deploy.yml

name: Deploy static site

on:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: deploy-static-site
  cancel-in-progress: true

jobs:
  deploy:
    name: Build and deploy
    runs-on: ubuntu-latest

    env:
      DEPLOY_HOST: ${{ secrets.DASHBOARD_DEPLOY_HOST }}
      DEPLOY_USER: ${{ secrets.DASHBOARD_DEPLOY_USER }}
      DEPLOY_KEY: ${{ secrets.DASHBOARD_DEPLOY_KEY }}
      DEPLOY_PATH: ${{ secrets.DASHBOARD_DEPLOY_PATH }}
      DEPLOY_PORT: ${{ secrets.DASHBOARD_DEPLOY_PORT || '22' }}

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.8.1

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build static files
        run: pnpm run build

      - name: Configure SSH
        shell: bash
        run: |
          set -euo pipefail

          test -n "$DEPLOY_HOST"
          test -n "$DEPLOY_USER"
          test -n "$DEPLOY_KEY"
          test -n "$DEPLOY_PATH"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts

      - name: Replace Caddy static files
        shell: bash
        run: |
          set -euo pipefail

          SSH_TARGET="${DEPLOY_USER}@${DEPLOY_HOST}"
          SSH_COMMAND="ssh -i ~/.ssh/deploy_key -p ${DEPLOY_PORT}"
          REMOTE_PATH="${DEPLOY_PATH%/}"

          $SSH_COMMAND "$SSH_TARGET" "mkdir -p '$REMOTE_PATH'"

          rsync -az --delete \
            --exclude 'links.json' \
            -e "$SSH_COMMAND" \
            dist/ "$SSH_TARGET:$REMOTE_PATH/"