feat: independently publish server SSH keys with safe sync and Worker homepage

.github/workflows/check.yml

@@ -0,0 +1,37 @@
+name: Validate repository keys and clients
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - name: Install shell test interpreters
+        run: sudo apt-get update && sudo apt-get install -y busybox shellcheck
+      - name: Run unit, shell, and real-browser tests
+        run: npm test
+        env:
+          BROWSER_TESTS: '1'
+          BROWSER_ARTIFACTS_DIR: /tmp/quickly-browser-artifacts
+      - name: Build isolated test fixture (never deployed)
+        run: npm run build:test
+      - name: Validate Worker bundle without publishing
+        run: npx wrangler deploy --dry-run --config cf-worker/wrangler.toml --outdir /tmp/worker-dry-run
+      - name: Upload browser evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: browser-evidence
+          path: /tmp/quickly-browser-artifacts
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/deploy.yml

@@ -0,0 +1,40 @@
+name: Publish server key release
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: production-key-release
+  cancel-in-progress: false
+jobs:
+  deploy:
+    # Deliberate opt-in prevents accidental deployment when this PR is merged.
+    # Configure production credentials and real server keys before enabling.
+    if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: production
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - name: Install shell test interpreters
+        run: sudo apt-get update && sudo apt-get install -y busybox shellcheck
+      - run: npm test
+        env:
+          BROWSER_TESTS: '1'
+      - name: Build production release (empty keys fail unless explicitly allowed)
+        run: npm run build
+      - run: node scripts/verify-release.mjs
+      - name: Deploy the validated production bundle
+        run: npx wrangler deploy --config cf-worker/wrangler.toml
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      - name: Verify published revision and public key payload
+        run: node scripts/verify-release.mjs --remote

.github/workflows/update-access-url.yml

@@ -1,28 +0,0 @@
-name: Update access url
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  update-url:
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Update access url
-        run: |
-          sed -i "s/ssh.lamgc.me/$REPLACEMENT_VALUE/g" README.md
-        env:
-          # 要替换的个人访问地址，例如：ssh.lamgc.me
-          REPLACEMENT_VALUE: ${{ secrets.ACCESS_URL }}
-      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v4
-        with:
-          commit_message: Update access url to ${{ secrets.ACCESS_URL }}
-          commit_options: '--no-verify'
-          file_pattern: README.md