ovh.yaml

name: Website Deploy

on:
  workflow_call:
    inputs:
      environment_name:
        required: true
        type: string
      url:
        required: false
        type: string
      target:
        required: false
        type: string
        default: 'www'
      action:
        required: false
        type: string
        default: 'deploy' # Or 'teardown'
    secrets:
      OVH_USERNAME:
        required: true
      OVH_HOSTNAME:
        required: true
      OVH_PASSWORD:
        required: true
      MIXXX_WEBSITE_ENV_CLEANUP_PAT:
        required: true

jobs:
  apply:
    name: ${{ format('{0} environment "{1}"', inputs.action == 'teardown' && 'Tearing down' || 'Deploying', inputs.environment_name) }}
    runs-on: ubuntu-latest
    concurrency:
      group: website-ovh-${{ inputs.target }}
    environment:
      name: ${{ inputs.environment_name }}
      url: ${{ inputs.url }}
    steps:
    - name: Forbid tearing down production
      if: ${{ inputs.target == 'www' && inputs.action == 'teardown' }}
      run: |
        echo "Tearing down production is not allowed!"
        exit 1
    - name: Check out repository
      if: ${{ inputs.action != 'teardown' }}
      uses: actions/checkout@v4.2.2
      with:
        fetch-depth: 0
    - name: Set up Python
      if: ${{ inputs.action != 'teardown' }}
      uses: actions/setup-python@v6
      with:
        python-version: 3.12
        cache: 'pip' # caching pip dependencies
    - name: Install Python dependencies
      if: ${{ inputs.action != 'teardown' }}
      run: |
        pip install -r requirements.txt
    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y lftp

    - name: Setup PR website HTACCESS
      if: ${{ inputs.target == 'www' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        MAIN_WEBSITE: ${{ vars.MAIN_WEBSITE }}
      run: |
        mkdir -p ${HOME}/.ssh/
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        cat > .htaccess <<EOF
        Options -Indexes
        ErrorDocument 403 https://${MAIN_WEBSITE}
        EOF
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} \
          -e "put .htaccess -o /home/${OVH_USERNAME}/pulls/.htaccess"

    - name: Build
      if: ${{ inputs.action != 'teardown' }}
      env:
        SITEURL: ${{ inputs.url }}
      run: |
        pelican -e SITEURL="\"$SITEURL\""
        sed -E '/\{% (end)?verbatim %\}/d' htaccess > ./output/.htaccess
        # Migrated from netlify.toml
        cat >> ./output/.htaccess <<EOF
        <IfModule mod_headers.c>
          # Global security headers
          Header set Content-Security-Policy "default-src 'self'; style-src 'self'; script-src 'self'"
          Header set Permissions-Policy "ambient-light-sensor=(); autoplay=(); accelerometer=(); camera=(); display-capture=(); document-domain=(); encrypted-media=(); fullscreen=(); gyroscope=(); magnetometer=(); microphone=(); midi=(); payment=(); picture-in-picture=(); sync-xhr=(); usb=(); wake-lock=(); xr-spatial-tracking=()"
          Header set Referrer-Policy "no-referrer-when-downgrade"
          Header set X-Content-Type-Options "nosniff"
          Header set X-Frame-Options "DENY"
          Header set X-XSS-Protection "1; mode=block"

          # Override CSP for /news/* pages
          SetEnvIf Request_URI "^/news/" is_news
          Header set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-UPkidoMErzWw1gW/eY4LhAi9ZkPch3PP31d6KQoJ6Yc=' 'sha256-G40wI6OaLZXCtrb02xUq1H1kEVWjstzoQ0FXKwsWxPw=' 'sha256-1CldwzdEg2k1wTmf7s5RWVd7NMXI/7nxxjJM2C4DqII=' https://mixxx.discourse.group/javascripts/embed.js *.discourse-cdn.com; frame-src 'self' https://www.youtube-nocookie.com https://mixxx.discourse.group ; img-src 'self' https://i.ytimg.com https://raw.githubusercontent.com/mixxxdj/ ; connect-src 'self' https://mixxx.discourse.group https://*.discourse-cdn.com" env=is_news
        </IfModule>
        EOF
        sed -E '/\{% (end)?verbatim %\}/d' content/robots.txt > ./output/robots.txt
    - name: Deploy website
      if: ${{ inputs.action != 'teardown' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        TARGET: ${{ inputs.target }}
      run: |
        set -exo pipefail
        mkdir -p ${HOME}/.ssh/
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} \
          -e "set sftp:connect-program \"ssh -o Compression=no\"; set mirror:parallel-transfer-count 16; set mirror:parallel-directories yes; mirror -vv --delete -P 16 -R ./output /home/${OVH_USERNAME}/${TARGET}; quit"

    - name: Delete website
      if: ${{ inputs.action == 'teardown' && inputs.target != 'www' }}
      env:
        OVH_USERNAME: ${{ secrets.OVH_USERNAME }}
        OVH_HOSTNAME: ${{ secrets.OVH_HOSTNAME }}
        LFTP_PASSWORD: ${{ secrets.OVH_PASSWORD }}
        TARGET: ${{ inputs.target }}
      run: |
        set -exo pipefail
        mkdir -p ${HOME}/.ssh/
        mkdir -p /tmp/ovh_sshfs
        mkdir empty
        ssh-keyscan "${OVH_HOSTNAME}" >> "${HOME}/.ssh/known_hosts"
        lftp --env-password -u ${OVH_USERNAME} sftp://${OVH_HOSTNAME} -e "set sftp:connect-program \"ssh -o Compression=no\"; set mirror:parallel-transfer-count 16; set mirror:parallel-directories yes; mirror -vv --delete -P 16 -R ./empty /home/${OVH_USERNAME}/${TARGET}; rmdir /home/${OVH_USERNAME}/${TARGET}; quit"

    - name: Deleting environment
      if: ${{ inputs.action == 'teardown' && inputs.target != 'www' }}
      env:
        ENVIRONMENT_NAME: ${{ inputs.environment_name }}
      uses: actions/github-script@v9
      with:
        github-token: ${{ secrets.MIXXX_WEBSITE_ENV_CLEANUP_PAT }}
        script: |
          const environment = process.env.ENVIRONMENT_NAME;

          try {

            await github.rest.repos.deleteAnEnvironment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              environment_name: environment,
            });

            console.log(`Deleted environment '${environment}'`);
          } catch (err) {
            if (err.status === 404) {
              console.log(`Environment '${environment}' does not exist.`);
            } else {
              throw err;
            }
          }