action.yml

name: SSH Archive Deploy
description: Inspect, build, report, apply, and rollback a scoped deployment archive over SSH.

inputs:
  mode:
    description: Deployment mode. Supported values are doctor, report, apply, and rollback.
    required: true
    default: report
  config:
    description: Path to the deploy.yml configuration.
    required: true
    default: deploy.yml
  archive:
    description: Path to the generated or existing archive.
    required: true
    default: dist/site.tar.gz
  report-dir:
    description: Directory where doctor or report artifacts are written.
    required: false
    default: dist/deploy-report
  rollback-release:
    description: Reserved rollback target input.
    required: false
    default: latest
  target-name:
    description: Non-secret target label required in doctor mode (for example preproduction).
    required: false
  ssh-host:
    description: SSH host.
    required: false
  ssh-user:
    description: SSH user.
    required: false
  ssh-port:
    description: SSH port.
    required: false
    default: "22"
  ssh-private-key:
    description: SSH private key content.
    required: false
  ssh-known-hosts:
    description: Known hosts content. Required by default for every SSH mode.
    required: false
  ssh-allow-host-key-discovery:
    description: Explicit permissive host-key discovery for doctor or report only.
    required: false
    default: "false"
outputs:
  release-id:
    description: Release id from the generated manifest.
    value: ${{ steps.export.outputs.release-id }}
  manifest-path:
    description: Manifest path written by the CLI.
    value: ${{ steps.export.outputs.manifest-path }}
  report-dir:
    description: Doctor or report directory.
    value: ${{ inputs.report-dir }}
  doctor-report:
    description: Doctor JSON report path in doctor mode.
    value: ${{ inputs.report-dir }}/doctor.json
  transaction-id:
    description: Transaction id written by apply or rollback.
    value: ${{ steps.export.outputs.transaction-id }}
  checkpoint-path:
    description: Remote checkpoint path written by apply or rollback.
    value: ${{ steps.export.outputs.checkpoint-path }}
  rollback-command:
    description: Rollback command hint for apply mode.
    value: ${{ steps.export.outputs.rollback-command }}

runs:
  using: composite
  steps:
    - name: Set up Python
      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: "3.12"

    - name: Install ssh-archive-deploy
      id: install
      shell: bash
      run: |
        set -euo pipefail

        if [ "${RUNNER_OS}" != "Linux" ] || [ "${RUNNER_ARCH}" != "X64" ]; then
          echo "Unsupported runner: ${RUNNER_OS}/${RUNNER_ARCH}" >&2
          exit 1
        fi

        asset="ssh-archive-deploy-linux-x86_64.pex"
        case "${CI_SOURCE_BUILD}" in
          true)
            action_path="$(cd "${ACTION_PATH}" && pwd -P)"
            workspace="$(cd "${WORKSPACE}" && pwd -P)"
            if [ "${EVENT_NAME}" != "pull_request" ] || [ "${action_path}" != "${workspace}" ]; then
              echo "CI source builds are restricted to pull requests using the local root Action." >&2
              exit 1
            fi

            binary="${action_path}/dist/release/${asset}"
            checksum="${binary}.sha256"
            if [ ! -x "${binary}" ] || [ ! -f "${checksum}" ]; then
              echo "CI source PEX or checksum is missing; build the current checkout first." >&2
              exit 1
            fi
            (
              cd "$(dirname "${binary}")"
              sha256sum --check "$(basename "${checksum}")"
            )
            "${binary}" doctor --help >/dev/null
            "${binary}" summarize-doctor --help >/dev/null
            echo "Using PEX built from the pull-request checkout: ${binary}"
            ;;
          false|"")
            version="$(
              python -c 'import pathlib,tomllib; print(tomllib.loads(pathlib.Path("'"$ACTION_PATH"'/pyproject.toml").read_text())["project"]["version"])'
            )"
            install_dir="$RUNNER_TEMP/ssh-archive-deploy"
            tag="v${version}"

            mkdir -p "$install_dir"

            gh release download "${tag}" \
              --repo "${ACTION_REPOSITORY}" \
              --pattern "${asset}" \
              --pattern "${asset}.sha256" \
              --dir "${install_dir}" \
              --clobber

