cd.yml

name: CD

on:
  workflow_dispatch:

# Restrict GITHUB_TOKEN to the minimum (Scorecard / OpenSSF); deploy uses SSH secrets, not the token.
permissions:
  contents: read

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:
    - name: Deploy via SSH
      uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
      with:
        host: ${{ secrets.SERVER_HOST }}
        username: ${{ secrets.SERVER_USER }}
        key: ${{ secrets.SERVER_SSH_KEY }}
        port: ${{ secrets.SERVER_PORT || 22 }}
        script: |
          cd /opt/boost-weblate
          git pull origin develop
          git submodule update --init weblate-docker
          # Docker build context is .. (repo root); copy submodule ignore to context root
          cp weblate-docker/.dockerignore .dockerignore
          cd weblate-docker
          docker compose down
          docker compose up -d --build

    - name: Health check
      uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
      with:
        host: ${{ secrets.SERVER_HOST }}
        username: ${{ secrets.SERVER_USER }}
        key: ${{ secrets.SERVER_SSH_KEY }}
        port: ${{ secrets.SERVER_PORT || 22 }}
        script: |
          sleep 300
          curl -sf http://localhost:8000/healthz/