Refactor GitHub Actions for website deployment

Signed-off-by: TheCommCraft <79996518+TheCommCraft@users.noreply.github.com>

Author: TheCommCraft

.github/workflows/deploy-website.yml

@@ -39,35 +39,42 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install dependencies
+      - name: Install Python deps
         run: |
           python -m pip install --upgrade pip
           if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
           pip install cryptography scratchattach
 
-      - name: Generate Vercel secrets as environment variables (securely)
-        id: generate_vars
+      - name: Checkout website branch
+        uses: actions/checkout@v4
+        with:
+          ref: 'website'
+
+      # New single-step secure deploy:
+      - name: Generate Vercel token and deploy (keeps secrets in-step only)
         env:
           FERNET_KEY: ${{ secrets.FERNET_KEY }}
         run: |
+          set -euo pipefail
+
+          # run token generator and capture output into variables WITHOUT printing
+          # Adjust this read pattern if `python -m util vercel` emits a different format.
           cd tests
-          eval "$(python -m util vercel | awk '
-            NR==1 {print "echo \"vercel_token="$0"\" >> $GITHUB_ENV"}
-            NR==2 {print "echo \"org_id="$0"\" >> $GITHUB_ENV"}
-            NR==3 {print "echo \"project_id="$0"\" >> $GITHUB_ENV"}')"
+          IFS=$'\n' read -r VERCEL_TOKEN ORG_ID PROJECT_ID < <(python -m util vercel)
           cd ..
-        shell: bash
 
-      - name: Checkout website branch
-        uses: actions/checkout@v4
-        with:
-          ref: 'website'
+          # Mask the values so accidental prints later are redacted
+          echo "::add-mask::$VERCEL_TOKEN"
+          echo "::add-mask::$ORG_ID"
+          echo "::add-mask::$PROJECT_ID"
 
-      - uses: nexterias/actions-vercel@v1
-        id: vercel
-        with:
-          token: ${{ env.vercel_token }}
-          org-id: ${{ env.org_id }}
-          project-id: ${{ env.project_id }}
-          production: true
-          prebuilt: true
+          # Install node / vercel CLI (no global logs of the token)
+          curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
+          sudo apt-get install -y nodejs
+          npm install -g vercel
+
+          # Run Vercel deploy using the token only in this step (no exporting)
+          # Use --confirm so it won't prompt; adapt flags for your project.
+          cd website
+          vercel --token "$VERCEL_TOKEN" --prod --confirm --org "$ORG_ID" --scope "$ORG_ID" --force --local-config ./vercel.json -- --project "$PROJECT_ID"
+        shell: bash