Deploy #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| workflow_run: | |
| workflows: ["CI"] | |
| types: [completed] | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| if: >- | |
| github.event_name == 'workflow_dispatch' || | |
| github.event.workflow_run.conclusion == 'success' | |
| concurrency: | |
| group: deploy-${{ matrix.host }} | |
| cancel-in-progress: false | |
| strategy: | |
| matrix: | |
| include: | |
| - host: glyph | |
| system: x86_64-linux | |
| runner: ubuntu-latest | |
| - host: spore | |
| system: x86_64-linux | |
| runner: ubuntu-latest | |
| - host: zeta | |
| system: aarch64-linux | |
| runner: ubuntu-24.04-arm | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: cachix/install-nix-action@v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| extra_nix_config: | | |
| extra-substituters = https://cache.zx.dev/main | |
| extra-trusted-public-keys = main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c= | |
| - name: Configure Attic cache | |
| run: | | |
| nix profile install --inputs-from . attic#attic-client | |
| attic login rc https://cache.zx.dev ${{ secrets.ATTIC_TOKEN }} | |
| attic use rc:main | |
| - name: Connect to Tailscale | |
| uses: tailscale/github-action@v3 | |
| with: | |
| oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} | |
| oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} | |
| tags: tag:ci | |
| - name: Configure SSH | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key | |
| chmod 600 ~/.ssh/deploy_key | |
| cat >> ~/.ssh/config <<'EOF' | |
| Host glyph spore zeta | |
| User root | |
| IdentityFile ~/.ssh/deploy_key | |
| IdentitiesOnly yes | |
| StrictHostKeyChecking accept-new | |
| EOF | |
| - name: Deploy to ${{ matrix.host }} | |
| env: | |
| NIX_SSHOPTS: "-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" | |
| run: | | |
| nix run --inputs-from . deploy-rs -- \ | |
| .#${{ matrix.host }} \ | |
| --skip-checks |