deploy.yml

name: "Deploy"

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      log_level:
        required: true
        type: string
      ssh_config:
        type: string
        default: ''
      ssh_known_hosts:
        type: string
        default: ''
      run_tests:
        type: boolean
        default: true
        description: >
          Re-run composer test before deploying. Defaults to true; set false in
          repos where the ref being deployed has already passed CI: Test, to skip
          the test run and the npm install that only exists to feed it.
    secrets:
      DEPLOY_SSH_PRIVATE_KEY:
        required: true
      NPM_FONTAWESOME_AUTH_TOKEN:
        required: true
      PACKAGIST_GITHUB_TOKEN:
        required: true
      YOAST_LICENSE_TOKEN:
        required: false

jobs:
  build_deploy:
    name: Build and deploy
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Start SSH agent
        uses: generoi/github-actions/ssh-agent@v1
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}

      - name: Setup project
        uses: generoi/github-actions/setup@v1
        with:
          npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
          packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}
          yoast_license_token: ${{ secrets.YOAST_LICENSE_TOKEN }}

      # Composer is always needed — dep and robo live in vendor/bin. npm is only
      # needed because composer test lints the front end, so it follows run_tests.
      - name: Install Composer dependencies
        run: composer install --no-interaction

      - name: Install npm dependencies
        if: inputs.run_tests
        run: npm install

      - name: Configure SSH
        if: inputs.ssh_config != ''
        env:
          SSH_CONFIG: ${{ inputs.ssh_config }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_CONFIG" >> ~/.ssh/config
          chmod 600 ~/.ssh/config

      - name: Add known hosts
        env:
          SSH_KNOWN_HOSTS: ${{ inputs.ssh_known_hosts }}
          DEPLOY_ENV: ${{ inputs.environment }}
        run: |
          if [ -n "$SSH_KNOWN_HOSTS" ]; then
            echo "$SSH_KNOWN_HOSTS" >> ~/.ssh/known_hosts
          else
            ssh-keyscan \
              -p $(yq ".env[\"@${DEPLOY_ENV}\"].port // 22" robo.yml) \
              $(yq ".env[\"@${DEPLOY_ENV}\"].host" robo.yml) >> ~/.ssh/known_hosts
          fi

      - name: Run tests
        if: inputs.run_tests
        run: composer test --no-interaction

      - name: Deploy
        env:
          DEPLOY_ENV: ${{ inputs.environment }}
          LOG_LEVEL: ${{ inputs.log_level }}
        run: ./vendor/bin/dep deploy "$DEPLOY_ENV" "$LOG_LEVEL"