deploy.yml

# Deploy the dhake docs site to dhake.fixpointlinux.org (node-infra) on push.
#
# The site is an Elm app (src/Main.elm) rendered against the shared Fixpoint.*
# design package (the `design` submodule) and pre-rendered to a static
# dist/index.html by `npm run build` (elm make + scripts/ssg.mjs). The workflow
# builds it, assembles a deploy tarball from dist/, and ships it over restricted
# SSH to node-infra's dhake-receive forced command (stages + promotes to
# /srv/www/dhake, served by Caddy on dhake.fixpointlinux.org).
name: Deploy dhake site

on:
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-dhake
  cancel-in-progress: false

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          # The Elm app imports the Fixpoint.* design package from the `design`
          # git submodule, so it must be checked out for the build.
          submodules: recursive

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: "Build the docs site (dhake: elm + MFE vendor + SSG)"
        # The build is driven by dhake (./Dhakefile.dhall, dist/index.html
        # target). `npm ci` above provides the tooling dhake shells out to
        # (elm, happy-dom, tsc in the mfe-framework submodule). dhake.com is
        # the committed bootstrap binary in this repo.
        run: |
          npm ci
          ./dhake.com dist/index.html

      - name: Assemble deploy bundle
        run: |
          set -euo pipefail
          rm -rf /tmp/dhakepkg
          mkdir -p /tmp/dhakepkg/site
          cp -r dist/. /tmp/dhakepkg/site/
          tar -czf /tmp/dhakepkg/dhake.tar.gz -C /tmp/dhakepkg site
          ls -la /tmp/dhakepkg/dhake.tar.gz

      - name: Deploy via restricted SSH
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
        run: |
          set -euo pipefail
          umask 077
          mkdir -p ~/.ssh
          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          echo "$DEPLOY_HOST_KEY" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/deploy_key ~/.ssh/known_hosts
          cat /tmp/dhakepkg/dhake.tar.gz | ssh -i ~/.ssh/deploy_key \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile=~/.ssh/known_hosts \
            "${DEPLOY_USER}@${DEPLOY_HOST}" 'cat > /dev/null'