name: Deploy to production

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Run deploy script on the droplet
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DROPLET_HOST }}
          username: deploy
          key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          port: 22
          # Strict host key checking would need us to pin a known_hosts;
          # for now the droplet's host key is trusted on first use.
          script_stop: true
          script: |
            /opt/hackerspace-ops/deploy.sh