ovh.yaml

name: Website Deploy

on:
  workflow_call:
    inputs:
      environment_name:
        required: true
        type: string
      url:
        required: false
        type: string
      target:
        required: false
        type: string
        default: 'www'
      action:
        required: false
        type: string
        default: 'deploy' # Or 'teardown'
      ref:
        required: false
        type: string
      approval_required:
        required: false
        type: boolean
        default: false
    secrets:
      OVH_USERNAME:
        required: true
      OVH_HOSTNAME:
        required: true
      OVH_PASSWORD:
        required: true

jobs:
  apply:
    runs-on: ubuntu-latest
    concurrency:
      group: website-ovh-${{ inputs.target }}
    environment:
      name: ${{ inputs.environment_name }}
      url: ${{ inputs.url }}
    steps:
    - name: Require maintainer approval
      if: ${{ inputs.action != 'teardown' && inputs.approval_required }}
      run: |
        echo "::error::Preview deploy requires a maintainer to add the 'preview-approved' label on this pull request."
        exit 1
    - name: Forbid tearing down production
      if: ${{ inputs.target == 'www' && inputs.action == 'teardown' }}
      run: |
        echo "Tearing down production is not allowed!"
        exit 1
    - name: Check out repository
      if: ${{ inputs.action != 'teardown' }}
      uses: actions/checkout@v4.2.2
      with:
        fetch-depth: 0
        ref: ${{ inputs.ref }}
    - name: Set up Python
      if: ${{ inputs.action != 'teardown' }}
      uses: actions/setup-python@v6
      with:
        python-version: 3.12
        cache: 'pip' # caching pip dependencies
    - name: Install Python dependencies
      if: ${{ inputs.action != 'teardown' }}
      run: |
        pip install -r requirements.txt
    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y lftp

    - name: Setup PR website HTACCESS
      if: ${{ inputs.target == 'www' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        MAIN_WEBSITE: ${{ vars.MAIN_WEBSITE }}
      run: |
        mkdir -p ${HOME}/.ssh/
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        cat > .htaccess <<EOF
        Options -ExecCGI -Indexes
        ErrorDocument 403 https://${MAIN_WEBSITE}

        RemoveHandler .php .phtml .phar .cgi .pl .py
        RemoveType .php .phtml .phar

        <FilesMatch "\.(php|phtml|phar|cgi|pl|py)$">
            Require all denied
        </FilesMatch>
        <IfModule mod_php.c>
            php_flag engine off
        </IfModule>
        EOF
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} \
          -e "put .htaccess -o /home/${OVH_USERNAME}/pulls/.htaccess"

    - name: Build
      if: ${{ inputs.action != 'teardown' }}
      env:
        SITEURL: ${{ inputs.url }}
      run: |
        pelican -e SITEURL="\"$SITEURL\""
        python tools/generate_htaccess.py \
          --template htaccess \
          --redirects content/_redirects \
          --netlify-config netlify.toml \
          --output ./output/.htaccess
        sed -E '/\{% (end)?verbatim %\}/d' content/robots.txt > ./output/robots.txt
    - name: Deploy website
      if: ${{ inputs.action != 'teardown' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        TARGET: ${{ inputs.target }}
      run: |
        set -exo pipefail
        mkdir -p ${HOME}/.ssh/
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} \
          -e "set sftp:connect-program \"ssh -o Compression=no\"; set mirror:parallel-transfer-count 16; set mirror:parallel-directories yes; mirror -vv --delete -P 16 -R ./output /home/${OVH_USERNAME}/${TARGET}; quit"

    - name: Delete website
      if: ${{ inputs.action == 'teardown' && inputs.target != 'www' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        TARGET: ${{ inputs.target }}
      run: |
        set -exo pipefail
        mkdir -p ${HOME}/.ssh/
        mkdir -p /tmp/ovh_sshfs
        mkdir empty
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} -e "set sftp:connect-program \"ssh -o Compression=no\"; set mirror:parallel-transfer-count 16; set mirror:parallel-directories yes; mirror -vv --delete -P 16 -R ./empty /home/${OVH_USERNAME}/${TARGET}; rmdir /home/${OVH_USERNAME}/${TARGET}; quit"