Add deploy workflow (#17)

* make build action run on pushes and pull requests

* add deploy workflow

* merge rm calls into single command

* purge cloudflare cache after deploy

* authenticate when pulling build artifact

* use env var for artifact URL

* fix invalid artifact names on pull requests

.github/workflows/build.yml

@@ -1,7 +1,8 @@
+name: Build
+
 on:
-  push:
+  push: {}
-    branches:
+  pull_request: {}
-      - "*"
 
 jobs:
   build:
@@ -18,7 +19,21 @@ jobs:
         env:
           NODE_ENV: production
       - name: Upload Artifact
+        id: upload-artifact
         uses: actions/upload-artifact@v4
         with:
-          name: '${{ github.event.repository.name }}-${{ github.ref_name }}-${{ github.sha }}'
+          name: "${{ github.event.repository.name }}-${{ github.sha }}"
           path: dist
+      - name: Trigger Deployment
+        # only run on the main branch
+        if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        with:
+          event-type: deploy-ssh
+          client-payload: |
+            {
+              "ref": "${{ github.ref }}",
+              "sha": "${{ github.sha }}",
+              "artifact-url": "${{ steps.upload-artifact.outputs.artifact-url }}",
+              "artifact-name": "${{ github.event.repository.name }}-${{ github.sha }}"
+            }

.github/workflows/deploy.yml

@@ -0,0 +1,33 @@
+name: Deploy
+
+on:
+  repository_dispatch:
+    types: [deploy-ssh]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      ARTIFACT_NAME: ${{ github.event.client_payload.artifact-name }}
+      ARTIFACT_URL: ${{ github.event.client_payload.artifact-url }}
+    steps:
+      - name: Deploy via SSH
+        id: deploy
+        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
+        with:
+          host: ${{ secrets.SSH_HOST }}
+          username: ${{ secrets.SSH_USER }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          port: ${{ secrets.SSH_PORT }}
+          script: |
+            cd ${{ secrets.TMP_DIR }}
+            wget -O "${{ env.ARTIFACT_NAME }}.zip" --header="Authorization: token ${{ github.token }}" ${{ env.ARTIFACT_URL }}
+            unzip -aDo "${{ env.ARTIFACT_NAME }}.zip" -d "${{ env.ARTIFACT_NAME }}"
+            rsync -vR --delete "${{ env.ARTIFACT_NAME }}/" "${{ secrets.DESTINATION_DIR }}"
+            rm -rf "./${{ env.ARTIFACT_NAME }}.zip" "./${{ env.ARTIFACT_NAME }}"
+      - name: Purge Cloudflare Cache
+        id: purge-cache
+        uses: NathanVaughn/actions-cloudflare-purge@f70c63827b539cf48eb3a29fdaa7547eca4dede4 #latest commit at the time
+        with:
+          cf_auth: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          cf_zone: ${{ secrets.CLOUDFLARE_ZONE_ID }}