ci: verify Timeweb pull deployment

.github/workflows/deploy-timeweb.yml

@@ -1,4 +1,4 @@
-name: Deploy Caterium to Timeweb Hosting
+name: Verify Caterium on Timeweb
 
 on:
   workflow_run:
@@ -14,82 +14,64 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  deploy:
+  verify:
     if: >-
       github.event_name == 'workflow_dispatch' ||
       (github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'production')
     runs-on: ubuntu-latest
     env:
-      TIMEWEB_HOST: ${{ secrets.TIMEWEB_HOST }}
-      TIMEWEB_USER: ${{ secrets.TIMEWEB_USER }}
-      TIMEWEB_SSH_KEY: ${{ secrets.TIMEWEB_SSH_KEY }}
-      TIMEWEB_REMOTE_PATH: ${{ secrets.TIMEWEB_REMOTE_PATH }}
+      TIMEWEB_BASE_URL: https://app.caterium.ru
 
     steps:
-      - name: Check Timeweb configuration
-        id: config
-        shell: bash
-        run: |
-          missing=0
-          for name in TIMEWEB_HOST TIMEWEB_USER TIMEWEB_SSH_KEY TIMEWEB_REMOTE_PATH; do
-            if [ -z "${!name}" ]; then
-              echo "::notice::$name is not configured yet"
-              missing=1
-            fi
-          done
-
-          if [ "$missing" -eq 0 ]; then
-            echo "ready=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "ready=false" >> "$GITHUB_OUTPUT"
-            echo "Timeweb deployment is prepared but inactive until all four repository secrets are configured."
-          fi
-
       - name: Checkout tested production revision
-        if: steps.config.outputs.ready == 'true'
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'production' }}
 
-      - name: Configure SSH
-        if: steps.config.outputs.ready == 'true'
+      - name: Wait for Timeweb cron deployment
         shell: bash
         run: |
-          install -m 700 -d "$HOME/.ssh"
-          printf '%s\n' "$TIMEWEB_SSH_KEY" > "$HOME/.ssh/timeweb_deploy_key"
-          chmod 600 "$HOME/.ssh/timeweb_deploy_key"
-          ssh-keyscan -p 22 -H "$TIMEWEB_HOST" >> "$HOME/.ssh/known_hosts"
-          chmod 600 "$HOME/.ssh/known_hosts"
+          set -euo pipefail
 
-      - name: Verify Timeweb target
-        if: steps.config.outputs.ready == 'true'
-        shell: bash
-        run: |
-          test -f public/index.html
-          ssh -p 22 -i "$HOME/.ssh/timeweb_deploy_key" \
-            -o BatchMode=yes \
-            -o IdentitiesOnly=yes \
-            "$TIMEWEB_USER@$TIMEWEB_HOST" \
-            "mkdir -p -- '$TIMEWEB_REMOTE_PATH'"
+          login_file="public/core/login-signature-v1776.js"
+          logo_file="public/caterium-mark-light.svg"
 
-      - name: Deploy public directory
-        if: steps.config.outputs.ready == 'true'
-        shell: bash
-        run: |
-          rsync -az --delete --checksum \
-            --exclude='.htaccess' \
-            --exclude='.well-known/' \
-            -e "ssh -p 22 -i $HOME/.ssh/timeweb_deploy_key -o BatchMode=yes -o IdentitiesOnly=yes" \
-            public/ \
-            "$TIMEWEB_USER@$TIMEWEB_HOST:$TIMEWEB_REMOTE_PATH/"
+          test -s "$login_file"
+          test -s "$logo_file"
 
-      - name: Verify deployed entry point
-        if: steps.config.outputs.ready == 'true'
-        shell: bash
-        run: |
-          ssh -p 22 -i "$HOME/.ssh/timeweb_deploy_key" \
-            -o BatchMode=yes \
-            -o IdentitiesOnly=yes \
-            "$TIMEWEB_USER@$TIMEWEB_HOST" \
-            "test -s '$TIMEWEB_REMOTE_PATH/index.html'"
+          local_login="$(sha256sum "$login_file" | awk '{print $1}')"
+          local_logo="$(sha256sum "$logo_file" | awk '{print $1}')"
+
+          echo "Expected login sha256: $local_login"
+          echo "Expected logo sha256:  $local_logo"
+
+          for attempt in $(seq 1 18); do
+            stamp="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${attempt}"
+            echo "Attempt $attempt/18"
+
+            if curl -fsSL --connect-timeout 10 --max-time 30 \
+                "${TIMEWEB_BASE_URL}/core/login-signature-v1776.js?deploy_check=${stamp}" \
+                -o /tmp/caterium-login.js && \
+               curl -fsSL --connect-timeout 10 --max-time 30 \
+                "${TIMEWEB_BASE_URL}/caterium-mark-light.svg?deploy_check=${stamp}" \
+                -o /tmp/caterium-mark.svg; then
+              remote_login="$(sha256sum /tmp/caterium-login.js | awk '{print $1}')"
+              remote_logo="$(sha256sum /tmp/caterium-mark.svg | awk '{print $1}')"
+
+              echo "Remote login sha256: $remote_login"
+              echo "Remote logo sha256:  $remote_logo"
+
+              if [ "$remote_login" = "$local_login" ] && [ "$remote_logo" = "$local_logo" ]; then
+                echo "Timeweb production is current."
+                exit 0
+              fi
+            else
+              echo "Timeweb is not reachable yet."
+            fi
+
+            sleep 30
+          done
+
+          echo "::error::Timeweb did not reach the tested Caterium login revision within 9 minutes."
+          exit 1