cd.yml

on:
  push:
    branches:
      - main

name: CD

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: 📂 setup
        uses: actions/checkout@v4
      - name: Check 🕵️
        uses: shalzz/zola-deploy-action@v0.18.0
        env:
          CHECK_LINKS: true
          BUILD_ONLY: true

      - name: Install Nix ⚒️
        uses: DeterminateSystems/nix-installer-action@main
      - name: Setup nix cache 📝
        uses: DeterminateSystems/magic-nix-cache-action@main

        # TODO: Set this up when contributes are more frequent
        # - name: Check Nixpkgs inputs 🔍
        #   uses: DeterminateSystems/flake-checker-action@main
        #   with:
        #     fail-mode: true

      - name: Flake check 🕵️
        run: nix flake check --print-build-logs
      - name: Check deploy schema 📐
        run: nix build -L .#checks.x86_64-linux.deploy-schema
        if: success() || failure()
      - name: Check deploy activate 💪🏻
        run: nix build -L .#checks.x86_64-linux.deploy-activate

      - name: Setup secrets 🤫
        uses: 1password/load-secrets-action@v1
        id: op-load-secret # required so other steps can access secrets
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          PERUN_IP: op://damszew.dev/Perun/URL
          SSH_PRIVATE_KEY: op://damszew.dev/deploy_ssh_key/private key?ssh-format=openssh

      - name: Add perun to hosts ⚡
        run: sudo echo "${{ steps.op-load-secret.outputs.PERUN_IP }} perun" | sudo tee -a /etc/hosts
      - name: Setup ssh key 🔐
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ steps.op-load-secret.outputs.SSH_PRIVATE_KEY }}
      - name: Setup ssh/known_hosts 💁
        run: |
          mkdir -p ~/.ssh && touch ~/.ssh/known_hosts
          ssh-keyscan perun >> ~/.ssh/known_hosts

      - name: deploy 
        run: nix develop -c deploy --skip-checks # checks are performed earlier in pipeline