deploy.yml

name: Deploy

on:
  schedule:
    - cron: 0 2 * * *
  workflow_call:
    inputs:
      channel:
        type: string
      ref:
        type: string
      disable-deploy:
        type: boolean
  workflow_dispatch:

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.SPACES_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET_ACCESS_KEY }}
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_EMAIL: ${{ secrets.CLOUDFLARE_EMAIL }}
  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
  TF_VAR_cloudflare_zone_id: ${{ secrets.TF_VAR_CLOUDFLARE_ZONE_ID }}
  TF_WORKSPACE: ${{ inputs.channel || (github.ref_name == 'main' && 'nightly') || github.ref_name }}

concurrency:
  group: deploy-${{ inputs.channel || github.ref_name }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: AdityaGarg8/remove-unwanted-software@v3
        with:
          remove-android: true
          remove-codeql: true
          remove-docker-images: true
          remove-dotnet: true
          remove-haskell: true

      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref || github.ref }}
          submodules: true

      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DIGITALOCEAN_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

      - uses: DeterminateSystems/nix-installer-action@main
      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Apply universal
        run: nix run .#tf-universal-apply
        env:
          TF_WORKSPACE: default

      - name: Apply channel
        run: nix run .#tf-channel-apply

      - uses: EndBug/add-and-commit@v9
        with:
          message: "chore: update terraform output"
          default_author: github_actions

      - name: Build server
        if: inputs.disable-deploy != true
        run: nix build -L .?submodules=1#unavi-server

      - name: Build web
        if: inputs.disable-deploy != true
        run: nix build -L .?submodules=1#unavi-web

      - name: Deploy
        if: inputs.disable-deploy != true
        run: nix run .?submodules=1#deploy