nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.
- Update all references from timothykim/ to hantim/ org
- Rename DEPLOY_KEY to DEPLOY_SSH_KEY everywhere
- Update README to reference org-level secrets
appleboy/ssh-action's script parameter doesn't set
SSH_ORIGINAL_COMMAND, which deploy.sh needs. Using raw ssh
with the command as an argument works correctly.
timothykim