project-auto-wizard 0.15.0 → 0.16.0

package/payload/workflows/python/PROJECT-PYTHON-PR-PREVIEW.yaml

@@ -106,6 +106,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -113,11 +115,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
 
@@ -206,18 +213,26 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
           sparse-checkout-cone-mode: false
 
       - name: Load messages
+        id: load_messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -348,16 +363,16 @@ jobs:
           EOF
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build & push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ${{ env.PROJECT_PATH }}
           file: ${{ env.PROJECT_PATH }}/${{ env.DOCKERFILE_PATH }}
@@ -369,13 +384,16 @@ jobs:
       - name: Progress - Docker done
         id: docker_progress
         uses: actions/github-script@v9
+        env:
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const dockerStart = ${{ steps.progress.outputs.docker_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const dockerStart = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START, 10) || Date.now();
             const now = Date.now();
             const dockerElapsed = now - dockerStart;
             const minutes = Math.floor(dockerElapsed / 60000);
@@ -552,28 +570,34 @@ jobs:
 
       - name: Deploy complete comment
         uses: actions/github-script@v9
+        env:
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_PR_OUTPUTS_REF: ${{ steps.pr.outputs.ref }}
+          PAW_IN_STEPS_PR_OUTPUTS_SHA: ${{ steps.pr.outputs.sha }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START: ${{ steps.docker_progress.outputs.deploy_start }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
-            const deployStart = ${{ steps.docker_progress.outputs.deploy_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
+            const deployStart = parseInt(process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START, 10) || Date.now();
             const now = Date.now();
             const deployElapsed = now - deployStart;
             const minutes = Math.floor(deployElapsed / 60000);
             const seconds = Math.floor((deployElapsed % 60000) / 1000);
             const deployDuration = minutes > 0 ? m('wf_preview.dur_min_sec', {minutes, seconds}) : m('wf_preview.dur_sec', {seconds});
 
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const domainSuffix = '${{ env.PREVIEW_DOMAIN_SUFFIX }}';
-            const previewPort = '${{ env.PREVIEW_PORT }}';
-            const apiDocsPath = '${{ env.API_DOCS_PATH }}';
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const domainSuffix = process.env.PREVIEW_DOMAIN_SUFFIX;
+            const previewPort = process.env.PREVIEW_PORT;
+            const apiDocsPath = process.env.API_DOCS_PATH;
             const prNumber = context.issue.number;
             const domain = `${projectName}-pr-${prNumber}.${domainSuffix}`;
             const previewUrl = `http://${domain}:${previewPort}`;
-            const sha = '${{ steps.pr.outputs.sha }}';
+            const sha = process.env.PAW_IN_STEPS_PR_OUTPUTS_SHA;
 
             // Build the preview environment table (the API Docs row is added only when API_DOCS_PATH is set)
             const envRows = [
@@ -585,7 +609,7 @@ jobs:
             envRows.push(m('wf_preview.env_container_pr', {projectName, prNumber}));
             envRows.push(m('wf_preview.env_commit', {sha}));
 
-            const branchName = '${{ steps.pr.outputs.ref }}';
+            const branchName = process.env.PAW_IN_STEPS_PR_OUTPUTS_REF;
 
             const body = [
               m('wf_preview.title_pr_deployed'),
@@ -629,20 +653,23 @@ jobs:
             });
 
       - name: Build/deploy failure comment
-        if: failure()
+        if: failure() && steps.load_messages.outcome == 'success'
         uses: actions/github-script@v9
+        env:
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id || 0 }};
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
             const prNumber = context.issue.number;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
 
             // Show where it failed based on progress
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
 
             // Work out where it failed - early-stage failures are distinguished too
             let dockerStatus, deployStatus;
@@ -725,6 +752,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -732,11 +761,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
 
@@ -749,7 +783,7 @@ jobs:
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
-            const marker = '${{ env.ISSUE_HELPER_MARKER }}';
+            const marker = process.env.ISSUE_HELPER_MARKER;
 
             console.log(m('wf_preview.log_search_branch', {issueNumber}));
             console.log(m('wf_preview.log_marker', {marker}));
@@ -794,7 +828,7 @@ jobs:
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
-            const marker = '${{ env.ISSUE_HELPER_MARKER }}';
+            const marker = process.env.ISSUE_HELPER_MARKER;
 
             const body = [
               m('wf_preview.title_branch_missing_warn'),
@@ -838,18 +872,26 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
           sparse-checkout-cone-mode: false
 
