gowalk-cicd 1.0.22 → 1.0.24

package/README.md

@@ -39,6 +39,36 @@ Re-run the same command anytime to pull the latest version.
 5. The existing metadata-rich form
    `*(key_id_<KEY_ID>_issuer_<UUID>_vendor_id_<ID>).p8` is also accepted.
 
+## Backend deploy (Python + Postgres, Docker)
+
+When a repo carries a Dockerized backend — a `backend/` (or `server/`) directory
+with a `docker-compose.yml` — the installer also vendors a backend deploy path:
+`.github/actions/backend-app/` and `.github/workflows/deploy-backend.yml`. A
+mobile-only repo is unaffected (the backend path is not installed).
+
+The backend workflow runs on a GitHub-hosted runner and, on a push touching
+`backend/**`, deploys to the gowalk host (`138.197.36.107`, publicly reachable):
+it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
+`docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
+wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+
+Requirements on the consumer repo:
+
+- **`backend/docker-compose.yml`** that publishes the API on a **loopback host
+  port** (`127.0.0.1:<port>:<container-port>`) so nginx can proxy it. Include a
+  Postgres service (or use a per-app database) and a `/health` endpoint.
+- A **`Dockerfile`** the compose file builds; pin the base image, run non-root,
+  never bake secrets in. A generated `.env` (with `POSTGRES_PASSWORD`) is created
+  on the host on first deploy and preserved across deploys (rsync excludes it).
+- Repo **secret** `BACKEND_DEPLOY_SSH_KEY` (a private key with access to the host).
+- Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
+  at the host for the cert; empty = deploy the container only, skip nginx/cert),
+  `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
+  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`).
+
+The action directory is canonical here (like the iOS/Android actions): edit it in
+`backend-action/`, never in a consumer's vendored copy.
+
 ## Android credentials
 
 Place these files under `creds/`:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.22
+1.0.24

package/action/scripts/capabilities.py

@@ -66,6 +66,28 @@ CAPABILITY_BY_ENTITLEMENT = {
 # so we say what is missing and stop.
 APP_ATTEST_ENTITLEMENT = "com.apple.developer.devicecheck.appattest-environment"
 
+# CarPlay capabilities are Apple-GRANTED per App ID (the CarPlay entitlement
+# request at https://developer.apple.com/contact/carplay/); the ASC API's
+# capabilityType enum has no CarPlay member, so a POST would 409 exactly like
+# App Attest. They live in MANUAL_ENTITLEMENTS (message, no POST) and in
+# PROFILE_ENTITLEMENT_KEYS (cache invalidation) — see the notes on each.
+CARPLAY_ENTITLEMENTS = {
+    "com.apple.developer.carplay-charging",
+    "com.apple.developer.carplay-fueling",
+    "com.apple.developer.carplay-parking",
+    "com.apple.developer.carplay-quick-ordering",
+    "com.apple.developer.carplay-maps",
+    "com.apple.developer.carplay-audio",
+    "com.apple.developer.carplay-communication",
+}
+
+_CARPLAY_MESSAGE = (
+    "a CarPlay entitlement, which Apple grants per App ID through the CarPlay "
+    "entitlement request form (developer.apple.com/contact/carplay/) — the "
+    "App Store Connect API cannot enable it. Request it from Apple, wait for "
+    "the grant, then re-run"
+)
+
 MANUAL_ENTITLEMENTS = {
     # App Attest is a real App ID capability in the developer portal, but it is
     # absent from the ASC API's capabilityType enum entirely — POSTing it
@@ -82,6 +104,7 @@ MANUAL_ENTITLEMENTS = {
     "com.apple.developer.in-app-payments": "Apple Pay",
     "com.apple.developer.pass-type-identifiers": "Wallet",
     "com.apple.developer.default-data-protection": "Data Protection",
+    **{key: _CARPLAY_MESSAGE for key in CARPLAY_ENTITLEMENTS},
 }
 
 
@@ -95,7 +118,16 @@ MANUAL_ENTITLEMENTS = {
 # Apple Pay, Wallet, Data Protection): those need App ID configuration this
 # action does not perform, so treating them as missing would regenerate the
 # profile on every single run without ever fixing anything.
-PROFILE_ENTITLEMENT_KEYS = set(CAPABILITY_BY_ENTITLEMENT) | {APP_ATTEST_ENTITLEMENT}
+#
+# CarPlay IS included, deliberately: a profile cached before Apple granted
+# the capability would otherwise be reinstalled until it expires, failing
+# every archive with no hint. Before the grant this forces a regenerate on
+# every run — which still fails, but loudly, with Apple's own message (and
+# the fail-fast in profile_manager); after the grant the fresh profile
+# carries the key and the check goes quiet.
+PROFILE_ENTITLEMENT_KEYS = (
+    set(CAPABILITY_BY_ENTITLEMENT) | {APP_ATTEST_ENTITLEMENT} | CARPLAY_ENTITLEMENTS
+)
 
 
 def missing_profile_entitlements(
@@ -109,6 +141,22 @@ def missing_profile_entitlements(
     }
 
