fix: keep Launchpad deployment ownership in its own repository

Author: chrisbbreuer

.github/scripts/deploy/attached-sites.test.ts

@@ -0,0 +1,14 @@
+import { expect, test } from 'bun:test'
+import { readFileSync } from 'node:fs'
+
+const text = readFileSync(new URL('../../workflows/configure-launchpad-deployment.yml', import.meta.url), 'utf8')
+const workflow = Bun.YAML.parse(text) as any
+
+test('host credential setup is protected and never deploys an attached application', () => {
+  expect(workflow.jobs.configure.if).toContain("github.ref == 'refs/heads/main'")
+  expect(workflow.jobs.configure.environment).toBe('production')
+  expect(text).toContain('--repo stacksjs/launchpad --env website-production')
+  expect(text).not.toContain('./buddy deploy')
+  expect(text).not.toContain('secrets.DOTENV_PRIVATE_KEY_PRODUCTION')
+  expect(text).not.toContain('PORKBUN_SECRET_KEY')
+})

.github/scripts/deploy/configure-launchpad.test.ts

@@ -0,0 +1,33 @@
+name: Configure Launchpad deployment access
+
+# Host credential setup only. Launchpad owns its cloud configuration and deploys
+# its website and API from stacksjs/launchpad through cloud.attachTo.
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  configure:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: production
+    steps:
+      - name: Configure the dedicated protected deployment environment
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}
+          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
+        run: |
+          set -euo pipefail
+          test -n "$GH_TOKEN"
+          for name in HCLOUD_TOKEN CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID DEPLOY_SSH_KEY; do
+            test -n "${!name}"
+            printf '%s' "${!name}" | gh secret set "$name" --repo stacksjs/launchpad --env website-production
+          done
+          if [ -n "$SSH_KNOWN_HOSTS" ]; then
+            printf '%s' "$SSH_KNOWN_HOSTS" | gh secret set SSH_KNOWN_HOSTS --repo stacksjs/launchpad --env website-production
+          fi