deployments.yaml

name: Deployments
on:
  push:
    branches: [main, production]
jobs:
  deploy-environment:
    concurrency:
      group: deploy-${{ matrix.environment }}
      cancel-in-progress: false
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - environment: staging
            host: tracker-staging.security.nixos.org
            branch: main
          - environment: production
            host: tracker.security.nixos.org
            branch: production
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: NixOS/nix-installer-action@228d8a956062db04221c97c2794ea443194824aa # 2.34.0beta
      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
      - name: Trust server public SSH host keys
        run: cat ./infra/host_keys >> ~/.ssh/known_hosts
      - name: Deploy to ${{ matrix.environment }}
        if: github.ref_name == matrix.branch
        run: |
          nix-build -A ci
          result/bin/deploy switch ${{ matrix.host }}