deploy.yaml

name: Deploy to linode
on:
  workflow_call:
    secrets:
      SSH_KEY_PRIV:
        required: true
      CACHIX_AUTH_TOKEN:
        required: true

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
  group: "pages"
  cancel-in-progress: false

jobs:
  nix:
    name: Deploy NixOS Machines
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v4
    - uses: cachix/install-nix-action@v30
    - uses: cachix/cachix-action@v15
      with:
        name: nexus-ci
        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
    - name: Set up ssh-agent
      uses: webfactory/ssh-agent@v0.9.0
      with:
        ssh-private-key: ${{ secrets.SSH_KEY_PRIV }}
    - name: Test SSH connection to servers
      run: ssh -T -o StrictHostKeyChecking=no admin@servers-us-east-1.socialvr.net
    - name: Ensure that the latest commit is actually going to be pulled by docker
      env:
        TAG: commit-${{ github.sha }}
      run: |
        ssh -o StrictHostKeyChecking=no admin@servers-us-east-1.socialvr.net \
          docker pull "ghcr.io/nexussocial/identity-server:${TAG}"
    - name: Deploy via deploy-rs
      run: nix run .#deploy-rs -- .

  pages:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4