Merge pull request #231 from humhub/enh/consolidate-npm #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy documentation | |
| # Builds the Docusaurus site and deploys the static output to the web server | |
| # via rsync over SSH. Replaces the cron-based build.sh on the server: this runs | |
| # only when master actually changes (plus a manual trigger), instead of every | |
| # 15 minutes. | |
| # | |
| # Required repository secrets (Settings > Secrets and variables > Actions): | |
| # DEPLOY_SSH_KEY Private SSH key (ed25519) for the deploy user. The matching | |
| # public key goes into the deploy user's ~/.ssh/authorized_keys | |
| # on the server, ideally locked to rrsync, e.g.: | |
| # command="rrsync -wo <RRSYNC_ROOT>",restrict ssh-ed25519 AAAA... | |
| # DEPLOY_HOST Server hostname or IP | |
| # DEPLOY_USER Deploy user name on the server | |
| # DEPLOY_KNOWN_HOSTS Output of `ssh-keyscan -H <host>` — pins the server key so | |
| # the connection cannot be MITM'd. | |
| # Optional: | |
| # DEPLOY_PORT SSH port (defaults to 22) | |
| # DEPLOY_PATH Destination directory for the built site (defaults to "."). | |
| # See "How rrsync root and DEPLOY_PATH combine" below. | |
| # | |
| # How rrsync root and DEPLOY_PATH combine | |
| # --------------------------------------- | |
| # When the deploy key is locked to rrsync (recommended), rrsync confines rsync to | |
| # one directory — the "rrsync root", the path given in the authorized_keys line: | |
| # command="rrsync -wo <RRSYNC_ROOT>",restrict ssh-ed25519 AAAA... | |
| # rrsync then interprets DEPLOY_PATH *relative to that root* and joins the two. | |
| # The site is written to: <RRSYNC_ROOT>/<DEPLOY_PATH> | |
| # | |
| # IMPORTANT: DEPLOY_PATH must be relative. An absolute path (one starting with "/") | |
| # gets re-rooted under RRSYNC_ROOT and points nowhere, so rsync fails with | |
| # 'mkdir "..." failed: No such file or directory'. Use "." to write into the root | |
| # itself, or a sub-directory name to write one level below it. | |
| # | |
| # RRSYNC_ROOT (authorized_keys) DEPLOY_PATH writes to | |
| # ----------------------------- ----------- ----------------------------- | |
| # <root>/webroot . <root>/webroot (tightest) | |
| # <root> webroot <root>/webroot | |
| # <root> staging <root>/staging | |
| # | |
| # The RRSYNC_ROOT must already exist and be writable by the deploy user; rsync | |
| # only creates the final DEPLOY_PATH sub-directory, not missing parents. Prefer | |
| # jailing rrsync directly to the target dir (DEPLOY_PATH=".") so the key can | |
| # write nowhere else. Note: --delete removes anything in the target not present | |
| # in build/, so keep unrelated files (e.g. /.well-known) out of that directory. | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| # Never let two deploys run at once; if a newer push arrives, drop the older run. | |
| concurrency: | |
| group: deploy-docs | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| # Bind the deploy secrets to a protected environment so only this workflow, | |
| # running on master, can read them. Configure protection rules on the | |
| # "production" environment in the repo settings. | |
| environment: production | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install dependencies | |
| run: npm install | |
| - name: Refresh browser data | |
| run: npx update-browserslist-db@latest | |
| - name: Build | |
| run: npm run build | |
| - name: Set up SSH | |
| run: | | |
| mkdir -p ~/.ssh | |
| chmod 700 ~/.ssh | |
| printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key | |
| chmod 600 ~/.ssh/deploy_key | |
| printf '%s\n' "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts | |
| chmod 600 ~/.ssh/known_hosts | |
| - name: Deploy via rsync | |
| env: | |
| DEPLOY_PORT: ${{ secrets.DEPLOY_PORT || '22' }} | |
| DEPLOY_PATH: ${{ secrets.DEPLOY_PATH || '.' }} | |
| run: | | |
| rsync -az --delete \ | |
| -e "ssh -i ~/.ssh/deploy_key -p ${DEPLOY_PORT}" \ | |
| build/ "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${DEPLOY_PATH}/" | |
| - name: Clean up SSH key | |
| if: always() | |
| run: rm -f ~/.ssh/deploy_key |