How iris — and every PHP app on cPanel — ships itself

Stop replacing FileZilla. Remove the upload step entirely.

Today the iris pages are PHP files hand-uploaded to a cPanel server. The deploy docs (Iris_Kepler_Deploy_Playbook, DEPLOY_2026-05-31.md) are full of "upload file X → set 0644 → repeat". Once the app lives in GitHub, nobody uploads anything — deploy becomes a side-effect of merging.

Merge → Action → server. Four moving parts.

GitHub Actions does the FTP on the server's behalf, in the cloud, the instant a PR lands on main.

Make the repo root mirror the server docroot — exactly

A 1:1 mapping is the single highest-leverage decision. It deletes the path-translation tables, the .bak sprawl, and the permissions bug in one move — deploy becomes a dumb mirror with zero translation.

idata/                          # repo root            →  /public_html/
├─ iris_master.php              →  /public_html/iris_master.php
├─ lens.php  prism_*.php  header.inc.php
├─ _agent/
│  ├─ modes/eval_watchlist.php  →  /public_html/_agent/modes/...
│  ├─ modes/refresh_inventory.php
│  └─ migrate.php               # applies pending sql/ files, idempotent
├─ sql/28_iris_kepler.sql        # versioned, NOT auto-run blindly
├─ .gitignore                   # *.bak  *.zip  config.php  .idata/  __pycache__/
└─ .github/workflows/deploy.yml

One file, copy-paste ready

FTPS, diff-only, secrets in GitHub. The same file (parameterized) deploys Auth, Prism, BEAM and every other cPanel app — one reusable template across the org.

name: Deploy iData / iris to cPanel
on:
  push:
    branches: [main]
    paths: ['**.php', '**.html', '**.htaccess']   # docs-only changes don't redeploy
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: SamKirkland/FTP-Deploy-Action@v4.3.5
        with:
          server:   ${{ secrets.CPANEL_FTP_HOST }}
          username: ${{ secrets.CPANEL_FTP_USER }}
          password: ${{ secrets.CPANEL_FTP_PASS }}
          protocol: ftps
          local-dir:  ./
          server-dir: /public_html/
          exclude: ['**/.git*', '**/*.bak', '**/*.zip', 'sql/**', 'README*']
      # optional: apply pending DB migrations after files land
      - run: curl -fsS "https://idata.ienergia.cl/_agent/migrate.php?key=${{ secrets.MIGRATE_KEY }}"

Why this action: it stores .ftp-deploy-sync-state.json on the server and compares hashes, so after the first run it uploads only what changed — faster than any full mirror, and the FTP password lives in GitHub Secrets rather than a .bat on someone's desk.

Seven decisions that make this fast and safe

Tuned to this exact setup — shared cPanel host, a Windows team of mixed technical depth, files currently scattered across Dropbox with hand-made backups.

Three ways to deliver to cPanel — pick one

All three end with "merge auto-deploys". They differ in where the moving parts sit. The reachability probe already confirmed the host has Terminal/SSH + crontab, so all three are technically available.

From scratch, in the right order