       - name: Load messages
+        id: load_messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -879,13 +921,16 @@ jobs:
       - name: Check branch exists
         id: check_branch
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const branchName = '${{ needs.get-branch-from-issue.outputs.branch_name }}';
-            const issueNumber = ${{ needs.get-branch-from-issue.outputs.issue_number }};
+            const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
+            const issueNumber = parseInt(process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER, 10) || 0;
 
             console.log(m('wf_preview.log_check_exists', {branchName}));
 
@@ -942,23 +987,28 @@ jobs:
       - name: Set issue info
         if: steps.check_branch.outputs.exists == 'true'
         id: issue
+        env:
+          PAW_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
         run: |
-          echo "ref=${{ needs.get-branch-from-issue.outputs.branch_name }}" >> $GITHUB_OUTPUT
+          echo "ref=$PAW_BRANCH_NAME" >> $GITHUB_OUTPUT
           echo "issue_number=${{ needs.get-branch-from-issue.outputs.issue_number }}" >> $GITHUB_OUTPUT
-          echo "sha=$(git ls-remote https://github.com/${{ github.repository }}.git refs/heads/${{ needs.get-branch-from-issue.outputs.branch_name }} | cut -c1-7)" >> $GITHUB_OUTPUT
+          echo "sha=$(git ls-remote https://github.com/${{ github.repository }}.git "refs/heads/$PAW_BRANCH_NAME" | cut -c1-7)" >> $GITHUB_OUTPUT
 
       # Progress comment system
       - name: Create progress comment
         if: steps.check_branch.outputs.exists == 'true'
         id: progress
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const issueNumber = ${{ needs.get-branch-from-issue.outputs.issue_number }};
-            const branchName = '${{ needs.get-branch-from-issue.outputs.branch_name }}';
+            const issueNumber = parseInt(process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const startTime = Date.now();
 
@@ -1045,18 +1095,18 @@ jobs:
 
       - name: Log in to Docker Hub
         if: steps.check_branch.outputs.exists == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
         if: steps.check_branch.outputs.exists == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build & push Docker image
         if: steps.check_branch.outputs.exists == 'true'
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ${{ env.PROJECT_PATH }}
           file: ${{ env.PROJECT_PATH }}/${{ env.DOCKERFILE_PATH }}
@@ -1069,14 +1119,18 @@ jobs:
         if: steps.check_branch.outputs.exists == 'true'
         id: docker_progress
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const branchName = '${{ needs.get-branch-from-issue.outputs.branch_name }}';
-            const dockerStart = ${{ steps.progress.outputs.docker_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
+            const dockerStart = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START, 10) || Date.now();
             const now = Date.now();
             const dockerElapsed = now - dockerStart;
             const minutes = Math.floor(dockerElapsed / 60000);
@@ -1257,29 +1311,36 @@ jobs:
       - name: Deploy complete comment
         if: steps.check_branch.outputs.exists == 'true'
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_ISSUE_OUTPUTS_SHA: ${{ steps.issue.outputs.sha }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START: ${{ steps.docker_progress.outputs.deploy_start }}
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const branchName = '${{ needs.get-branch-from-issue.outputs.branch_name }}';
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
-            const deployStart = ${{ steps.docker_progress.outputs.deploy_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
+            const deployStart = parseInt(process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START, 10) || Date.now();
             const now = Date.now();
             const deployElapsed = now - deployStart;
             const minutes = Math.floor(deployElapsed / 60000);
             const seconds = Math.floor((deployElapsed % 60000) / 1000);
             const deployDuration = minutes > 0 ? m('wf_preview.dur_min_sec', {minutes, seconds}) : m('wf_preview.dur_sec', {seconds});
 
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const domainSuffix = '${{ env.PREVIEW_DOMAIN_SUFFIX }}';
-            const previewPort = '${{ env.PREVIEW_PORT }}';
-            const apiDocsPath = '${{ env.API_DOCS_PATH }}';
-            const issueNumber = ${{ needs.get-branch-from-issue.outputs.issue_number }};
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const domainSuffix = process.env.PREVIEW_DOMAIN_SUFFIX;
+            const previewPort = process.env.PREVIEW_PORT;
+            const apiDocsPath = process.env.API_DOCS_PATH;
+            const issueNumber = parseInt(process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER, 10) || 0;
             const domain = `${projectName}-pr-${issueNumber}.${domainSuffix}`;
             const previewUrl = `http://${domain}:${previewPort}`;
-            const sha = '${{ steps.issue.outputs.sha }}';
+            const sha = process.env.PAW_IN_STEPS_ISSUE_OUTPUTS_SHA;
 
