preview.yml

name: Preview environment

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]
  delete:

permissions:
  contents: read
  packages: write
  pull-requests: write
  deployments: write
  id-token: write

# Cancel a superseded deploy when a new commit lands on the same PR,
# but never cancel a teardown — letting a `closed` event get cancelled
# would leave the preview app + databases orphaned on the host.
concurrency:
  group: kamal-previews-${{ github.event.pull_request.number || github.event.ref || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}

jobs:
  preview:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      # Optional: VPN tunnel if your deploy host is private.
      # - uses: <your-vpn-action>@v1
      #   with: { ... }

      - uses: web-ascender/github-actions-kamal-previews@v1
        with:
          base-deploy-file:    config/deploy.staging.yml
          base-secrets-file:   .kamal/secrets.staging
          domain-suffix:       preview.example.com
          deploy-host:         staging.example.com
          database-engine:     mysql
          databases: |
            DATABASE_URL=myapp_staging:myapp_{db_slug}
          image-tag: ${{ github.event.pull_request.head.sha }}
          memory-limit: "512m"
          cpu-limit:    "0.5"
        env:
          SSH_PRIVATE_KEY:    ${{ secrets.DEPLOY_SSH_KEY }}
          RAILS_MASTER_KEY:   ${{ secrets.STAGING_MASTER_KEY }}
          # Optional admin URL override when your app role lacks
          # CREATE DATABASE privilege.
          DATABASE_ADMIN_URL: ${{ secrets.DATABASE_ADMIN_URL }}