deploy.yml

name: Deploy Web App

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        # npm ci installs the exact, committed lockfile and fails if
        # package.json and package-lock.json have drifted out of sync,
        # guaranteeing the deployed bundle matches the audited repo state.
        run: npm ci

      - name: Audit dependencies (blocking)
        # Fail the deploy on any critical advisory.
        run: npm audit --audit-level=critical

      - name: Audit dependencies (high, report-only)
        # Surface high-severity advisories without blocking; the current
        # highs are dev-tooling transitives with breaking-change-only fixes.
        run: npm audit --audit-level=high
        continue-on-error: true

      - name: Typecheck
        run: npm run typecheck

      - name: Build web app
        run: npm run build

      - name: Setup SSH
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keygen -y -f ~/.ssh/deploy_key > /dev/null
          # Prefer a pinned host key supplied via the SSH_KNOWN_HOSTS secret.
          # Fall back to ssh-keyscan only if no pinned key is configured.
          if [ -n "$SSH_KNOWN_HOSTS" ]; then
            printf '%s\n' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
          else
            ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts
          fi
          chmod 600 ~/.ssh/known_hosts

      - name: Deploy to server
        env:
          SSH_HOST: ${{ secrets.SSH_HOST }}
          SSH_USER: ${{ secrets.SSH_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
        run: |
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=~/.ssh/known_hosts" \
            dist/ \
            "$SSH_USER@$SSH_HOST:$DEPLOY_PATH"

      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key