luxick
aea3aa47ae
There is only one server. The site is served from /var/www/mcg on the VPS at mcg.luxick.de today, and the main domain will be pointed at the same instance at cutover; local `hugo server` covers development. Drops the development/production split from the workflow, its DEPLOY_PATH_DEV / DEPLOY_PATH_PROD secrets and the workflow_dispatch environment input, leaving a single DEPLOY_PATH. baseURL now comes from hugo.toml rather than being injected per environment, so it is the one place to change at cutover. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
80 lines
2.7 KiB
YAML
80 lines
2.7 KiB
YAML
name: Build & Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch: # manual re-deploy of the current main
|
|
|
|
env:
|
|
HUGO_VERSION: '0.164.0'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # Hugo reads git info for lastmod
|
|
|
|
- name: Install Hugo ${{ env.HUGO_VERSION }}
|
|
run: |
|
|
set -euo pipefail
|
|
curl -sSL -o /tmp/hugo.deb \
|
|
"https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_linux-amd64.deb"
|
|
sudo dpkg -i /tmp/hugo.deb
|
|
hugo version
|
|
|
|
# baseURL comes from hugo.toml - that is the single place to change when
|
|
# the site moves to its final domain.
|
|
- name: Build
|
|
run: |
|
|
set -euo pipefail
|
|
hugo --gc --minify
|
|
|
|
# Pull requests are built to catch breakage, but never published.
|
|
- name: Deploy
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# rsync runs with --delete, so the destination becomes an exact mirror
|
|
# of public/. Refuse to run against an unset, root or shallow path.
|
|
case "${DEPLOY_PATH:-}" in
|
|
""|"/"|"/root"|"/home"|"/var"|"/etc"|"/usr"|"/srv"|"/opt")
|
|
echo "::error::DEPLOY_PATH is unset or unsafe: '${DEPLOY_PATH:-}'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [ "$(printf '%s' "$DEPLOY_PATH" | tr -cd '/' | wc -c)" -lt 2 ]; then
|
|
echo "::error::DEPLOY_PATH '$DEPLOY_PATH' is too shallow to delete into" >&2
|
|
exit 1
|
|
fi
|
|
if [ ! -f public/index.html ]; then
|
|
echo "::error::public/index.html missing - refusing to deploy an empty build" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sudo apt-get update -qq && sudo apt-get install -y -qq rsync openssh-client
|
|
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/id_deploy
|
|
chmod 600 ~/.ssh/id_deploy
|
|
printf '%s\n' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
|
chmod 644 ~/.ssh/known_hosts
|
|
|
|
rsync -az --delete --checksum \
|
|
-e "ssh -i ~/.ssh/id_deploy -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
|
|
public/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/"
|
|
|
|
rm -f ~/.ssh/id_deploy
|