ci: deploy to Bluehost over SSH with rsync (FTP fallback, dry-run option)

[laveshparyani]

Summary

• Deploy over SSH with rsync when the BLUEHOST_SSH_KEY secret is set:
  • only files whose content changed are sent, and an interrupted run resumes cleanly;
  • --delete removes files the build no longer makes (old asset hashes, Vantir's old pre-built page);
  • protect filters keep what lives only on the server: cgi-bin, temp, .well-known, the FTP state files and error_log.
• FTP stays as the fallback while the key secret isn't set.
• Manual runs can be a dry run (dry_run: true): rsync only lists the changes; FTP, IndexNow and the Cloudflare purge are skipped.

Why

Since the morning of 7 Oct 2026, Bluehost's FTP server drops the connection after a few files on every deploy (four failures, including with a 120 s timeout), so PR #128 isn't live yet.

Setup (done)

• SSH shell access enabled on the hosting account. Public key xktf_github_deploy added; login tested from a PC.
• Site folder: /home4/fmxpeumy/public_html/; rsync is on the server.
• Secrets set: BLUEHOST_SSH_HOST, BLUEHOST_SSH_USER, BLUEHOST_SSH_PATH, BLUEHOST_SSH_PORT.
• BLUEHOST_SSH_KEY (the private key) is added by the account owner.

Testing

• YAML parsed; step conditions checked.
• Next: gh workflow run deploy.yml --ref ci/ssh-rsync-deploy -f dry_run=true to see the exact list of changes before anything is written.