deploy.yml

name: Deploy

on:
  workflow_run:
    workflows:
      - Test
    types:
      - completed

permissions:
  contents: read

jobs:
  deploy:
    # The checkout below names the commit that triggered the run. Only a push
    # to this repository carries a commit meant for deployment; a pull
    # request, fork or not, does not.
    if: >-
      ${{ github.event.workflow_run.conclusion == 'success'
      && github.event.workflow_run.event == 'push'
      && github.event.workflow_run.head_repository.full_name == github.repository }}
    runs-on: ubuntu-26.04

    # Runs of a branch deploy 1 at a time, so no other run can push between
    # the tip check of a run and its push.
    concurrency:
      group: deploy-${{ github.event.workflow_run.head_branch }}
      cancel-in-progress: false
      # The default queue cancels a waiting run when another one arrives. Runs
      # arrive as their tests finish, so the cancelled one can hold the newest
      # commit.
      queue: max

    permissions:
      contents: read

    env:
      DEPLOY_USER_NAME: ${{ secrets.DEPLOY_USER_NAME }}
      DEPLOY_USER_EMAIL: ${{ secrets.DEPLOY_USER_EMAIL }}
      DEPLOY_REMOTE: ${{ secrets.DEPLOY_REMOTE }}
      DEPLOY_PROCEED: ${{ secrets.DEPLOY_PROCEED }}

    # Deployment is optional, so its steps run only when DEPLOY_REMOTE is set.
    steps:
      - name: Report missing deployment configuration
        if: ${{ env.DEPLOY_REMOTE == '' }}
        run: echo "::notice::Deployment is not configured. Set the DEPLOY_REMOTE secret to enable it."

      - name: Checkout code
        if: ${{ env.DEPLOY_REMOTE != '' }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # `workflow_run` resolves refs against the default branch, so the
          # tested commit is named explicitly.
          ref: ${{ github.event.workflow_run.head_sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Install the tooling
        if: ${{ env.DEPLOY_REMOTE != '' }}
        run: ./scripts/eddy-tooling
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install SSH key
        if: ${{ env.DEPLOY_REMOTE != '' }}
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
        with:
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          known_hosts: unnecessary
          config: |
            Host *
              StrictHostKeyChecking no

      - name: Deploy to Remote
        if: ${{ env.DEPLOY_REMOTE != '' }}
        env:
          # Optional repository variable for branch pushes. Falls back to the
          # branch that triggered the build.
          DEPLOY_BRANCH: ${{ vars.DEPLOY_BRANCH }}
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # A tag push reports the tag name as the head branch. A branch can
          # share a name with an unrelated tag, so match the tags on the
          # commit that triggered the run rather than the name alone.
          if git tag --points-at "${HEAD_SHA}" | grep -Fxq "${HEAD_BRANCH}"; then
            # Pushing the tagged commit to a branch rewinds the branch when the
            # tag is behind its tip, so only the tag is deployed.
            DEPLOY_BRANCH='' DEPLOY_TAG="${HEAD_BRANCH}" vendor/bin/eddy-deploy
            exit 0
          fi

          # The checkout keeps no credentials, and a private repository needs
          # them to fetch.
          AUTH_HEADER="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"

          # Runs finish out of order and can be re-run, so deploying a commit
          # that is no longer the branch tip would rewind the remote branch.
          # The branch can also move after the checkout, so it is fetched again.
          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraheader GIT_CONFIG_VALUE_0="${AUTH_HEADER}" \
            git fetch --prune --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
          HEAD_BRANCH_TIP="$(git rev-parse --verify --quiet "refs/remotes/origin/${HEAD_BRANCH}" || true)"
          if [ "${HEAD_BRANCH_TIP}" != "${HEAD_SHA}" ]; then
            echo "::notice::Skip deployment because ${HEAD_SHA} is no longer the tip of ${HEAD_BRANCH}."
            exit 0
          fi

          DEPLOY_BRANCH="${DEPLOY_BRANCH:-${HEAD_BRANCH}}" vendor/bin/eddy-deploy