Deploy #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| # Push-to-deploy for zig-utils.org and every <slug>.zig-utils.org docs site. | |
| # | |
| # This project ATTACHES to the shared box owned by the `stacks` project | |
| # (cloud.config.ts sets `cloud.attachTo: 'stacks'`), so it never provisions — | |
| # it builds its sites and ships only those onto the existing box. | |
| on: | |
| push: | |
| branches: [main] | |
| # The docs are built from each library's own repository, so a change over | |
| # there should reach the site without a commit here. | |
| schedule: | |
| - cron: '0 6 * * *' | |
| workflow_dispatch: | |
| concurrency: | |
| group: deploy-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| # Not --frozen-lockfile: bun.lock here is lockfileVersion 2, written by a | |
| # 1.4.0 canary, and the newest Bun published to npm (1.3.14, what | |
| # setup-bun resolves for `latest`) cannot parse it — a frozen install | |
| # fails outright. Restore the flag once 1.4 ships to the `latest` channel. | |
| - run: bun install | |
| # ts-cloud reaches the shared box over SSH (hetzner.sshPrivateKeyPath). | |
| # DEPLOY_SSH_KEY is a dedicated, passphrase-less ed25519 key authorized on | |
| # the box for this project — a personal key cannot be used here, because | |
| # ssh-keygen cannot derive the public half of a passphrase-protected key | |
| # non-interactively and the step dies before the deploy runs. | |
| # StrictHostKeyChecking=accept-new so the first connection is not an | |
| # interactive prompt on a runner with no TTY. | |
| - name: Add deploy SSH key | |
| run: | | |
| mkdir -p ~/.ssh && chmod 700 ~/.ssh | |
| printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519 | |
| chmod 600 ~/.ssh/id_ed25519 | |
| ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub | |
| chmod 644 ~/.ssh/id_ed25519.pub | |
| printf 'Host *\n StrictHostKeyChecking accept-new\n UserKnownHostsFile ~/.ssh/known_hosts\n' > ~/.ssh/config | |
| chmod 600 ~/.ssh/config | |
| # The deploy runs each site's own `build` command, which clones the | |
| # library repositories — so nothing is prebuilt here. | |
| - name: Deploy (production) | |
| env: | |
| HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }} | |
| PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }} | |
| PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }} | |
| run: bunx --bun @stacksjs/ts-cloud deploy --env production --yes |