            (
              cd "$install_dir"
              sha256sum --check "$asset.sha256"
            )

            tag_ref="repos/${ACTION_REPOSITORY}/git/ref/tags/${tag}"
            expected_source_digest="$(gh api "$tag_ref" --jq .object.sha)"
            tag_object_type="$(gh api "$tag_ref" --jq .object.type)"
            if [ "$tag_object_type" = "tag" ]; then
              expected_source_digest="$(
                gh api \
                  "repos/${ACTION_REPOSITORY}/git/tags/${expected_source_digest}" \
                  --jq .object.sha
              )"
            fi

            gh attestation verify "$install_dir/$asset" \
              --repo "${ACTION_REPOSITORY}" \
              --signer-workflow "${ACTION_REPOSITORY}/.github/workflows/release.yml" \
              --source-digest "${expected_source_digest}" \
              --deny-self-hosted-runners

            chmod +x "$install_dir/$asset"
            binary="$install_dir/$asset"
            ;;
          *)
            echo "SSH_ARCHIVE_DEPLOY_CI_SOURCE_BUILD must be true or false." >&2
            exit 1
            ;;
        esac

        echo "binary=${binary}" >> "$GITHUB_OUTPUT"
      env:
        ACTION_REPOSITORY: ${{ github.action_repository }}
        ACTION_PATH: ${{ github.action_path }}
        CI_SOURCE_BUILD: ${{ env.SSH_ARCHIVE_DEPLOY_CI_SOURCE_BUILD }}
        EVENT_NAME: ${{ github.event_name }}
        GH_TOKEN: ${{ github.token }}
        WORKSPACE: ${{ github.workspace }}

    - name: Configure SSH
      id: ssh
      shell: bash
      run: |
        set -euo pipefail
        mkdir -p "$RUNNER_TEMP/ssh"
        chmod 700 "$RUNNER_TEMP/ssh"

        if [ -n "${SSH_PRIVATE_KEY}" ]; then
          printf '%s\n' "$SSH_PRIVATE_KEY" > "$RUNNER_TEMP/ssh/deploy_key"
          chmod 600 "$RUNNER_TEMP/ssh/deploy_key"
          echo "SSH_PRIVATE_KEY_FILE=$RUNNER_TEMP/ssh/deploy_key" >> "$GITHUB_ENV"
        fi

        if [ -n "${SSH_KNOWN_HOSTS}" ]; then
          printf '%s\n' "$SSH_KNOWN_HOSTS" > "$RUNNER_TEMP/ssh/known_hosts"
          chmod 600 "$RUNNER_TEMP/ssh/known_hosts"
          echo "SSH_KNOWN_HOSTS_FILE=$RUNNER_TEMP/ssh/known_hosts" >> "$GITHUB_ENV"
        fi
      env:
        SSH_PRIVATE_KEY: ${{ inputs.ssh-private-key }}
        SSH_KNOWN_HOSTS: ${{ inputs.ssh-known-hosts }}

    - name: Build archive
      if: ${{ inputs.mode == 'report' || inputs.mode == 'apply' }}
      shell: bash
      run: |
        set -euo pipefail
        "$SSH_ARCHIVE_DEPLOY_BIN" build \
          --config "${CONFIG}" \
          --output "${ARCHIVE}"
      env:
        CONFIG: ${{ inputs.config }}
        ARCHIVE: ${{ inputs.archive }}
        PEX_ROOT: ${{ runner.temp }}/ssh-archive-deploy-pex
        SSH_ARCHIVE_DEPLOY_BIN: ${{ steps.install.outputs.binary }}

    - name: Run mode
      shell: bash
      run: |
        set -euo pipefail

        discovery_args=()
        case "${ALLOW_HOST_KEY_DISCOVERY}" in
          false)
            ;;
          true)
            case "${MODE}" in
              doctor|report)
                discovery_args+=(--allow-host-key-discovery)
                ;;
              *)
                echo "Host-key discovery is only allowed in doctor or report mode." >&2
                exit 2
                ;;
            esac
            ;;
          *)
            echo "ssh-allow-host-key-discovery must be true or false." >&2
            exit 2
            ;;
        esac

