main.yml

name: Build
on:
  push:
  workflow_dispatch:
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
jobs:
  docker-rebuild:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            docker-rebuild:
              - 'Dockerfile'

      - name: Log in to the Container registry
        if: steps.filter.outputs.docker-rebuild == 'true'
        uses: docker/login-action@v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        if: steps.filter.outputs.docker-rebuild == 'true'
        id: meta
        uses: docker/metadata-action@v5.7.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push
        if: steps.filter.outputs.docker-rebuild == 'true'
        uses: docker/build-push-action@v6
        with:
          context: "."
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  build:
    runs-on: ubuntu-latest
    needs: docker-rebuild
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Check if this branch has its own docker image
        id: check_image
        run: |-
          IMAGE_NAME="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}"
          if docker pull $IMAGE_NAME; then
            echo "Image exists"
            echo "ref=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          else
            echo "Image does not exist"
            echo "ref=main" >> $GITHUB_OUTPUT
          fi

      - name: Build
        run: |
          docker run --rm -v $(pwd):/src -w /src ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.check_image.outputs.ref }} just build

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: site
          path: build/

  deploy:
    needs: build
    if: github.ref_name == github.event.repository.default_branch
    concurrency:
      group: "deploy"
      cancel-in-progress: false
    runs-on: ubuntu-latest
    environment:
      name: production
      deployment: true
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: site
          path: build/

      - name: Set up SSH key
        run: |
          install -m 600 -D /dev/null ~/.ssh/id_ed25519
          echo "${{ vars.SSH_CONFIG }}" > ~/.ssh/config
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519

      - name: Deploy via rsync
        run: |
          rsync -avz --delete build/ "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH }}"

      - name: Clean up SSH key
        if: always()
        run: rm -f ~/.ssh/id_ed25519