commit + push (VpEngOps identity).
+cd /app/data/user || exit 1
+GIT=/usr/bin/git
+BASE="https://${CLOUDRON_APP_DOMAIN}"
+PORT="${CLOUDRON_APP_PORT:-80}"
+verify() { # returns 0 if key routes answer 200
+  sleep 2
+  for r in / /shop; do
+    code=$(curl -s -o /dev/null -w '%{http_code}' -m 10 "http://127.0.0.1:${PORT}${r}" 2>/dev/null)
+    [ "$code" != "200" ] && { echo "$(date -u +%FT%TZ) ALARM: route $r -> $code after deploy"; return 1; }
+  done
+  return 0
+}
+$GIT fetch origin main 2>/dev/null || exit 0
+LOCAL=$($GIT rev-parse HEAD 2>/dev/null || echo none)
+REMOTE=$($GIT rev-parse origin/main 2>/dev/null || echo none)
+if [ "$LOCAL" != "$REMOTE" ]; then
+  if [ "$LOCAL" = "none" ]; then
+    $GIT checkout -f -B main origin/main || exit 0
+  else
+    PREV=$LOCAL
+    $GIT reset --hard origin/main || exit 0
+  fi
+  $GIT clean -fdq pages/ 2>/dev/null
+  cd /app/code && php bin/grav clearcache >/dev/null 2>&1; cd /app/data/user
+  if ! verify; then
+    if [ -n "${PREV:-}" ]; then
+      $GIT reset --hard "$PREV" && $GIT clean -fdq pages/ 2>/dev/null
+      cd /app/code && php bin/grav clearcache >/dev/null 2>&1
+      echo "$(date -u +%FT%TZ) rolled back to $PREV"
+    fi
+    exit 1
+  fi
+  echo "$(date -u +%FT%TZ) deployed $REMOTE"
+  exit 0
+fi
+if ! $GIT diff --quiet || ! $GIT diff --cached --quiet; then
+  $GIT add pages/
+  $GIT -c user.name=VpEngOps -c user.email=tsgstaff-coo-vpengops@turnsys.com commit -qm '(Grav site) content changes' || exit 0
+fi
+$GIT push origin main 2>/dev/null && echo "$(date -u +%FT%TZ) pushed" || true

app/scheduler/git-sync.job.yaml

@@ -0,0 +1,4 @@
+enabled: true
+run_at: '*/15 * * * *'
+command: /bin/bash /app/data/git-sync-job.sh
+output: logs/git-sync-job.log

app/system.yaml

@@ -0,0 +1,14 @@
+site:
+  title: 'Rogue Technologies'
+  description: 'Fabrication, printing, and maker services in San Antonio, TX.'
+author:
+  name: 'VpEngOps'
+  email: 'tsgstaff-coo-vpengops@turnsys.com'
+reverse_proxy_setup: true
+http_x_forwarded:
+  protocol: true
+  host: true
+debugger:
+  enabled: false
+errors:
+  display: false

qa/pre-push

@@ -0,0 +1,3 @@
+#!/bin/bash
+# runs repo QA before any push
+"$(dirname "$0")/site-qa.sh"