             // Build the preview environment table (the API Docs row is added only when API_DOCS_PATH is set)
             const envRows = [
@@ -1336,20 +1397,25 @@ jobs:
             });
 
       - name: Build/deploy failure comment
-        if: failure() && steps.check_branch.outputs.exists == 'true'
+        if: failure() && steps.load_messages.outcome == 'success' && steps.check_branch.outputs.exists == 'true'
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id || 0 }};
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const issueNumber = ${{ needs.get-branch-from-issue.outputs.issue_number }};
-            const branchName = '${{ needs.get-branch-from-issue.outputs.branch_name }}';
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const issueNumber = parseInt(process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
 
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
 
             let dockerStatus, deployStatus;
             let dockerTime = '-';
@@ -1425,6 +1491,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -1432,11 +1500,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -1463,6 +1536,41 @@ jobs:
           print("PAW_EOF")
           PY
 
+      # Without the deploy secrets no preview could have been deployed: on close events skip the cleanup quietly,
+      # and on an explicit command report what is missing instead of surfacing a raw SSH action error
+      - name: Deploy pre-check (Secrets)
+        id: precheck
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          SERVER_HOST: ${{ secrets.SERVER_HOST }}
+          SERVER_USER: ${{ secrets.SERVER_USER }}
+          SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
+          SSH_KEY: ${{ secrets.SSH_KEY }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          m() { python3 "$RUNNER_TEMP/paw/messages.py" get "$@"; }
+
+          MISSING=""
+          for NAME in DOCKERHUB_USERNAME SERVER_HOST SERVER_USER; do
+            [ -n "${!NAME}" ] || MISSING="$MISSING $NAME"
+          done
+          # SSH_KEY is required when SSH_AUTH_METHOD=key, otherwise SERVER_PASSWORD
+          if [ "${SSH_AUTH_METHOD:-password}" = "key" ]; then
+            [ -n "$SSH_KEY" ] || MISSING="$MISSING SSH_KEY"
+          else
+            [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
+          fi
+          if [ -n "$MISSING" ]; then
+            if [ "$EVENT_NAME" = "issue_comment" ]; then
+              echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+              exit 1
+            fi
+            echo "::warning title=$(m wf_preview.precheck_skip_title)::$(m wf_preview.precheck_skip_body missing="$MISSING")"
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+
       - name: Get PR/issue number
         id: pr_number
         run: |
@@ -1478,6 +1586,7 @@ jobs:
           fi
 
       - name: Remove container & image
+        if: steps.precheck.outputs.ready == 'true'
         uses: appleboy/ssh-action@v1.0.3
         env:
           SSH_AUTH_METHOD: ${{ env.SSH_AUTH_METHOD }}
@@ -1525,17 +1634,20 @@ jobs:
 
       - name: Destroy complete comment
         if: |
-          github.event_name == 'issue_comment' ||
-          (github.event_name == 'pull_request' && github.event.action == 'closed') ||
-          (github.event_name == 'issues' && github.event.action == 'closed')
+          steps.precheck.outputs.ready == 'true' && (
+            github.event_name == 'issue_comment' ||
+            (github.event_name == 'pull_request' && github.event.action == 'closed') ||
+            (github.event_name == 'issues' && github.event.action == 'closed'))
         uses: actions/github-script@v9
+        env:
+          PAW_IN_STEPS_PR_NUMBER_OUTPUTS_NUMBER: ${{ steps.pr_number.outputs.number }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const number = ${{ steps.pr_number.outputs.number }};
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
+            const number = parseInt(process.env.PAW_IN_STEPS_PR_NUMBER_OUTPUTS_NUMBER, 10) || 0;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
 
             const body = [
               m('wf_preview.title_destroyed'),
@@ -1571,6 +1683,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -1578,11 +1692,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -1609,6 +1728,32 @@ jobs:
           print("PAW_EOF")
           PY
 
