deploy.yml

name: Deploy site

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    concurrency:
      group: deploy-site
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # design, mfe-framework and dhake are git submodules and the build
          # needs them checked out. (Previously submodules were not fetched, so
          # `mfe-framework/` was empty and the old `npm run build` recursed
          # into the site's own build script forever -> E2BIG.)
          submodules: true

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: "Build the site (dhake: elm + MFE vendor + SSG)"
        # The build is driven by dhake (./Dhakefile.dhall). `npm ci` above
        # provides the tooling dhake shells out to (elm, happy-dom, tsc in the
        # mfe-framework submodule). dhake.com is the committed bootstrap binary
        # shipped with the dhake submodule.
        run: ./dhake/dhake.com

      - name: Assemble deploy bundle
        run: |
          set -euo pipefail
          rm -rf /tmp/sitebundle
          mkdir -p /tmp/sitebundle/site
          cp index.html /tmp/sitebundle/site/
          cp -r shell vendor dist /tmp/sitebundle/site/
          tar -czf /tmp/sitebundle/site.tar.gz -C /tmp/sitebundle site
          ls -la /tmp/sitebundle/site.tar.gz

      - name: Deploy site via restricted SSH
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
        run: |
          set -euo pipefail
          umask 077
          mkdir -p ~/.ssh
          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          echo "$DEPLOY_HOST_KEY" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/deploy_key ~/.ssh/known_hosts
          cat /tmp/sitebundle/site.tar.gz | ssh -i ~/.ssh/deploy_key \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile=~/.ssh/known_hosts \
            "${DEPLOY_USER}@${DEPLOY_HOST}" 'cat > /dev/null'