deploy-selfhosted.yml

name: Deploy to self-hosted server

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci
      - run: npm run build

      - name: Prepare SSH
        shell: bash
        run: |
          set -euo pipefail
          install -m 700 -d ~/.ssh
          printf '%s' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s' "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts

      - name: Upload and switch release
        shell: bash
        run: |
          set -euo pipefail
          release="${{ secrets.DEPLOY_PATH }}/releases/${GITHUB_SHA}"

          rsync -az --delete \
            -e "ssh -i ~/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=yes" \
            dist/ \
            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${release}/"

          ssh -i ~/.ssh/id_ed25519 -o BatchMode=yes -o StrictHostKeyChecking=yes \
            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "ln -sfn '${release}' '${{ secrets.DEPLOY_PATH }}/current' && ls -dt '${{ secrets.DEPLOY_PATH }}/releases/'* | tail -n +6 | xargs -r rm -rf"