+      # Report the missing secrets by name instead of surfacing a raw SSH action error
+      - name: Deploy pre-check (Secrets)
+        id: precheck
+        env:
+          SERVER_HOST: ${{ secrets.SERVER_HOST }}
+          SERVER_USER: ${{ secrets.SERVER_USER }}
+          SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
+          SSH_KEY: ${{ secrets.SSH_KEY }}
+        run: |
+          m() { python3 "$RUNNER_TEMP/paw/messages.py" get "$@"; }
+
+          MISSING=""
+          for NAME in SERVER_HOST SERVER_USER; do
+            [ -n "${!NAME}" ] || MISSING="$MISSING $NAME"
+          done
+          # SSH_KEY is required when SSH_AUTH_METHOD=key, otherwise SERVER_PASSWORD
+          if [ "${SSH_AUTH_METHOD:-password}" = "key" ]; then
+            [ -n "$SSH_KEY" ] || MISSING="$MISSING SSH_KEY"
+          else
+            [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
+          fi
+          if [ -n "$MISSING" ]; then
+            echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            exit 1
+          fi
+
       - name: Check container status
         id: status
         uses: appleboy/ssh-action@v1.0.3
@@ -1660,19 +1805,22 @@ jobs:
 
       - name: Post status comment
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_IS_PR: ${{ needs.check-command.outputs.is_pr }}
+          PAW_IN_STEPS_CHECK_RUNNING_OUTCOME: ${{ steps.check_running.outcome }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const number = context.issue.number;
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const domainSuffix = '${{ env.PREVIEW_DOMAIN_SUFFIX }}';
-            const previewPort = '${{ env.PREVIEW_PORT }}';
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const domainSuffix = process.env.PREVIEW_DOMAIN_SUFFIX;
+            const previewPort = process.env.PREVIEW_PORT;
             const domain = `${projectName}-pr-${number}.${domainSuffix}`;
             const previewUrl = `http://${domain}:${previewPort}`;
-            const isRunning = '${{ steps.check_running.outcome }}' === 'success';
-            const isPr = '${{ needs.check-command.outputs.is_pr }}' === 'true';
+            const isRunning = process.env.PAW_IN_STEPS_CHECK_RUNNING_OUTCOME === 'success';
+            const isPr = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_IS_PR === 'true';
             const contextType = isPr ? 'PR' : 'Issue';
 
             let body;
@@ -1734,18 +1882,26 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
           sparse-checkout-cone-mode: false
 
       - name: Load messages
+        id: load_messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -1775,12 +1931,14 @@ jobs:
       - name: Check branch exists and extract info
         id: branch_info
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
             const issueNumber = context.issue.number;
 
             console.log(m('wf_preview.log_check_branch', {branchName}));
@@ -1855,21 +2013,25 @@ jobs:
       - name: Get latest commit SHA of the branch
         if: steps.branch_info.outputs.branch_exists == 'true'
         id: get_sha
+        env:
+          PAW_BRANCH_NAME: ${{ needs.check-command.outputs.custom_branch }}
         run: |
-          SHA=$(git ls-remote https://github.com/${{ github.repository }}.git refs/heads/${{ needs.check-command.outputs.custom_branch }} | cut -c1-7)
+          SHA=$(git ls-remote https://github.com/${{ github.repository }}.git "refs/heads/$PAW_BRANCH_NAME" | cut -c1-7)
           echo "sha=$SHA" >> $GITHUB_OUTPUT
 
       - name: Create progress comment
         if: steps.branch_info.outputs.branch_exists == 'true'
         id: progress
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const startTime = Date.now();
 
@@ -1955,14 +2117,14 @@ jobs:
 
       - name: Log in to Docker Hub
         if: steps.branch_info.outputs.branch_exists == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
         if: steps.branch_info.outputs.branch_exists == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Resolve container name
         if: steps.branch_info.outputs.branch_exists == 'true'
@@ -1978,7 +2140,7 @@ jobs:
 