 
+def missing_carplay_entitlements(
+    profile_entitlements: dict, required_keys: set[str]
+) -> set[str]:
+    """CarPlay keys the app needs that an issued profile does not carry.
+
+    Used as a pre-archive assertion: a freshly minted profile without the
+    granted CarPlay capability means Apple has not (yet) granted it, and the
+    archive would die later with an opaque xcodebuild error.
+    """
+    return {
+        key
+        for key in required_keys & CARPLAY_ENTITLEMENTS
+        if key not in profile_entitlements
+    }
+
+
 def read_entitlement_keys(path: Path) -> set[str]:
     """Top-level keys of an entitlements plist; empty when unreadable."""
     try:

package/action/scripts/profile_manager.py

@@ -262,6 +262,8 @@ def _provision_bundle(
     bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
+    if entitlement_keys:
+        _assert_carplay_entitlements(profile_der, entitlement_keys, bid, name)
     uuid, team_id, expiration = install_profile(profile_der)
     creds_store.write_cached_profile(creds_dir, uuid, profile_der)
     entry = {
@@ -275,6 +277,38 @@ def _provision_bundle(
     return name, uuid, team_id, entry
 
 
+def _assert_carplay_entitlements(
+    profile_der: bytes, entitlement_keys: set[str], bid: str, name: str
+) -> None:
+    """Fail fast when a fresh profile lacks a required CarPlay capability.
+
+    CarPlay capabilities are Apple-granted per App ID and cannot be enabled
+    through the ASC API. Without this check the run dies much later inside
+    ``xcodebuild archive`` with an opaque "doesn't include the ... capability"
+    — here it dies immediately, saying exactly what to do.
+    """
+    try:
+        plist = decode_profile_plist(profile_der, _PROFILE_DIRS[0])
+    except (OSError, subprocess.CalledProcessError, ValueError) as exc:
+        print(f"::warning::could not inspect fresh profile for {bid}: {exc!r}")
+        return
+    missing = capabilities.missing_carplay_entitlements(
+        plist.get("Entitlements") or {}, entitlement_keys
+    )
+    if not missing:
+        return
+    keys = ", ".join(sorted(missing))
+    raise SystemExit(
+        f"::error::Profile {name} for {bid} was issued WITHOUT {keys}. "
+        f"CarPlay capabilities are granted by Apple per App ID via the "
+        f"CarPlay entitlement request (developer.apple.com/contact/carplay/) "
+        f"and cannot be enabled through the App Store Connect API. Until the "
+        f"grant lands, keep the CarPlay key out of the entitlements file "
+        f"used by this configuration; once Apple confirms it on the App ID, "
+        f"re-run — the profile is regenerated automatically."
+    )
+
+
 def _gc_orphan_profiles(
     creds_dir: Path, old_manifest: dict, new_entries: list[dict]
 ) -> None:

package/action/scripts/test_capabilities.py

@@ -199,5 +199,63 @@ class ReconcileTest(unittest.TestCase):
         self.assertTrue(any("App Groups" in w for w in warnings), warnings)
 
