deploy-site.yml

name: Deploy site

on:
  push:
    branches:
      - main
  pull_request_target:
    branches:
      - main
jobs:
  build:
    name: Build site
    runs-on: ubuntu-latest

    steps:
      - name: Check-out (Production)
        uses: actions/checkout@v4
        if: github.event_name == 'push'

      - name: Check-out (Staging)
        uses: actions/checkout@v4
        if: github.event_name == 'pull_request_target'
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Install dependencies
        run: pnpm install

      - name: Build
        run: pnpm run build

      - uses: actions/upload-artifact@v4
        with:
          name: site-build
          path: dist
          if-no-files-found: error
          include-hidden-files: true

  deploy-production:
    name: Deploy to Production
    needs: [build]
    if: ${{ (github.ref == 'refs/heads/main') && (github.event_name == 'push') }}
    runs-on: ubuntu-latest
    environment:
      name: production
      url: "https://jb3.dev/"

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: site-build
          path: dist

      - name: Tailscale
        uses: tailscale/github-action@v2
        with:
          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
          tags: tag:ci

      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh/
          echo "$SSH_KEY" > ~/.ssh/production.key
          chmod 600 ~/.ssh/production.key
          cat >>~/.ssh/config <<END
          Host production
            HostName $SSH_HOST
            User ci
            IdentityFile ~/.ssh/production.key
            StrictHostKeyChecking no
          END
        env:
          SSH_KEY: ${{ secrets.DEPLOYMENT_SSH_KEY }}
          SSH_HOST: ${{ vars.DEPLOYMENT_HOST }}

      - name: Deploy to deployment host
        run: rsync -a --delete dist/ production:/usr/share/nginx/jb3.dev/

      - name: Logout from Tailscale & delete ephemeral node
        run: sudo tailscale logout

  deploy-staging:
    name: Deploy to Staging
    needs: [build]
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request_target'
    environment:
      name: staging
      url: "https://${{ steps.slug.outputs.branch-name-slug }}.blog-staging.jb3.dev/"

    steps:
      - name: Generate slug for deployment name
        uses: gacts/github-slug@v1
        id: slug

      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: site-build
          path: dist

      - name: Tailscale
        uses: tailscale/github-action@v2
        with:
          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
          tags: tag:ci

      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh/
          echo "$SSH_KEY" > ~/.ssh/production.key
          chmod 600 ~/.ssh/production.key
          cat >>~/.ssh/config <<END
          Host production
            HostName $SSH_HOST
            User ci
            IdentityFile ~/.ssh/production.key
            StrictHostKeyChecking no
          END
        env:
          SSH_KEY: ${{ secrets.DEPLOYMENT_SSH_KEY }}
          SSH_HOST: ${{ vars.DEPLOYMENT_HOST }}

      - name: Deploy to deployment host
        run: rsync -a --delete dist/ production:/usr/share/nginx/jb3.dev-staging/${{ steps.slug.outputs.branch-name-slug }}

      - name: Logout from Tailscale & delete ephemeral node
        run: sudo tailscale logout