       - name: Build & push Docker image
         if: steps.branch_info.outputs.branch_exists == 'true'
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ${{ env.PROJECT_PATH }}
           file: ${{ env.PROJECT_PATH }}/${{ env.DOCKERFILE_PATH }}
@@ -1991,14 +2153,18 @@ jobs:
         if: steps.branch_info.outputs.branch_exists == 'true'
         id: docker_progress
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const dockerStart = ${{ steps.progress.outputs.docker_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const dockerStart = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START, 10) || Date.now();
             const now = Date.now();
             const dockerElapsed = now - dockerStart;
             const minutes = Math.floor(dockerElapsed / 60000);
@@ -2172,29 +2338,36 @@ jobs:
       - name: Deploy complete comment
         if: steps.branch_info.outputs.branch_exists == 'true'
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
+          PAW_IN_STEPS_CONTAINER_OUTPUTS_NAME: ${{ steps.container.outputs.name }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_GET_SHA_OUTPUTS_SHA: ${{ steps.get_sha.outputs.sha }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START: ${{ steps.docker_progress.outputs.deploy_start }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id }};
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
-            const deployStart = ${{ steps.docker_progress.outputs.deploy_start }};
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
+            const deployStart = parseInt(process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START, 10) || Date.now();
             const now = Date.now();
             const deployElapsed = now - deployStart;
             const minutes = Math.floor(deployElapsed / 60000);
             const seconds = Math.floor((deployElapsed % 60000) / 1000);
             const deployDuration = minutes > 0 ? m('wf_preview.dur_min_sec', {minutes, seconds}) : m('wf_preview.dur_sec', {seconds});
 
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const domainSuffix = '${{ env.PREVIEW_DOMAIN_SUFFIX }}';
-            const previewPort = '${{ env.PREVIEW_PORT }}';
-            const apiDocsPath = '${{ env.API_DOCS_PATH }}';
-            const containerName = '${{ steps.container.outputs.name }}';
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const domainSuffix = process.env.PREVIEW_DOMAIN_SUFFIX;
+            const previewPort = process.env.PREVIEW_PORT;
+            const apiDocsPath = process.env.API_DOCS_PATH;
+            const containerName = process.env.PAW_IN_STEPS_CONTAINER_OUTPUTS_NAME;
             const domain = `${containerName}.${domainSuffix}`;
             const previewUrl = `http://${domain}:${previewPort}`;
-            const sha = '${{ steps.get_sha.outputs.sha }}';
+            const sha = process.env.PAW_IN_STEPS_GET_SHA_OUTPUTS_SHA;
 
             // Build the preview environment table
             const envRows = [
@@ -2251,18 +2424,22 @@ jobs:
             });
 
       - name: Build/deploy failure comment
-        if: failure() && steps.branch_info.outputs.branch_exists == 'true'
+        if: failure() && steps.load_messages.outcome == 'success' && steps.branch_info.outputs.branch_exists == 'true'
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
+          PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
+          PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const commentId = ${{ steps.progress.outputs.comment_id || 0 }};
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
+            const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
 
-            const dockerDuration = '${{ steps.docker_progress.outputs.docker_duration }}';
+            const dockerDuration = process.env.PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION;
 
             let dockerStatus, deployStatus;
             let dockerTime = '-';
@@ -2338,6 +2515,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -2345,11 +2524,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -2376,16 +2560,45 @@ jobs:
           print("PAW_EOF")
           PY
 
+      # Report the missing secrets by name instead of surfacing a raw SSH action error
+      - name: Deploy pre-check (Secrets)
+        id: precheck
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          SERVER_HOST: ${{ secrets.SERVER_HOST }}
+          SERVER_USER: ${{ secrets.SERVER_USER }}
+          SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
+          SSH_KEY: ${{ secrets.SSH_KEY }}
+        run: |
+          m() { python3 "$RUNNER_TEMP/paw/messages.py" get "$@"; }
+
+          MISSING=""
+          for NAME in DOCKERHUB_USERNAME SERVER_HOST SERVER_USER; do
+            [ -n "${!NAME}" ] || MISSING="$MISSING $NAME"
+          done
+          # SSH_KEY is required when SSH_AUTH_METHOD=key, otherwise SERVER_PASSWORD
+          if [ "${SSH_AUTH_METHOD:-password}" = "key" ]; then
+            [ -n "$SSH_KEY" ] || MISSING="$MISSING SSH_KEY"
+          else
+            [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
+          fi
+          if [ -n "$MISSING" ]; then
+            echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            exit 1
+          fi
+
       - name: Extract container info from branch name
         id: container_info
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
 
             // Extract the issue number from the branch name (#number pattern)
             const issueMatch = branchName.match(/#(\d+)/);
@@ -2460,13 +2673,16 @@ jobs:
 
