deploy.yml

name: Deploy to Raspberry Pi

on:
  workflow_run:
    workflows: ["Build and Push Docker Images"]
    types:
      - completed
  workflow_dispatch:

jobs:
  deploy:
    runs-on: [self-hosted, "${{ matrix.runner}}" ]
    # Only deploy if the build workflow succeeded
    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
    strategy:
      matrix:
        include:
          - runner: kitchen
            airplay_name: "Kitchen HomeSpeaker"
          - runner: upstairs
            airplay_name: "Upstairs HomeSpeaker"

    steps:
    - uses: actions/checkout@v4

    - name: Log in to GitHub Container Registry
      run: |
        echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

    - name: Renew Tailscale certificate
      run: |
        cd ~/cert
        HOSTNAME=$(hostname)
        sudo tailscale cert ${HOSTNAME}.boston-cloud.ts.net
        sudo openssl pkcs12 -export -out certificate.pfx -inkey ${HOSTNAME}.boston-cloud.ts.net.key -in ${HOSTNAME}.boston-cloud.ts.net.crt -passout pass:
        sudo chown piuser. certificate.pfx

    - name: Write environment variables to .env file
      env:
        GOVEE_API_KEY: ${{ secrets.GOVEE_API_KEY }}
        AIRPLAY_NAME: "${{ matrix.airplay_name }}"
      run: |
        cat > .env << EOF
        GOVEE_API_KEY=${GOVEE_API_KEY}
        AIRPLAY_NAME=${AIRPLAY_NAME}
        HOMESPEAKER_IMAGE=ghcr.io/${{ github.repository_owner }}/homespeaker:latest
        EOF

    - name: Pull latest images
      run: docker-compose pull

    - name: Stop containers
      run: docker-compose down

    - name: Start containers (no build!)
      run: docker-compose up -d --remove-orphans

    - name: Wait for services to be ready
      run: sleep 25

    - name: Refresh browser on touchscreen
      run: |
        export DISPLAY=:0
        xdotool key F5
      continue-on-error: true

    - name: Clean up old images
      run: docker image prune -af --filter "until=168h"
      continue-on-error: true