qa/site-qa.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+# site-qa.sh - QA for the Grav Website repo and (with -l BASE) the live site.
+#   ./site-qa.sh              repo checks: structure, frontmatter, link targets
+#   ./site-qa.sh -l BASE      live checks: every known route returns 200, all
+#                             internal links/assets resolve, pages have content
+# Exit non-zero on any failure. Used by CI and the post-deploy sync job.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+FAIL=0
+fail() { echo "FAIL: $*"; FAIL=$((FAIL+1)); }
+route_of() { # pages-relative dir -> URL route (lowercase, strip NN. prefixes)
+  echo "$1" | tr 'A-Z' 'a-z' | sed -E 's|/([0-9]+\.)|/|g; s|^([0-9]+\.)||'
+}
+
+repo_checks() {
+  declare -A ROUTES
+  while IFS= read -r f; do
+    grep -q '^title:' "$f" || fail "no title frontmatter: $f"
+    d=$(dirname "$f"); r=$(route_of "${d#pages/}")
+    ROUTES["${r:-/}"]=1
+  done < <(find pages -name '*.md')
+  while IFS= read -r f; do
+    d=$(dirname "$f")
+    for link in $(grep -oE '\]\([^)#]+' "$f" | sed -E 's/^\]\(//'); do
+      case "$link" in http*|mailto:*) continue ;; esac
+      t=$(realpath -m --relative-to=. "$(dirname "$f")/$link" 2>/dev/null) || { fail "unresolvable link $link in $f"; continue; }
+      t=${t#pages}; t=$(route_of "$t")
+      [ -n "${ROUTES[${t:-/}]:-}" ] || fail "broken link '$link' in $f (no route '${t:-/}')"
+    done
+  done < <(find pages -name '*.md')
+  echo "repo: ${#ROUTES[@]} routes checked"
+}
+
+live_checks() {
+  local BASE=${1%/}
+  local ROUTES=("/")
+  while IFS= read -r f; do
+    d=$(dirname "$f"); r=$(route_of "${d#pages/}")
+    ROUTES+=("/${r#/}")
+  done < <(find pages -name '*.md' | grep -v 'pages/01.home/home.md')
+  local SITEMAP=/tmp/qa-sitemap.txt CHECKED=/tmp/qa-checked.txt
+  : > $SITEMAP; : > $CHECKED
+  for r in $(printf '%s\n' "${ROUTES[@]}" | sort -u); do
+    code=$(curl -s -o /dev/null -w '%{http_code}' -m 20 --retry 1 "$BASE$r")
+    if [ "$code" = "200" ]; then echo "$BASE$r" >> $SITEMAP; else fail "route $r -> $code"; fi
+    sleep 0.2
+  done
+  for url in $(cat $SITEMAP); do
+    body=$(curl -s -m 20 "$url"); sleep 0.2
+    [ ${#body} -lt 500 ] && fail "page too small ($url, ${#body} bytes)"
+    upath=${url#$BASE}; [ -z "$upath" ] && upath=/
+    for link in $(echo "$body" | grep -oE 'href="[^"]*"' | sed 's/href="//; s/"$//' | sort -u); do
+      case "$link" in
+        http*|mailto:*|\#*) [[ "$link" == "$BASE"* ]] || continue ;;
+        /*) link="$BASE$link" ;;
+        *)  link="$BASE$(realpath -m "$upath/../$link" | sed 's|//\+|/|g')" ;;
+      esac
+      grep -qxF "$link" $CHECKED && continue
+      echo "$link" >> $CHECKED
+      case "$link" in
+        *.css|*.js|*.png|*.jpg|*.jpeg|*.svg|*.ico|*.woff*|*.map|*.webp|*.txt|*.xml) ;;
+        *) continue ;;
+      esac
+      code=$(curl -s -o /dev/null -w '%{http_code}' -m 20 "$link"); sleep 0.1
+      [ "$code" != "200" ] && fail "asset $link -> $code"
+    done
+    for link in $(echo "$body" | grep -oE 'href="[^"]*"' | sed 's/href="//; s/"$//' | sort -u); do
+      case "$link" in http*|mailto:*|\#*) continue ;; esac
+      case "$link" in
+        /*) L="$BASE$link" ;;
+        *)  L="$BASE$(realpath -m "$upath/../$link" | sed 's|//\+|/|g')" ;;
+      esac
+      grep -qxF "$L" $CHECKED && continue
+      echo "$L" >> $CHECKED
+      case "$L" in
+        *.css|*.js|*.png|*.jpg|*.jpeg|*.svg|*.ico|*.woff*|*.map|*.webp|*.txt|*.xml) continue ;;
+      esac
+      code=$(curl -s -o /dev/null -w '%{http_code}' -m 20 "$L"); sleep 0.1
+      [ "$code" != "200" ] && fail "link $L -> $code"
+    done
+  done
+  # canonical must be https (reverse-proxy scheme detection)
+  can=$(curl -s -m 15 "$BASE/" | grep -oE '<link rel="canonical" href="[^"]*"' | head -1)
+  case "$can" in *https://*) : ;; "") fail "no canonical link on home" ;; *) fail "canonical not https: $can" ;; esac
+  echo "checked $(wc -l < $SITEMAP) routes, $(wc -l < $CHECKED) links/assets"
+}
+
+case "${1:-}" in
+  -l) live_checks "$2" ;;
+  *)  repo_checks ;;
+esac
+[ $FAIL -eq 0 ] && echo "QA: PASS" || { echo "QA: $FAIL failure(s)"; exit 1; }