build.yml

name: Build, Publish, and Deploy
on:
  push:
    branches:
      - main

jobs:
  publish:
    name: Build and Publish
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME: mopad
      IMAGE_TAGS: latest ${{ github.sha }} ${{ github.ref_name }}
      IMAGE_REGISTRY: docker://ghcr.io/hulks/
      REGISTRY_USER: ${{ github.actor }}
      REGISTRY_PASSWORD: ${{ github.token }}
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: true

      - name: build image
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.IMAGE_TAGS }}
          containerfiles: |
            ./Containerfile

      - name: push to ghcr.io
        id: push-to-registry
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ env.REGISTRY_USER }}
          password: ${{ env.REGISTRY_PASSWORD }}

      - name: echo outputs
        run: |
          echo "${{ toJSON(steps.push-to-registry.outputs) }}"

  deploy:
    needs: publish
    name: Deploy
    runs-on: self-hosted
    container:
      image: docker.io/debian:bookworm

    steps:
      - name: setup ssh
        run : |
          set -e
          apt update
          apt install --yes ssh
      - name: install ssh keys
        run: |
          install -m 600 -D /dev/null /root/.ssh/id_ed25519
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > /root/.ssh/id_ed25519
          ssh-keyscan -H ${{ secrets.SSH_HOST }} > /root/.ssh/known_hosts
      - name: connect and pull
        run: ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "cd ${{ secrets.WORK_DIR }} && docker compose pull && docker compose up -d && exit"