Cleanup alternative download page #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Simple workflow for deploying static content to GitHub Pages | |
| name: Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| # Allow only one concurrent deployment | |
| concurrency: | |
| group: "pages" | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Setup Hugo | |
| uses: peaceiris/actions-hugo@v2 | |
| with: | |
| hugo-version: '0.121.1' | |
| extended: true | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: | | |
| npm install -g minify | |
| sudo apt-get update | |
| sudo apt-get install -y imagemagick | |
| - name: Build with Hugo | |
| run: | | |
| if [ "${{ github.ref_name }}" = 'main' ]; then | |
| echo "Building production site..." | |
| HUGO_ENV=production hugo --minify --gc --baseURL "https://kubuntu.org" | |
| elif [ "${{ github.ref_name }}" = 'develop' ]; then | |
| echo "Building testing site..." | |
| hugo --minify --gc --baseURL "https://kubuntu-team.github.io/kubuntu.org" | |
| else | |
| echo "This workflow is restricted to main or develop. Exiting." | |
| exit 1 | |
| fi | |
| - name: Upload via SFTP to Production | |
| if: github.ref_name == 'main' | |
| env: | |
| SFTP_USER: ${{ vars.SFTP_USER }} | |
| SFTP_HOST: ${{ vars.SFTP_HOST }} | |
| SFTP_PORT: ${{ vars.SFTP_PORT }} | |
| SFTP_TARGET_DIR: ${{ vars.SFTP_TARGET_DIR }} | |
| SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} | |
| run: | | |
| set -euo pipefail | |
| : "${SFTP_USER:?GitHub variable SFTP_USER is required}" | |
| : "${SFTP_HOST:?GitHub variable SFTP_HOST is required}" | |
| : "${SFTP_PORT:=22}" | |
| : "${SSH_PRIVATE_KEY:?GitHub secret SSH_PRIVATE_KEY is required}" | |
| : "${SFTP_TARGET_DIR:=data/}" | |
| mkdir -p "$HOME/.ssh" | |
| chmod 700 "$HOME/.ssh" | |
| echo "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key" | |
| chmod 600 "$HOME/.ssh/deploy_key" | |
| # Ensure sensitive files are cleaned up on exit (success or failure) | |
| cleanup() { rm -f "$HOME/.ssh/deploy_key" lftp.cmd || true; } | |
| trap cleanup EXIT | |
| # Preload known_hosts to avoid interactive prompt | |
| ssh-keyscan -p "$SFTP_PORT" -t rsa,ecdsa,ed25519 "$SFTP_HOST" >> "$HOME/.ssh/known_hosts" | |
| chmod 644 "$HOME/.ssh/known_hosts" | |
| # Use lftp in sftp mode because the server is SFTP-only (no shell) | |
| # https://lftp.yar.ru/lftp-man.html | |
| sudo apt-get update && sudo apt-get install -y lftp | |
| # Create lftp script for robust sync | |
| # NOTE: no quotes around EOF so shell variables expand here | |
| cat > lftp.cmd <<EOF | |
| set sftp:auto-confirm yes | |
| set net:max-retries 2 | |
| set net:timeout 20 | |
| set net:reconnect-interval-base 5 | |
| set net:persist-retries 1 | |
| # Force key-only auth; prevent any password prompt | |
| set sftp:connect-program "ssh -i $HOME/.ssh/deploy_key -oBatchMode=yes -oPubkeyAuthentication=yes -oPasswordAuthentication=no -oKbdInteractiveAuthentication=no -oStrictHostKeyChecking=yes -p $SFTP_PORT" | |
| # Ensure remote target exists, then cd into it | |
| mkdir -p "$SFTP_TARGET_DIR" | |
| cd "$SFTP_TARGET_DIR" | |
| # Upload contents of ./public into remote ./data and delete remote extras | |
| mirror -R --delete --parallel=4 --verbose ./public . | |
| bye | |
| EOF | |
| # Connect with key auth; pass empty password to avoid GetPass | |
| lftp -u "$SFTP_USER," -p "$SFTP_PORT" -e "source lftp.cmd; bye" sftp://"$SFTP_HOST" | |
| # Explicit cleanup after successful transfer | |
| rm -f "$HOME/.ssh/deploy_key" lftp.cmd || true | |
| - name: Upload artifact | |
| uses: actions/upload-pages-artifact@v3 | |
| with: | |
| path: ./public | |
| deploy: | |
| environment: | |
| name: ${{ github.ref_name == 'main' && 'production' || 'testing' }} | |
| url: ${{ github.ref_name == 'main' && 'https://kubuntu.org' || 'https://kubuntu-team.github.io/kubuntu.org' }} | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Deploy to ${name} | |
| id: deployment | |
| uses: actions/deploy-pages@v4 | |
| - name: Notify on success | |
| if: success() && github.event_name == 'push' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const environment = '${{ github.ref_name == 'main' && 'production' || 'testing' }}'; | |
| const url = '${{ github.ref_name == 'main' && 'https://kubuntu.org' || 'https://kubuntu-team.github.io/kubuntu.org' }}'; | |
| const message = `🚀 Deployment to ${environment} successful!\n\nSite is live at: ${url}`; | |
| await github.rest.repos.createCommitComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| commit_sha: context.sha, | |
| body: message | |
| }); | |
| - name: Notify on failure | |
| if: failure() && github.event_name == 'push' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const environment = '${{ github.ref_name == 'main' && 'production' || 'testing' }}'; | |
| const message = `❌ Deployment to ${environment} failed!\n\nPlease check the [workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) for details.`; | |
| await github.rest.repos.createCommitComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| commit_sha: context.sha, | |
| body: message | |
| }); |