deploy.yml

name: Deploy

# Push-to-deploy for ts-maps.stacksjs.com: the docs, and the core-map
# playground at /playground/.
#
# This project ATTACHES to the shared box owned by the `stacks` project
# (cloud.config.ts sets `cloud.attachTo: 'stacks'`), so it never provisions:
# it builds its sites and ships only those onto the existing box.
on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
    steps:
      # Until the repository has its deploy secrets, say so and stop, rather
      # than fail every push to main.
      - name: Check deploy secrets
        id: secrets
        run: |
          if [ -z "$HCLOUD_TOKEN" ] || [ -z "$CLOUDFLARE_API_TOKEN" ] || [ -z "$DEPLOY_SSH_KEY" ]; then
            echo "::notice::Skipping deploy: set HCLOUD_TOKEN, CLOUDFLARE_API_TOKEN and DEPLOY_SSH_KEY in the repository's secrets."
            echo "ready=false" >> "$GITHUB_OUTPUT"
          else
            echo "ready=true" >> "$GITHUB_OUTPUT"
          fi

      - if: steps.secrets.outputs.ready == 'true'
        uses: actions/checkout@v4

      - if: steps.secrets.outputs.ready == 'true'
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - if: steps.secrets.outputs.ready == 'true'
        run: bun install

      # ts-cloud reaches the shared box over SSH (hetzner.sshPrivateKeyPath).
      # DEPLOY_SSH_KEY is a passphrase-less ed25519 key authorized on the box;
      # ssh-keygen cannot derive the public half of a passphrase-protected key
      # without a prompt. accept-new, so the first connection is not one either.
      - name: Add deploy SSH key
        if: steps.secrets.outputs.ready == 'true'
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub
          chmod 644 ~/.ssh/id_ed25519.pub
          printf 'Host *\n  StrictHostKeyChecking accept-new\n  UserKnownHostsFile ~/.ssh/known_hosts\n' > ~/.ssh/config
          chmod 600 ~/.ssh/config

      # Each site's `build` runs as part of the deploy, so nothing is prebuilt.
      - name: Deploy (production)
        if: steps.secrets.outputs.ready == 'true'
        run: bun run deploy