 
+class CarPlayEntitlementsTest(unittest.TestCase):
+    CHARGING = "com.apple.developer.carplay-charging"
+
+    def test_every_carplay_key_is_manual_with_a_request_form_message(self) -> None:
+        for key in capabilities.CARPLAY_ENTITLEMENTS:
+            self.assertIn(key, capabilities.MANUAL_ENTITLEMENTS, key)
+            self.assertIn("carplay", capabilities.MANUAL_ENTITLEMENTS[key].lower())
+
+    def test_carplay_never_maps_to_an_asc_capability_post(self) -> None:
+        # The ASC capabilityType enum has no CarPlay member; a POST would 409.
+        self.assertEqual(
+            capabilities.required_capabilities(capabilities.CARPLAY_ENTITLEMENTS),
+            set(),
+        )
+
+    def test_cached_profile_without_carplay_is_detected_as_stale(self) -> None:
+        # The self-correcting-cache check: a profile minted pre-grant must be
+        # regenerated once the entitlements file declares CarPlay.
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(
+                {"application-identifier": "T.com.gowalk.ev"}, {self.CHARGING}
+            ),
+            {self.CHARGING},
+        )
+
+    def test_profile_carrying_carplay_passes_both_checks(self) -> None:
+        entitlements = {self.CHARGING: True}
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(entitlements, {self.CHARGING}),
+            set(),
+        )
+        self.assertEqual(
+            capabilities.missing_carplay_entitlements(entitlements, {self.CHARGING}),
+            set(),
+        )
+
+    def test_missing_carplay_ignores_non_carplay_keys(self) -> None:
+        self.assertEqual(
+            capabilities.missing_carplay_entitlements(
+                {}, {"aps-environment", "keychain-access-groups"}
+            ),
+            set(),
+        )
+
+    def test_reconcile_warns_but_does_not_post_for_carplay(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request") as posted, \
+                mock.patch("builtins.print") as printed:
+            regenerate = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.ev", {self.CHARGING}
+            )
+
+        posted.assert_not_called()
+        self.assertFalse(regenerate)
+        warnings = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("carplay" in w.lower() for w in warnings), warnings)
+
+
 if __name__ == "__main__":
     unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.22
+1.0.24

package/backend-action/.daemux-version

@@ -0,0 +1 @@
+1.0.24

package/backend-action/action.yml

@@ -0,0 +1,98 @@
+name: gowalk-cicd backend deploy
+description: >
+  Build and deploy a Dockerized Python+Postgres backend to the gowalk deploy
+  host (138.197.36.107) — rsync the backend dir, `docker compose up -d --build`,
+  wire an nginx vhost + Let's Encrypt cert for the API domain, and health-check.
+  The deploy host is publicly reachable, so this runs on a GitHub-hosted runner.
+
+inputs:
+  host:
+    description: SSH host of the deploy server.
+    required: false
+    default: "138.197.36.107"
+  ssh-user:
+    description: SSH user on the deploy server.
+    required: false
+    default: "root"
+  ssh-key:
+    description: Private SSH key with access to the deploy host (from a secret).
+    required: true
+  app-name:
+    description: Stable slug — the compose project and /opt/gowalk-backends/<app-name> dir.
+    required: true
+  api-domain:
+    description: >
+      Public domain for the API (e.g. api.myapp.gowalk.com). Its DNS A record
+      must already point at the deploy host. Empty = deploy the container only,
+      skip nginx + cert.
+    required: false
+    default: ""
+  backend-dir:
+    description: Path to the backend (holds Dockerfile + docker-compose.yml).
+    required: false
+    default: "backend"
+  health-path:
+    description: HTTP path the service answers 2xx on once healthy.
+    required: false
+    default: "/health"
+  cert-email:
+    description: Email for the Let's Encrypt registration.
+    required: false
+    default: "admin@gowalk.com"
+
+runs:
+  using: composite
+  steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        set -euo pipefail
+        test -f "${{ inputs.backend-dir }}/docker-compose.yml" \
+          || { echo "::error::no ${{ inputs.backend-dir }}/docker-compose.yml"; exit 1; }
+        case "${{ inputs.app-name }}" in
+          *[!a-z0-9-]*|"") echo "::error::app-name must be [a-z0-9-]"; exit 1;;
+        esac
+
+    - name: Configure SSH
+      shell: bash
+      env:
+        DEPLOY_SSH_KEY: ${{ inputs.ssh-key }}
+      run: |
+        set -euo pipefail
+        mkdir -p ~/.ssh && chmod 700 ~/.ssh
+        printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/backend_deploy
+        chmod 600 ~/.ssh/backend_deploy
+        ssh-keyscan -t ed25519,rsa,ecdsa "${{ inputs.host }}" >> ~/.ssh/known_hosts 2>/dev/null
+        chmod 644 ~/.ssh/known_hosts
+
+    - name: Sync backend to the host
+      shell: bash
+      run: |
+        set -euo pipefail
+        SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
+        DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
+        $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" "mkdir -p '$DEST'"
+        # --delete keeps the mirror true; exclude .env so server-side secrets
+        # (generated DB password, etc.) survive across deploys.
+        rsync -az --delete --exclude '.env' --exclude '.git' \
+          -e "$SSH" "${{ inputs.backend-dir }}/" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
+        # ship the remote deploy script (kept out of the app checkout)
+        rsync -az -e "$SSH" "${{ github.action_path }}/remote_deploy.sh" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/.remote_deploy.sh"
+
+    - name: Deploy on the host
+      shell: bash
+      run: |
+        set -euo pipefail
+        SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
+        DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
+        $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
+          "bash '$DEST/.remote_deploy.sh' \
+             '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
+             '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
+
+    - name: Cleanup key
+      if: always()
+      shell: bash
+      run: rm -f ~/.ssh/backend_deploy