        case "${MODE}" in
          doctor)
            if [ -z "${TARGET_NAME}" ]; then
              echo "target-name is required in doctor mode." >&2
              exit 2
            fi
            "$SSH_ARCHIVE_DEPLOY_BIN" doctor \
              --config "${CONFIG}" \
              --target-name "${TARGET_NAME}" \
              --output "${REPORT_DIR}/doctor.json" \
              "${discovery_args[@]}"
            ;;
          report)
            "$SSH_ARCHIVE_DEPLOY_BIN" report \
              --config "${CONFIG}" \
              --archive "${ARCHIVE}" \
              --output-dir "${REPORT_DIR}" \
              "${discovery_args[@]}"
            ;;
          apply)
            "$SSH_ARCHIVE_DEPLOY_BIN" apply \
              --config "${CONFIG}" \
              --archive "${ARCHIVE}" \
              --result-json "${RESULT_JSON}"
            ;;
          rollback)
            "$SSH_ARCHIVE_DEPLOY_BIN" rollback \
              --config "${CONFIG}" \
              --release "${ROLLBACK_RELEASE}" \
              --result-json "${RESULT_JSON}"
            ;;
          *)
            echo "Unsupported mode: ${MODE}" >&2
            exit 2
            ;;
        esac
      env:
        MODE: ${{ inputs.mode }}
        CONFIG: ${{ inputs.config }}
        ARCHIVE: ${{ inputs.archive }}
        REPORT_DIR: ${{ inputs.report-dir }}
        TARGET_NAME: ${{ inputs.target-name }}
        ALLOW_HOST_KEY_DISCOVERY: ${{ inputs.ssh-allow-host-key-discovery }}
        ROLLBACK_RELEASE: ${{ inputs.rollback-release }}
        RESULT_JSON: ${{ runner.temp }}/ssh-archive-deploy-result.json
        SSH_HOST: ${{ inputs.ssh-host }}
        SSH_USER: ${{ inputs.ssh-user }}
        SSH_PORT: ${{ inputs.ssh-port }}
        PEX_ROOT: ${{ runner.temp }}/ssh-archive-deploy-pex
        SSH_ARCHIVE_DEPLOY_BIN: ${{ steps.install.outputs.binary }}

    - name: Write read-only summary
      if: ${{ inputs.mode == 'doctor' || inputs.mode == 'report' }}
      shell: bash
      run: |
        set -euo pipefail

        if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
          case "${MODE}" in
            doctor)
              "$SSH_ARCHIVE_DEPLOY_BIN" summarize-doctor \
                --report "${REPORT_DIR}/doctor.json" \
                --format github >> "$GITHUB_STEP_SUMMARY"
              ;;
            report)
              "$SSH_ARCHIVE_DEPLOY_BIN" summarize-report \
                --report "${REPORT_DIR}/report.json" \
                --format github >> "$GITHUB_STEP_SUMMARY"
              ;;
          esac
        fi
      env:
        MODE: ${{ inputs.mode }}
        REPORT_DIR: ${{ inputs.report-dir }}
        PEX_ROOT: ${{ runner.temp }}/ssh-archive-deploy-pex
        SSH_ARCHIVE_DEPLOY_BIN: ${{ steps.install.outputs.binary }}

    - name: Export outputs
      id: export
      shell: bash
      run: |
        set -euo pipefail
        if [ -f "${ARCHIVE}.manifest.json" ]; then
          release_id="$(python -c 'import json,sys; print(json.load(open(sys.argv[1]))["release_id"])' "${ARCHIVE}.manifest.json")"
          echo "release-id=${release_id}" >> "$GITHUB_OUTPUT"
          echo "manifest-path=${ARCHIVE}.manifest.json" >> "$GITHUB_OUTPUT"
        fi
        if [ -f "${RESULT_JSON}" ]; then
          result_release_id="$(python -c 'import json,sys; print(json.load(open(sys.argv[1])).get("release_id", ""))' "${RESULT_JSON}")"
          transaction_id="$(python -c 'import json,sys; print(json.load(open(sys.argv[1])).get("transaction_id", ""))' "${RESULT_JSON}")"
          checkpoint_path="$(python -c 'import json,sys; print(json.load(open(sys.argv[1])).get("checkpoint_path", ""))' "${RESULT_JSON}")"
          rollback_command="$(python -c 'import json,sys; print(json.load(open(sys.argv[1])).get("rollback_command", ""))' "${RESULT_JSON}")"
          if [ ! -f "${ARCHIVE}.manifest.json" ]; then
            echo "release-id=${result_release_id}" >> "$GITHUB_OUTPUT"
          fi
          echo "transaction-id=${transaction_id}" >> "$GITHUB_OUTPUT"
          echo "checkpoint-path=${checkpoint_path}" >> "$GITHUB_OUTPUT"
          echo "rollback-command=${rollback_command}" >> "$GITHUB_OUTPUT"
        fi
      env:
        ARCHIVE: ${{ inputs.archive }}
        RESULT_JSON: ${{ runner.temp }}/ssh-archive-deploy-result.json