Deployment

Deployment

The filesystem/Nginx destination is fully automated from the panel (#156 slice 1) — see the repository's DEPLOYMENT.md for the [deploy] table, the releases layout and troubleshooting. Sardine manages the site; external infrastructure serves it — publication is a repeatable cycle, never a one-off export. The big picture (with the flow diagram) lives in Operational Architecture; host-specific models and examples in the repository's docs/DEPLOYMENT.md.

cms export --target NAME produces everything a host needs; the output is plain static files plus target-specific extras.

Targets

swa — Azure Static Web Apps

Adds staticwebapp.config.json: security headers (nosniff, frame options, referrer policy, permissions policy), cache rules (immutable-ish for /assets/*, no-cache for pages), and a proper 404 rewrite. Free and Standard tiers take the same artifact.

nginx

Adds an nginx server block with the same security headers and a container-ready layout.

generic (default)

Plain static files for any host.

The demo pipeline (reference implementation)

The live demo (https://sardine.ph7x.com) deploys from GitHub Actions on every push to main:

1. In a build job with no deployment secret, install the packages and seed a fresh SQLite database.
2. Validate, export the SWA artifact and capture the read-only admin snapshot.
3. Upload the finished artifact with one-day retention.
4. In the protected deployment environment, download that artifact and deploy it; no project package is installed or executed in the job that receives the Azure token.

The same pattern works with real content: point the workflow at your storage URL instead of seeding.

Quality gates in CI

The repository defines ten required CI checks: ruff, mypy strict, pytest on Python 3.12 and 3.13, backend conformance, example build, offline docs links, a digest-pinned full-history secret scan, accessibility/markup, and pip-audit plus Bandit. Actions use immutable commit pins, downloaded tools are checksum-verified, and deployment credentials stay isolated from project execution. Managed CodeQL additionally scans Actions, Python and bundled JavaScript; enhanced secret scanning enables push protection, validity checks, non-provider patterns and assisted detection.