package/backend-action/remote_deploy.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Runs ON the deploy host, inside /opt/gowalk-backends/<app>. Brings up the
+# compose stack, then (when a domain is given) wires an nginx vhost + LE cert
+# and health-checks the public URL. Idempotent; safe to re-run.
+set -euo pipefail
+
+APP="$1"           # slug — compose project + dir name
+DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
+HEALTH="${3:-/health}"
+CERT_EMAIL="${4:-admin@gowalk.com}"
+DIR="/opt/gowalk-backends/$APP"
+cd "$DIR"
+
+log() { echo "[deploy $APP] $*"; }
+
+# ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
+if [ ! -f .env ]; then
+  log "first deploy — generating .env (POSTGRES_PASSWORD)"
+  {
+    echo "POSTGRES_PASSWORD=$(openssl rand -hex 24)"
+    echo "APP_NAME=$APP"
+  } > .env
+  chmod 600 .env
+fi
+
+# ── bring the stack up
+log "docker compose up -d --build"
+docker compose --project-name "$APP" up -d --build --remove-orphans
+
+# ── discover the host port the service published on 127.0.0.1.
+# The text `ps` PORTS column reliably shows `127.0.0.1:<port>-><target>/tcp`.
+detect_port() {
+  # Capture ONLY the published port after 127.0.0.1: (not the IP's own digits).
+  docker compose --project-name "$APP" ps 2>/dev/null \
+    | sed -nE 's/.*127\.0\.0\.1:([0-9]+)->.*/\1/p' | head -1
+}
+PORT="$(detect_port || true)"
+[ -n "${PORT:-}" ] || { log "ERROR: no 127.0.0.1:<port> publish found in compose ps"; \
+  docker compose --project-name "$APP" ps; exit 1; }
+log "service published on 127.0.0.1:$PORT"
+
+# ── local health-check first (fast failure, no DNS/cert dependency).
+# Generous: a first-ever deploy cold-inits Postgres and pulls base images.
+HEALTHY=""
+for i in $(seq 1 90); do
+  if curl -fsS "http://127.0.0.1:$PORT$HEALTH" >/dev/null 2>&1; then
+    log "container healthy on :$PORT$HEALTH (after ${i}x2s)"; HEALTHY=1; break
+  fi
+  [ $((i % 15)) -eq 0 ] && log "waiting for health… (${i}x2s)"
+  sleep 2
+done
+if [ -z "$HEALTHY" ]; then
+  log "ERROR: container never became healthy on :$PORT$HEALTH"
+  docker compose --project-name "$APP" ps
+  docker compose --project-name "$APP" logs --tail 60
+  exit 1
+fi
+
+# ── container-only deploy (no domain): stop here
+if [ -z "$DOMAIN" ]; then
+  log "no domain given — container deployed, skipping nginx/cert"
+  exit 0
+fi
+
+# ── nginx vhost → proxy the domain to the published port
+VHOST="/etc/nginx/conf.d/backend-$APP.conf"
+if [ ! -f "$VHOST" ] || ! grep -q "127.0.0.1:$PORT" "$VHOST"; then
+  log "writing nginx vhost $VHOST → 127.0.0.1:$PORT"
+  cat > "$VHOST" <<NGINX
+server {
+    listen 80;
+    server_name $DOMAIN;
+    client_max_body_size 100m;
+    location / {
+        proxy_pass http://127.0.0.1:$PORT;
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 120s;
+    }
+}
+NGINX
+  nginx -t && systemctl reload nginx
+fi
+
+# ── Let's Encrypt cert (idempotent; certbot skips if current)
+if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
+  log "requesting LE cert for $DOMAIN"
+  certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
+    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+else
+  log "cert for $DOMAIN already present"
+fi
+
+# ── public health-check (best effort — cert/DNS may still be propagating)
+if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+  log "public https://$DOMAIN$HEALTH healthy"
+else
+  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
+fi
+log "done"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -15,6 +15,9 @@
     "android-action/",
     "!android-action/**/__pycache__/**",
     "!android-action/**/*.py[cod]",
+    "backend-action/",
+    "!backend-action/**/__pycache__/**",
+    "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
     "CLAUDE.md"

package/src/install.mjs

@@ -26,16 +26,29 @@ const PACKAGE_DIR = resolve(__dirname, '..');
 
 const ACTION_SRC = join(PACKAGE_DIR, 'action');
 const ANDROID_ACTION_SRC = join(PACKAGE_DIR, 'android-action');
+const BACKEND_ACTION_SRC = join(PACKAGE_DIR, 'backend-action');
 const WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy.yml');
+const BACKEND_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-backend.yml');
 const PACKAGE_JSON = join(PACKAGE_DIR, 'package.json');
 
