deploy.yml

name: Deploy

on:
  workflow_dispatch:
  push:
    branches: ['main']

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install
      - run: echo "GITHUB_WEBHOOK_SECRET=${{ secrets.APP_GITHUB_WEBHOOK_SECRET }}" >> .env
      - run: echo "SENTRY_DSN=${{ secrets.APP_SENTRY_DSN }}" >> .env
      - id: ip
        uses: haythem/public-ip@v1.3
      - uses: aws-actions/configure-aws-credentials@v3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_ACCESS_KEY_SECRET }}
          aws-region: ${{ secrets.AWS_REGION }}
      - run: |
          aws ec2 authorize-security-group-ingress \
            --group-id "${{ secrets.AWS_EC2_SG }}" \
            --protocol tcp \
            --port 22 \
            --cidr "${{ steps.ip.outputs.ipv4 }}/32"
      - uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.AWS_EC2_HOST }}
          username: ${{ secrets.AWS_EC2_USERNAME }}
          key: ${{ secrets.AWS_EC2_KEY }}
          script: "rm -rf /app/..?* /app/.[!.]* /app/*"
      - uses: appleboy/scp-action@v0.1.4
        with:
          host: ${{ secrets.AWS_EC2_HOST }}
          username: ${{ secrets.AWS_EC2_USERNAME }}
          key: ${{ secrets.AWS_EC2_KEY }}
          source: "./*"
          target: "/app/"
          overwrite: true
      - uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.AWS_EC2_HOST }}
          username: ${{ secrets.AWS_EC2_USERNAME }}
          key: ${{ secrets.AWS_EC2_KEY }}
          script: |
            pm2 reload /app/ecosystem.config.js --env production
            pm2 save
      - if: always()
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id "${{ secrets.AWS_EC2_SG }}" \
            --protocol tcp \
            --port 22 \
            --cidr "${{ steps.ip.outputs.ipv4 }}/32"