Deploy #265

	name: Deploy

	on:
	schedule:
	- cron: 0 2 * * *
	workflow_call:
	inputs:
	channel:
	type: string
	ref:
	type: string
	disable-deploy:
	type: boolean
	workflow_dispatch:

	env:
	AWS_ACCESS_KEY_ID: ${{ secrets.SPACES_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET_ACCESS_KEY }}
	CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
	CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
	DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
	TF_VAR_cloudflare_zone_id: ${{ secrets.TF_VAR_CLOUDFLARE_ZONE_ID }}
	TF_WORKSPACE: ${{ inputs.channel \|\| (github.ref_name == 'main' && 'nightly') \|\| github.ref_name }}

	concurrency:
	group: deploy-${{ inputs.channel \|\| github.ref_name }}
	cancel-in-progress: false

	jobs:
	deploy:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	ref: ${{ inputs.ref \|\| github.ref }}
	submodules: true

	- name: Set up SSH key
	run: \|
	mkdir -p ~/.ssh
	echo "${{ secrets.DIGITALOCEAN_SSH_KEY }}" > ~/.ssh/id_ed25519
	chmod 600 ~/.ssh/id_ed25519

	- uses: DeterminateSystems/nix-installer-action@main
	- uses: DeterminateSystems/magic-nix-cache-action@main

	- name: Apply universal
	run: nix run .#tf-universal-apply
	env:
	TF_WORKSPACE: default

	- name: Apply channel
	run: nix run .#tf-channel-apply

	- uses: EndBug/add-and-commit@v9
	with:
	message: "chore: update terraform output"
	default_author: github_actions

	- name: Deploy
	if: inputs.disable-deploy != true
	run: nix-shell -p deploy-rs --command "deploy .?submodules=1#${{ env.TF_WORKSPACE }} --skip-checks"

Provide feedback