deploy.yml

name: Build and maybe deploy to dothq.org

on:
    push:
        branches: ["production", "staging"]
    workflow_dispatch:

env:
    SERVER_ID: "32657111668989263"

jobs:
    build:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v3

            - name: Use Node.js
              uses: actions/setup-node@v3
              with:
                  node-version: 18.x

            - name: Install dependencies
              run: |
                  yarn

            - name: Build
              run: |
                  yarn build

    deploy:
        runs-on: ubuntu-latest
        needs: build
        if: github.ref == 'refs/heads/production'
        permissions:
            contents: read

        steps:
            - name: Checkout repository
              uses: actions/checkout@v3

            - name: Retrieve server hostname
              run: |
                  TS_JSON=$(curl "https://api.tailscale.com/api/v2/device/${{ env.SERVER_ID }}" -u "${{ secrets.TS_KEY }}:")
                  HOSTNAME=$(echo $TS_JSON | jq -r '.name')
                  echo "SERVER_HOSTNAME=$HOSTNAME" >> $GITHUB_ENV

            - name: Connect to Tailscale network
              uses: tailscale/github-action@v2
              with:
                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
                  oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
                  tags: tag:ci

            - name: Install SSH key
              run: |
                  install -m 600 -D /dev/null ~/.ssh/id_rsa
                  echo "${{ secrets.CI_PRIVATE_KEY }}" > ~/.ssh/id_rsa
                  ssh-keyscan -H ${{ env.SERVER_HOSTNAME }} > ~/.ssh/known_hosts

            - name: Connect over SSH and deploy
              run: |
                  ssh -t ci@${{ env.SERVER_HOSTNAME }} "cd /app && git pull && ./scripts/rebuild_docker.sh"

            - name: Nuke SSH keys
              run: rm -rf ~/.ssh