feat: Update deployment workflow with health checks and auto-rollback

[cfsmp3]

Summary

Updates the GitHub Actions deployment workflow to implement safe deployments with automatic rollback on failure.

New Deployment Flow

┌─────────────────────────────────────────────────────────────┐
│  1. Pre-deployment checks                                    │
│     └─ Validate environment, save state for rollback        │
├─────────────────────────────────────────────────────────────┤
│  2. Deploy application                                       │
│     └─ Pull code, install deps, run migrations, reload      │
├─────────────────────────────────────────────────────────────┤
│  3. Verify deployment                                        │
│     └─ Health check with retries                            │
├─────────────────────────────────────────────────────────────┤
│  4. Rollback on failure (conditional)                        │
│     └─ Restore previous commit, downgrade migrations        │
├─────────────────────────────────────────────────────────────┤
│  5. Report status (always)                                   │
│     └─ Log final state, cleanup lock file                   │
└─────────────────────────────────────────────────────────────┘

Key Improvements

Before	After
Single monolithic step	5 distinct phases
No health verification	Health check with 6 retries
No rollback on failure	Automatic rollback
Silent failures possible	Clear logging at each phase
No deployment status	Always reports final status

Backwards Compatibility

The workflow includes fallback logic for when deployment scripts don't exist yet:

• If install/deploy/*.sh scripts exist → use new safe deployment
• Otherwise → use inline legacy deployment code

This allows the workflow to be merged before PRs #948 and #949, and it will automatically use the new scripts once they're merged.

Merge Order

These PRs can be merged in any order:

1. feat: Add health check endpoints for deployment verification #948 (health endpoint) - Recommended first, enables proper health checks
2. feat: Add safe deployment scripts with automatic rollback #949 (deployment scripts) - Recommended second, scripts used by workflow
3. feat: Update deployment workflow with health checks and auto-rollback #950 (this PR) - Can be merged anytime, has fallback logic

Once all three are merged, deployments will use the full safe deployment flow.

Test Plan

• Workflow syntax is valid (CI check)
• Manual trigger via workflow_dispatch works
• Pre-deployment checks pass on production
• Deployment completes successfully
• Health check verifies deployment
• Rollback triggers on simulated failure

Risk Assessment

Low risk because:

• Fallback to existing behavior if scripts missing
• Health check uses script_stop: false to allow rollback
• Final cleanup step always runs
• No changes to production config/secrets

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.88%. Comparing base (53b3d7f) to head (7530d6c).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #950   +/-   ##
=======================================
  Coverage   86.88%   86.88%           
=======================================
  Files          35       35           
  Lines        3759     3759           
  Branches      767      767           
=======================================
  Hits         3266     3266           
  Misses        355      355           
  Partials      138      138           

Flag	Coverage Δ
unittests	86.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud