deploy.yml

name: Deploy PHP site to Bluehost (index.php and .user.ini, preserve /data)

on:
  push:
    branches: [ "main" ]

concurrency:
  group: deploy-production
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Create a minimal deploy dir with index.php and its PHP settings
      - name: Prepare deploy folder
        run: |
          mkdir -p _deploy
          cp -f index.php _deploy/index.php
          cp -f .user.ini _deploy/.user.ini

      - name: Upload via FTP (index.php and .user.ini; keep /data safe)
        uses: SamKirkland/FTP-Deploy-Action@v4.3.6
        with:
          server: ${{ secrets.FTP_SERVER }}
          username: ${{ secrets.FTP_USERNAME }}
          password: ${{ secrets.FTP_PASSWORD }}
          server-dir: ${{ secrets.FTP_REMOTE_PATH }}   # e.g. /public_html/
          local-dir: ./_deploy/                        # contains index.php and .user.ini
          # NEVER set this to true. Clean-slate wipes ALL of server-dir before
          # uploading, including the live data/ folder (all reviews and
          # comments); `exclude` does NOT protect server files from it.
          # With it off, the action syncs incrementally against its
          # .ftp-deploy-sync-state.json and only deletes files it uploaded
          # itself (index.php, .user.ini), so data/ is never touched.
          dangerous-clean-slate: false
          # Ignored by dangerous-clean-slate. In incremental mode it also stops
          # the action from deleting matching server paths, so keep it as a
          # second guard for data/.
          exclude: |
            data
            data/**