deploy.yaml

name: deploy

on:
  push:
    branches:
      - main
    paths-ignore:
      - "*.md"
  workflow_dispatch:
    inputs:
      tag:
        description: "Deployment tag"
        required: true
        type: choice
        default: "main"
        options:
          - main
          - dev

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: nixbuild/nix-quick-install-action@v34
        with:
          nix_version: 2.31.2

      - name: Generate cache key
        run: |
          nixpkgs_hash=$(grep -Eom1 'archive/[0-9a-f]{40}\.tar\.gz' shell.nix | cut -d'/' -f2 | cut -d'.' -f1)
          echo "NIXPKGS_HASH=$nixpkgs_hash" >> $GITHUB_ENV
          echo "CACHE_KEY=${{ runner.os }}-$nixpkgs_hash" >> $GITHUB_ENV

      - uses: nix-community/cache-nix-action@v7
        with:
          primary-key: nix-${{ env.CACHE_KEY }}

      - name: Setup NIX_PATH
        run: |
          path=$(nix eval --impure --expr "(import (fetchTarball \"https://github.com/NixOS/nixpkgs/archive/${{ env.NIXPKGS_HASH }}.tar.gz\") {}).path")
          echo "NIX_PATH=nixpkgs=$path" >> $GITHUB_ENV

      - name: Get cache directories
        id: cache-dirs
        run: |
          nix-shell -p uv --run "
            echo \"UV_CACHE=\$(uv cache dir)\"
          " | tee -a $GITHUB_OUTPUT

      - name: Cache files and packages
        uses: actions/cache@v4
        with:
          key: pkg-${{ env.CACHE_KEY }}-${{ hashFiles('uv.lock') }}
          path: |
            ${{ steps.cache-dirs.outputs.UV_CACHE }}
            .venv

      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id && chmod 600 ~/.ssh/id
          echo "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          echo "Host remote
            HostName ${{ secrets.SSH_HOST }}
            User ${{ secrets.SSH_USER }}
            Port ${{ secrets.SSH_PORT }}
            IdentityFile ~/.ssh/id
          " > ~/.ssh/config

      - name: Deploy on remote
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            tag="${{ inputs.tag }}"
          else
            tag=dev
          fi

          printf '::group::Build image streamer (%s)\n' "$tag"
          nix-shell --pure --run true
          image_streamer=$(TAG="$tag" nix-build --no-out-link)
          printf '::endgroup::\n'

          printf '::group::Stream image to remote Docker\n'
          "$image_streamer" | ssh remote 'docker load'
          printf '::endgroup::\n'

          printf '::group::Deploy on remote\n'
          ssh remote <<\EOF
            set -e
            if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
              tag="${{ inputs.tag }}"
            else
              tag=dev
            fi

            echo "Fetching latest changes from the git repository"
            cd "$tag"
            git fetch origin main
            git reset --hard origin/main

            echo "Restarting containers"
            docker compose down --remove-orphans
            TAG="$tag" docker compose --env-file "envs/compose/$tag.env" up -d

            echo "Pruning dangling images"
            docker image prune -f
          EOF
          printf '::endgroup::\n'