static.yml

# Simple workflow for deploying static content to GitHub Pages
name: Deploy

on:
  push:
    branches:
      - main
      - develop

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: write
  pages: write
  id-token: write

# Allow only one concurrent deployment
concurrency:
  group: "pages"
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: '0.121.1'
          extended: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: |
          npm install -g minify
          sudo apt-get update
          sudo apt-get install -y imagemagick

      - name: Build with Hugo
        run: |
          if [ "${{ github.ref_name }}" = 'main' ]; then
            echo "Building production site..."
            HUGO_ENV=production hugo --minify --gc --baseURL "https://kubuntu.org"
          elif [ "${{ github.ref_name }}" = 'develop' ]; then
            echo "Building testing site..."
            hugo --minify --gc --baseURL "https://kubuntu-team.github.io/kubuntu.org"
          else
            echo "This workflow is restricted to main or develop. Exiting."
            exit 1
          fi

      - name: Upload via SFTP to Production
        if: github.ref_name == 'main'
        env:
          SFTP_USER: ${{ vars.SFTP_USER }}
          SFTP_HOST: ${{ vars.SFTP_HOST }}
          SFTP_PORT: ${{ vars.SFTP_PORT }}
          SFTP_TARGET_DIR: ${{ vars.SFTP_TARGET_DIR }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          : "${SFTP_USER:?GitHub variable SFTP_USER is required}"
          : "${SFTP_HOST:?GitHub variable SFTP_HOST is required}"
          : "${SFTP_PORT:=22}"
          : "${SSH_PRIVATE_KEY:?GitHub secret SSH_PRIVATE_KEY is required}"
          : "${SFTP_TARGET_DIR:=data/}"

          mkdir -p "$HOME/.ssh"
          chmod 700 "$HOME/.ssh"

          echo "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
          chmod 600 "$HOME/.ssh/deploy_key"

          # Ensure sensitive files are cleaned up on exit (success or failure)
          cleanup() { rm -f "$HOME/.ssh/deploy_key" lftp.cmd || true; }
          trap cleanup EXIT

          # Preload known_hosts to avoid interactive prompt
          ssh-keyscan -p "$SFTP_PORT" -t rsa,ecdsa,ed25519 "$SFTP_HOST" >> "$HOME/.ssh/known_hosts"
          chmod 644 "$HOME/.ssh/known_hosts"

          # Use lftp in sftp mode because the server is SFTP-only (no shell)
          # https://lftp.yar.ru/lftp-man.html
          sudo apt-get update && sudo apt-get install -y lftp

          # Create lftp script for robust sync
          # NOTE: no quotes around EOF so shell variables expand here
          cat > lftp.cmd <<EOF
          set sftp:auto-confirm yes
          set net:max-retries 2
          set net:timeout 20
          set net:reconnect-interval-base 5
          set net:persist-retries 1
          
          # Force key-only auth; prevent any password prompt
          set sftp:connect-program "ssh -i $HOME/.ssh/deploy_key -oBatchMode=yes -oPubkeyAuthentication=yes -oPasswordAuthentication=no -oKbdInteractiveAuthentication=no -oStrictHostKeyChecking=yes -p $SFTP_PORT"
          
          # Ensure remote target exists, then cd into it
          mkdir -p "$SFTP_TARGET_DIR"
          cd "$SFTP_TARGET_DIR"
           
          # Upload contents of ./public into remote ./data and delete remote extras
          mirror -R --delete --parallel=4 --verbose ./public .
          bye
          EOF

          # Connect with key auth; pass empty password to avoid GetPass
          lftp -u "$SFTP_USER," -p "$SFTP_PORT" -e "source lftp.cmd; bye" sftp://"$SFTP_HOST"

          # Explicit cleanup after successful transfer
          rm -f "$HOME/.ssh/deploy_key" lftp.cmd || true

      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: ./public

  deploy:
    environment:
      name: ${{ github.ref_name == 'main' && 'production' || 'testing' }}
      url: ${{ github.ref_name == 'main' && 'https://kubuntu.org' || 'https://kubuntu-team.github.io/kubuntu.org' }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy to ${name}
        id: deployment
        uses: actions/deploy-pages@v4

      - name: Notify on success
        if: success() && github.event_name == 'push'
        uses: actions/github-script@v7
        with:
          script: |
            const environment = '${{ github.ref_name == 'main' && 'production' || 'testing' }}';
            const url = '${{ github.ref_name == 'main' && 'https://kubuntu.org' || 'https://kubuntu-team.github.io/kubuntu.org' }}';
            const message = `🚀 Deployment to ${environment} successful!\n\nSite is live at: ${url}`;
            
            await github.rest.repos.createCommitComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              commit_sha: context.sha,
              body: message
            });

      - name: Notify on failure
        if: failure() && github.event_name == 'push'
        uses: actions/github-script@v7
        with:
          script: |
            const environment = '${{ github.ref_name == 'main' && 'production' || 'testing' }}';
            const message = `❌ Deployment to ${environment} failed!\n\nPlease check the [workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) for details.`;
            
            await github.rest.repos.createCommitComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              commit_sha: context.sha,
              body: message
            });