 // Target paths inside the consumer repo. These are relative to the repo
 // root we discover below.
 const ACTION_DEST_REL = join('.github', 'actions', 'swift-app');
 const ANDROID_ACTION_DEST_REL = join('.github', 'actions', 'android-app');
+const BACKEND_ACTION_DEST_REL = join('.github', 'actions', 'backend-app');
 const WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy.yml');
+const BACKEND_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-backend.yml');
 const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-version');
 const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
+const BACKEND_VERSION_MARKER_REL = join('.github', 'actions', 'backend-app', '.daemux-version');
+
+// A repo has a backend when a backend/ or server/ dir carries a compose file.
+function backendDir(repoRoot) {
+  for (const d of ['backend', 'server']) {
+    if (existsSync(join(repoRoot, d, 'docker-compose.yml'))) return d;
+  }
+  return null;
+}
 
 // Lines we treat as ignoring credentials. If any appears in the consumer's
 // .gitignore, CI will not see one or both platform keys. We warn instead of
@@ -113,6 +126,18 @@ function copyWorkflow(repoRoot, dryRun) {
   return { dest, existed };
 }
 
+function copyBackendWorkflow(repoRoot, dryRun) {
+  const dest = join(repoRoot, BACKEND_WORKFLOW_DEST_REL);
+  const existed = existsSync(dest);
+  if (dryRun) {
+    console.log(`  [dry-run] ${existed ? 'overwrite' : 'create'} ${BACKEND_WORKFLOW_DEST_REL}`);
+    return;
+  }
+  ensureDir(dirname(dest));
+  cpSync(BACKEND_WORKFLOW_TEMPLATE, dest, { force: true });
+  console.log(`  ${existed ? 'Overwrote' : 'Created'} ${BACKEND_WORKFLOW_DEST_REL}`);
+}
+
 function writeVersionMarkers(repoRoot, dryRun) {
   // Reads this package's own version from package.json and stamps it
   // into the consumer repo as the source of truth for autoupdate's
@@ -195,6 +220,19 @@ export async function runInstall({ dryRun = false } = {}) {
   writeVersionMarkers(repoRoot, dryRun);
   copyWorkflow(repoRoot, dryRun);
 
+  // Backend deploy path — installed only when the repo has a Dockerized
+  // backend (backend/ or server/ with a docker-compose.yml). Mobile-only
+  // repos are unaffected, so this is backward compatible.
+  const bdir = backendDir(repoRoot);
+  if (bdir) {
+    console.log(`  Backend detected (${bdir}/docker-compose.yml) — installing backend deploy`);
+    copyAction(BACKEND_ACTION_SRC, BACKEND_ACTION_DEST_REL, repoRoot, dryRun);
+    if (!dryRun) writeFileSync(
+      join(repoRoot, BACKEND_VERSION_MARKER_REL),
+      String(JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version || '').trim());
+    copyBackendWorkflow(repoRoot, dryRun);
+  }
+
   const gi = checkGitignore(repoRoot);
   printGitignoreWarning(gi);
 

package/templates/deploy-backend.yml

@@ -0,0 +1,41 @@
+name: Backend Deploy
+
+# Deploys the Dockerized Python+Postgres backend to the gowalk host. Installed
+# by gowalk-cicd only when a backend/ (or server/) dir with a docker-compose.yml
+# is present. Mobile deploy stays in deploy.yml — this is the backend's own path.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - "server/**"
+      - ".github/workflows/deploy-backend.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: backend-deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      # Pick backend/ or server/, whichever holds the compose file.
+      - id: dir
+        run: |
+          if [ -f backend/docker-compose.yml ]; then echo "path=backend" >> "$GITHUB_OUTPUT"
+          elif [ -f server/docker-compose.yml ]; then echo "path=server" >> "$GITHUB_OUTPUT"
+          else echo "::error::no backend/ or server/ docker-compose.yml"; exit 1; fi
+
+      - name: Deploy backend
+        uses: ./.github/actions/backend-app
+        with:
+          ssh-key: ${{ secrets.BACKEND_DEPLOY_SSH_KEY }}
+          host: ${{ vars.BACKEND_DEPLOY_HOST || '138.197.36.107' }}
+          app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}
+          api-domain: ${{ vars.BACKEND_API_DOMAIN }}
+          backend-dir: ${{ steps.dir.outputs.path }}
+          health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}