feat(ci): Improve deployment workflow with PM2, security fixes, and enhanced backup (#96)

* feat(ci): Add deployment workflow for staging and production

- Add deploy.yml workflow with SSH-based deployment
- Staging: Auto-deploys on push to main (after tests pass)
- Production: Deploys on GitHub releases or manual trigger
- Quality gates: Requires test.yml to pass before deployment
- Security: Uses ssh-agent for secure key handling
- Add workflow_call trigger to test.yml for reusability
- Include pre-deployment backups for production
- Add health check verification post-deployment

Triggers:
- Push to main → staging
- GitHub Release → production
- Manual workflow_dispatch → either

Required secrets: HOST, USER, SSH_KEY, PROJECT_PATH

* fix(ci): Use PM2 instead of systemd for service management

- Replace systemctl commands with PM2 restart/start
- Update health check port from 8080 to 14200 (staging backend port)
- Add logs directory creation before PM2 start
- Support optional ecosystem.production.config.js for production
- Add PM2 save after restart to persist process list

* feat(ci): Generate .env files from GitHub secrets during deployment

- Add environment file creation step for staging and production
- Create .env.staging/.env.production from GitHub secrets
- Set proper file permissions (600) for security
- Document new required secrets: ANTHROPIC_API_KEY, OPENAI_API_KEY,
  CORS_ORIGINS, API_URL, WS_URL

New secrets needed in staging environment:
- ANTHROPIC_API_KEY
- OPENAI_API_KEY (optional)
- CORS_ORIGINS
- API_URL
- WS_URL

* fix(ci): Enable DEBUG and HOT_RELOAD for staging environment

* refactor(ci): Pull all env vars from GitHub secrets

All environment variables now come from GitHub secrets so they can be
configured per-environment (staging vs production) in GitHub settings.

Secrets required per environment:
- ANTHROPIC_API_KEY, OPENAI_API_KEY
- DATABASE_PATH, API_HOST, API_PORT
- CORS_ORIGINS, API_URL, WS_URL
- LOG_LEVEL, LOG_FILE
- ENVIRONMENT, DEBUG, HOT_RELOAD

* fix(ci): Use explicit PM2 process names per environment

- Staging: ecosystem.staging.config.js, check for codeframe-staging-backend
- Production: ecosystem.production.config.js, check for codeframe-production-backend
- Use pm2 describe instead of grep for reliable process detection

* feat(ci): Improve production backup with retention and compression

- Move backups from /tmp to PROJECT_PATH/backups for persistence
- Create timestamped compressed tar.gz archives
- Include: database, .codeframe configs, .env files, ecosystem configs, logs
- Record git commit info in archive
- Implement retention policy (keep last 10 backups)
- Use atomic operations (create in /tmp, mv to final location)
- Set proper permissions (700 dir, 600 archives)
- Abort deployment if backup fails
- Report backup size and count after completion

* fix(ci): Add retry loop to health checks with proper failure handling

- Replace one-liner health check with retry loop (12 attempts, 5s apart)
- Exit 0 immediately on success
- Exit 1 after all attempts fail (fails the workflow)
- Show progress on each attempt
- Applied to both staging and production deployments

* fix(ci): Target specific PM2 processes instead of entire ecosystem

- Use pm2 jlist with grep for robust process existence check
- Restart individual processes by name when they exist
- Start with --only flag when processes don't exist
- Handle backend and frontend processes separately
- Applied to both staging and production deployments

* security(ci): Fix command injection vulnerability in env file creation

- Use printf with %s to build env content (no shell interpretation)
- Base64 encode content before transfer to prevent injection
- Decode safely on remote server
- Write to .tmp file first, then atomic mv to final location
- Verify file was created and is non-empty before proceeding
- Exit with error if creation fails

This prevents command injection if secrets contain shell metacharacters
like backticks, $(), or other special characters.

* Add uv to deployment script

Author: frankbria

.github/workflows/deploy.yml

@@ -74,6 +74,8 @@ jobs:
           ENV_ENVIRONMENT: ${{ secrets.ENVIRONMENT }}
           ENV_DEBUG: ${{ secrets.DEBUG }}
           ENV_HOT_RELOAD: ${{ secrets.HOT_RELOAD }}
+          ENV_PM2_FRONTEND_NAME: ${{ secrets.PM2_FRONTEND_NAME }}
+          ENV_PM2_BACKEND_NAME: ${{ secrets.PM2_BACKEND_NAME }}
         run: |
           echo "📝 Creating .env.staging file..."
 
@@ -142,13 +144,11 @@ jobs:
 
             # Backend setup
             echo "🐍 Setting up Python backend..."
-            if [ -d .venv ]; then
-              source .venv/bin/activate
-            else
-              python3 -m venv .venv
-              source .venv/bin/activate
-            fi
-            pip install --quiet uv
+            if ! command -v uv &> /dev/null; then
+              curl -LsSf https://astral.sh/uv/install.sh | sh
+            fi 
+            uv venv
+            source .venv/bin/activate
             uv sync
 
             # Frontend setup
@@ -169,8 +169,8 @@ jobs:
             fi
 
             CONFIG_FILE="ecosystem.staging.config.js"
-            BACKEND_NAME="codeframe-staging-backend"
-            FRONTEND_NAME="codeframe-staging-frontend"
+            BACKEND_NAME=$ENV_PM2_BACKEND_NAME
+            FRONTEND_NAME=$ENV_PM2_FRONTEND_NAME
 
             # Function to check if a PM2 process exists
             process_exists() {