deploy.yml

name: Deploy

# The build happens locally, not here: .githooks/pre-push runs bin/build and
# uploads the linux/amd64 artifact to a GitHub Release tagged with the commit
# SHA before the push completes. This job just downloads that exact release
# asset and scp+restarts it — no Go toolchain, no checkout, no compiling. It
# also means no third-party JS actions (actions/checkout, actions/setup-go)
# pinning us to their Node runtime version.
on:
  push:
    branches: [main]
  workflow_dispatch: {}

concurrency:
  group: deploy-prod
  cancel-in-progress: true

env:
  PROD_HOST: 78.47.64.38

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 3
    permissions:
      contents: read
    steps:
      - name: Download build artifact
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download "deploy-$GITHUB_SHA" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern notify-local-linux-amd64 \
            --output notify-local \
          || {
            echo "::error::No release artifact found for commit $GITHUB_SHA." \
                 "This commit wasn't pushed through the pre-push hook — run" \
                 "'git config core.hooksPath .githooks' and push again." >&2
            exit 1
          }
          chmod +x notify-local

      - name: Deploy
        env:
          SSH_KEY: ${{ secrets.PROD_DEPLOY_SSH_KEY }}
        run: |
          umask 077
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/deploy_key
          ssh-keyscan -H "$PROD_HOST" > ~/.ssh/known_hosts 2>/dev/null

          SSH="ssh -i ~/.ssh/deploy_key -o BatchMode=yes notify@$PROD_HOST"

          # Upload under a temp name, then atomically replace the running
          # binary — avoids serving a half-written file if the copy is
          # interrupted, and only touches files the notify user already owns.
          scp -i ~/.ssh/deploy_key notify-local "notify@$PROD_HOST:/opt/notify/notify-local.new"
          $SSH '
            set -e
            chmod 755 /opt/notify/notify-local.new
            mv /opt/notify/notify-local.new /opt/notify/notify-local
            sudo -n systemctl restart notify-local
          '

      - name: Smoke test
        run: |
          for i in $(seq 1 10); do
            code=$(curl -s -o /dev/null -w '%{http_code}' "http://$PROD_HOST:8082/?token=local-key" || true)
            [ "$code" = "200" ] && exit 0
            sleep 1
          done
          echo "deploy did not come back healthy" >&2
          exit 1