CI/CD pipeline: from a push to production

name: CI/CD

on:
  pull_request:
  push:
    branches: [main]

concurrency:                       # a newer push cancels the older run
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm               # dependencies from cache: minutes → seconds
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test
      - run: npm run build
      - uses: actions/upload-artifact@v7
        with:
          name: site
          path: dist/

  deploy:
    needs: checks                  # no release if any check failed
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production        # secrets and an optional manual approval
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: site
          path: dist/
      - name: Upload and switch
        env:
          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          HOST: ${{ vars.DEPLOY_HOST }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
          echo "$KNOWN_HOSTS" > ~/.ssh/known_hosts
          RELEASE=$(date -u +%Y%m%d%H%M%S)
          rsync -az dist/ "deploy@$HOST:/srv/site/releases/$RELEASE/"
          ssh "deploy@$HOST" "/srv/site/switch.sh $RELEASE"

#!/bin/sh
# Switches the site to a new release and returns the old one if the check fails
set -eu
SITE=/srv/site
NEW="$SITE/releases/$1"
OLD=$(readlink -f "$SITE/current" || true)

switch_to() {
  ln -sfn "$1" "$SITE/current.next"
  mv -T "$SITE/current.next" "$SITE/current"   # atomic: old or new
}

switch_to "$NEW"

if ! curl -fsS --max-time 10 https://example.com/health > /dev/null; then
  [ -n "$OLD" ] && switch_to "$OLD"
  echo "Health check failed, back to $(basename "$OLD")" >&2
  exit 1
fi

# keep the last five releases for a quick rollback
ls -1dt "$SITE"/releases/*/ | tail -n +6 | xargs -r rm -rf