       - name: Destroy complete comment
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
+          PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME: ${{ steps.container_info.outputs.container_name }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const containerName = '${{ steps.container_info.outputs.container_name }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const containerName = process.env.PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME;
 
             const body = [
               m('wf_preview.title_custom_destroyed'),
@@ -2506,6 +2722,8 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request' && github.sha || github.event.repository.default_branch }}
+          # Separate path: a sparse checkout at the workspace root would leave the later full checkout sparse too
+          path: .paw-msg
           sparse-checkout: |
             .github/scripts/messages.py
             version.yml
@@ -2513,11 +2731,16 @@ jobs:
 
       - name: Load messages
         run: |
-          # Keep a copy outside the workspace: checking out the PR branch later replaces its files
+          # Keep a copy outside the workspace and drop the sparse clone so the later checkout sees a clean tree
           mkdir -p "$RUNNER_TEMP/paw"
-          cp .github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          [ -f .paw-msg/.github/scripts/messages.py ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
+          cp .paw-msg/.github/scripts/messages.py "$RUNNER_TEMP/paw/messages.py"
+          LANG_CODE=$(cd .paw-msg && python3 "$RUNNER_TEMP/paw/messages.py" lang)
+          rm -rf .paw-msg
+          # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
+          export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
           {
-            echo "PROJECT_AUTO_WIZARD_LANG=$(python3 .github/scripts/messages.py lang)"
+            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
             echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
           } >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
@@ -2544,13 +2767,41 @@ jobs:
           print("PAW_EOF")
           PY
 
+      # Report the missing secrets by name instead of surfacing a raw SSH action error
+      - name: Deploy pre-check (Secrets)
+        id: precheck
+        env:
+          SERVER_HOST: ${{ secrets.SERVER_HOST }}
+          SERVER_USER: ${{ secrets.SERVER_USER }}
+          SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
+          SSH_KEY: ${{ secrets.SSH_KEY }}
+        run: |
+          m() { python3 "$RUNNER_TEMP/paw/messages.py" get "$@"; }
+
+          MISSING=""
+          for NAME in SERVER_HOST SERVER_USER; do
+            [ -n "${!NAME}" ] || MISSING="$MISSING $NAME"
+          done
+          # SSH_KEY is required when SSH_AUTH_METHOD=key, otherwise SERVER_PASSWORD
+          if [ "${SSH_AUTH_METHOD:-password}" = "key" ]; then
+            [ -n "$SSH_KEY" ] || MISSING="$MISSING SSH_KEY"
+          else
+            [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
+          fi
+          if [ -n "$MISSING" ]; then
+            echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            exit 1
+          fi
+
       - name: Extract container info from branch name
         id: container_info
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
 
             // Extract the issue number from the branch name (#number pattern)
             const issueMatch = branchName.match(/#(\d+)/);
@@ -2606,19 +2857,23 @@ jobs:
 
       - name: Post status comment
         uses: actions/github-script@v9
+        env:
+          PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
+          PAW_IN_STEPS_CHECK_RUNNING_OUTCOME: ${{ steps.check_running.outcome }}
+          PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME: ${{ steps.container_info.outputs.container_name }}
         with:
           script: |
             const M = JSON.parse(process.env.PAW_MSG);
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
-            const branchName = '${{ needs.check-command.outputs.custom_branch }}';
-            const containerName = '${{ steps.container_info.outputs.container_name }}';
-            const projectName = '${{ env.PROJECT_PATH != '.' && format('{0}-python', env.PROJECT_NAME) || env.PROJECT_NAME }}';
-            const domainSuffix = '${{ env.PREVIEW_DOMAIN_SUFFIX }}';
-            const previewPort = '${{ env.PREVIEW_PORT }}';
+            const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
+            const containerName = process.env.PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME;
+            const projectName = process.env.PROJECT_PATH !== '.' ? process.env.PROJECT_NAME + '-python' : process.env.PROJECT_NAME;
+            const domainSuffix = process.env.PREVIEW_DOMAIN_SUFFIX;
+            const previewPort = process.env.PREVIEW_PORT;
             const domain = `${containerName}.${domainSuffix}`;
             const previewUrl = `http://${domain}:${previewPort}`;
-            const isRunning = '${{ steps.check_running.outcome }}' === 'success';
+            const isRunning = process.env.PAW_IN_STEPS_CHECK_RUNNING_OUTCOME === 'success';
 
             let body;
             if (isRunning) {