fix: debug deploy workflow

Author: bramstroker

.github/workflows/deploy-website.yml

@@ -55,25 +55,49 @@ jobs:
           WEBSITE_SSH_PORT: ${{ secrets.WEBSITE_SSH_PORT || '22' }}
           WEBSITE_SSH_USER: ${{ secrets.WEBSITE_SSH_USER }}
           WEBSITE_DEPLOY_PATH: ${{ secrets.WEBSITE_DEPLOY_PATH }}
+          WEBSITE_RSYNC_USE_SUDO: ${{ secrets.WEBSITE_RSYNC_USE_SUDO || 'false' }}
         run: |
           set -euo pipefail
 
-          for variable in WEBSITE_SSH_HOST WEBSITE_SSH_PORT WEBSITE_SSH_USER WEBSITE_DEPLOY_PATH; do
+          for variable in WEBSITE_SSH_HOST WEBSITE_SSH_PORT WEBSITE_SSH_USER WEBSITE_DEPLOY_PATH WEBSITE_RSYNC_USE_SUDO; do
             if [ -z "${!variable}" ]; then
               echo "Missing ${variable} secret" >&2
               exit 1
             fi
           done
 
-          ssh -i ~/.ssh/deploy_key \
-            -p "${WEBSITE_SSH_PORT}" \
-            -o IdentitiesOnly=yes \
-            -o StrictHostKeyChecking=yes \
-            "${WEBSITE_SSH_USER}@${WEBSITE_SSH_HOST}" \
-            "mkdir -p '${WEBSITE_DEPLOY_PATH}'"
+          if [ "${WEBSITE_RSYNC_USE_SUDO}" != "true" ] && [ "${WEBSITE_RSYNC_USE_SUDO}" != "false" ]; then
+            echo "WEBSITE_RSYNC_USE_SUDO must be either 'true' or 'false'" >&2
+            exit 1
+          fi
+
+          remote_path="$(printf '%q' "${WEBSITE_DEPLOY_PATH}")"
+          ssh_options=(
+            -i ~/.ssh/deploy_key
+            -p "${WEBSITE_SSH_PORT}"
+            -o IdentitiesOnly=yes
+            -o StrictHostKeyChecking=yes
+          )
+          rsync_options=(
+            -az
+            --delete
+            --itemize-changes
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r
+            -e "ssh -i ~/.ssh/deploy_key -p ${WEBSITE_SSH_PORT} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+          )
+
+          if [ "${WEBSITE_RSYNC_USE_SUDO}" = "true" ]; then
+            ssh "${ssh_options[@]}" "${WEBSITE_SSH_USER}@${WEBSITE_SSH_HOST}" "sudo mkdir -p ${remote_path}"
+            rsync_options+=(--rsync-path="sudo rsync")
+          else
+            ssh "${ssh_options[@]}" "${WEBSITE_SSH_USER}@${WEBSITE_SSH_HOST}" "mkdir -p ${remote_path}"
+            ssh "${ssh_options[@]}" "${WEBSITE_SSH_USER}@${WEBSITE_SSH_HOST}" "test -w ${remote_path}" || {
+              echo "Deploy path is not writable by ${WEBSITE_SSH_USER}: ${WEBSITE_DEPLOY_PATH}" >&2
+              echo "Fix by chowning the deploy path to ${WEBSITE_SSH_USER}, or set WEBSITE_RSYNC_USE_SUDO=true and allow passwordless sudo for rsync/mkdir." >&2
+              exit 1
+            }
+          fi
 
-          rsync -az --delete \
-            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
-            -e "ssh -i ~/.ssh/deploy_key -p ${WEBSITE_SSH_PORT} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
+          rsync "${rsync_options[@]}" \
             website/ \
             "${WEBSITE_SSH_USER}@${WEBSITE_SSH_HOST}:${WEBSITE_DEPLOY_PATH}/"