Fix deploy workflow silently dropping dotfiles like .htaccess

[AlexanderWagnerDev]

Summary

• wlixcc/SFTP-Deploy-Action (used in the current deploy.yml) builds its final upload command from an unquoted shell glob (path/*). Bash/SFTP globbing with * never matches files starting with a dot, so .htaccess was silently skipped on every deploy while every other file uploaded fine.
• Replace it with wangyucode/sftp-upload-action (pinned by commit SHA), which enumerates the local directory with Python's os.walk instead of shell globbing, so dotfiles are included correctly. This also lets us drop the manual rsync staging step — file exclusion (.git, .github, README.md, AGENTS.md, renovate.json) is now handled by the action's own exclude input.
• The new action also leaves a small bookkeeping file (.sftp_upload_action_hashes) on the server to skip re-uploading unchanged files on future runs. Added it to the existing .htaccess deny rule alongside *.md/renovate.json so it isn't publicly servable.

No changes to which secrets are used (DEPLOY_HOST, DEPLOY_USERNAME, DEPLOY_PASSWORD, DEPLOY_PORT, DEPLOY_REMOTE_PATH).

Test plan

• Push to main (or run the workflow manually) and confirm the deploy step completes without error
• Verify https://openrtmp.org/.htaccess-dependent behavior works (e.g. the www → apex redirect, custom error pages) confirming .htaccess actually landed on the server this time
• Confirm https://openrtmp.org/.sftp_upload_action_hashes is not publicly reachable

🤖 Generated with Claude Code

https://claude.ai/code/session_01CJGvJZXkV9CUHonq8wzEyt

---

Generated by Claude Code

Summary by CodeRabbit

• Security

  • Blocked public access to the deployment tool’s metadata file, alongside existing protected repository files.

• Deployment

  • Streamlined the deployment process while preserving the existing server credentials and destination settings.
  • Continued excluding repository and configuration files from uploaded content.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b4516133-12ff-4da8-856e-e467e48de35e

📥 Commits

Reviewing files that changed from the base of the PR and between ef5ae97 and dfc791a.

📒 Files selected for processing (2)

• .github/workflows/deploy.yml
• .htaccess

---

📝 Walkthrough

Walkthrough

The deployment workflow now uploads the repository root with wangyucode/sftp-upload-action. The .htaccess rules also block access to .sftp_upload_action_hashes.

Changes

Deployment flow

Layer / File(s)	Summary
Direct SFTP upload .github/workflows/deploy.yml	Replaces payload staging and the previous SFTP action with a direct repository upload. The workflow preserves deployment secrets and defines repository exclusions.
Uploaded metadata protection .htaccess	Blocks .sftp_upload_action_hashes alongside existing metadata files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: claude

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/peaceful-cannon-88d4ye

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1d1b5d40-a9fb-48ca-b56a-649196bfca3b)