Add a dedicated workflow for deploying private playground (#28)

## Motivation for the change, related issues

We need to do some special things to deploy a Playground web app that is
private to Automattic (e.g., adding a check for A8C proxy). Let's
maintain private site deployment as a separate workflow so that those
changes don't eventually propagate to the main website deployment
workflow used by https://github.com/WordPress/wordpress-playground (when
we resume public contributions).

## Implementation details

Fork the website deployment workflow into deploy-private-website.yml. We
could make deployment to WP Cloud a reusable action if we need to deploy
to more sites than this, but let's just copy the workflow for now.

## Testing Instructions (or ideally a Blueprint)

- Deploy initial file and test manually afterward. This is required for
manual testing because you cannot launch a workflow that hasn't yet been
merged to the main branch (AFAIK).

Author: brandonpayton

.github/workflows/deploy-private-website.yml

@@ -0,0 +1,80 @@
+name: Deploy to playground.wordpress.net
+
+on:
+    workflow_dispatch:
+    # Deploy the website every day at 9am and 6pm UTC
+    # TODO: Uncomment when ready for regular deployment
+    # schedule:
+    #     - cron: '0 9,18 * * *'
+
+concurrency:
+    group: website-deployment
+    # TODO: Enable cancel-in-progress once we are deploying per commit?
+    #cancel-in-progress: true
+
+jobs:
+    build_and_deploy:
+        # Only run this workflow from the trunk branch and when it's triggered by another workflow OR a Playground maintainer
+        # TODO: Uncomment guards before merge
+        # if: >
+        #     github.ref == 'refs/heads/trunk' && (
+        #         github.event_name == 'workflow_run' ||
+        #         github.event_name == 'workflow_dispatch' ||
+        #         github.actor == 'adamziel' ||
+        #         github.actor == 'dmsnell' ||
+        #         github.actor == 'bgrgicak' ||
+        #         github.actor == 'brandonpayton' ||
+        #         github.actor == 'zaerl'
+        #     )
+
+        # Specify runner + deployment step
+        runs-on: ubuntu-latest
+        environment:
+            name: playground-wordpress-net-wp-cloud
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  submodules: true
+            - uses: ./.github/actions/prepare-playground
+            - run: npm run build
+            - run: tar -czf wasm-wordpress-net.tar.gz dist/packages/playground/wasm-wordpress-net
+            # Store dist/packages/artifacts/wasm-wordpress-net as a build artifact
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: playground-website
+                  path: wasm-wordpress-net.tar.gz
+            # The artifact only becomes available after this workflow wraps up, so let's wrap.
+            # This artifact enables the download of a pre-built package and hosting of one's own playground instance.
+
+            - name: Deploy to playground.wordpress.net
+              shell: bash
+              run: |
+                  mkdir -p ~/.ssh
+                  echo "${{ secrets.DEPLOY_WEBSITE_TARGET_HOST_KEY }}" >> ~/.ssh/known_hosts
+                  echo "${{ secrets.DEPLOY_WEBSITE_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+                  chmod 0600 ~/.ssh/*
+
+                  # Website files
+                  rsync -avz -e "ssh -i ~/.ssh/id_ed25519" --delete \
+                    dist/packages/playground/wasm-wordpress-net/ \
+                    ${{ secrets.DEPLOY_WEBSITE_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }}:'~/updated-playground-files'
+
+                  # Host-specific deployment scripts and server config
+                  rsync -avz -e "ssh -i ~/.ssh/id_ed25519" --delete \
+                    packages/playground/website-deployment/ \
+                    ${{ secrets.DEPLOY_WEBSITE_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }}:'~/website-deployment'
+
+                  # Copy MIME types for use with PHP-served files
+                  rsync -avz -e "ssh -i ~/.ssh/id_ed25519" \
+                    packages/php-wasm/universal/src/lib/mime-types.json \
+                    ${{ secrets.DEPLOY_WEBSITE_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }}:'~/website-deployment/'
+
+                  # Require A8C proxy for private web app
+                  ssh -i ~/.ssh/id_ed25519 \
+                    ${{ secrets.DEPLOY_WEBSITE_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }} \
+                    -tt -C 'echo "if ( \"cli\" !== php_sapi_name() && empty( \$_SERVER[\"A8C_PROXIED_REQUEST\"] ) ) { http_response_code( 401 ); echo \"Unauthorized. Please proxy.\"; die(); }" >> ~/website-deployment/custom-redirects.php'
+
+                  # Apply update
+                  ssh -i ~/.ssh/id_ed25519 \
+                    ${{ secrets.DEPLOY_WEBSITE_TARGET_USER }}@${{ secrets.DEPLOY_WEBSITE_TARGET_HOST }} \
+                    -tt -C '~/website-deployment/apply-update.sh'