deploy-application.yml

# This workflow deploys the application to a specified environment

name: Deploy application

# Controls when the action will run. Triggers the workflow on release publish events
on:
  workflow_dispatch:
    inputs:
      destinationEnvironment:
        description: "The target environment"
        required: true
        type: choice
        options:
          - "staging"
          - "production"

# Never run two deployments against the same environment at once
concurrency:
  group: deploy-${{ inputs.destinationEnvironment }}
  cancel-in-progress: false

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  deploy:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Set target environment
    environment:
      name: "${{ inputs.destinationEnvironment }}"

    env:
      # Plugins whose assets are compiled here and synced to the server, as the
      # host's disk quota cannot hold their node_modules
      ASSET_PLUGINS: cbf-multisite cbf-semantic-glossary cbf-semantic-glossary-learndash
      # Part of the asset cache key, so a Node upgrade rebuilds the assets
      NODE_VERSION: 24

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Most deployments don't change the plugins' scripts or styles, so the
      # built assets are cached against everything the build reads. A hit skips
      # Node, the installs and the builds.
      - name: Restore plugin assets
        id: assets-cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            web/app/plugins/cbf-multisite/assets
            web/app/plugins/cbf-semantic-glossary/assets
            web/app/plugins/cbf-semantic-glossary-learndash/assets
          key: plugin-assets-node${{ env.NODE_VERSION }}-${{ hashFiles('web/app/plugins/cbf-multisite/src/**', 'web/app/plugins/cbf-multisite/package*.json', 'web/app/plugins/cbf-multisite/webpack.config.js', 'web/app/plugins/cbf-semantic-glossary/src/**', 'web/app/plugins/cbf-semantic-glossary/package*.json', 'web/app/plugins/cbf-semantic-glossary/webpack.config.js', 'web/app/plugins/cbf-semantic-glossary-learndash/src/**', 'web/app/plugins/cbf-semantic-glossary-learndash/package*.json', 'web/app/plugins/cbf-semantic-glossary-learndash/webpack.config.js') }}

      # Sets the Node version
      - name: Setup Node.js
        if: steps.assets-cache.outputs.cache-hit != 'true'
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: |
            web/app/plugins/cbf-multisite/package-lock.json
            web/app/plugins/cbf-semantic-glossary/package-lock.json
            web/app/plugins/cbf-semantic-glossary-learndash/package-lock.json

      # Builds before touching the server, so a failed build leaves the site as it was.
      # The plugins install and build at the same time; each one's output is
      # printed in its own group once it finishes.
      - name: Build plugin assets
        if: steps.assets-cache.outputs.cache-hit != 'true'
        run: |
          declare -A pids
          for plugin in $ASSET_PLUGINS; do
            (
              cd "web/app/plugins/$plugin"
              npm ci --no-audit --no-fund
              npm run build:assets
            ) > "$RUNNER_TEMP/$plugin.log" 2>&1 &
            pids[$plugin]=$!
          done

          failed=0
          for plugin in $ASSET_PLUGINS; do
            if wait "${pids[$plugin]}"; then result=built; else result=failed; failed=1; fi
            echo "::group::$plugin ($result)"
            cat "$RUNNER_TEMP/$plugin.log"
            echo "::endgroup::"
            if [ "$result" = failed ]; then echo "::error::$plugin assets failed to build"; fi
          done
          exit "$failed"

      # Saved straight after the build, so later deployment steps can't stop it
      - name: Save plugin assets
        if: steps.assets-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            web/app/plugins/cbf-multisite/assets
            web/app/plugins/cbf-semantic-glossary/assets
            web/app/plugins/cbf-semantic-glossary-learndash/assets
          key: ${{ steps.assets-cache.outputs.cache-primary-key }}

      - name: Configure SSH
        env:
          SSH_HOST: ${{ secrets.SSH_HOST }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_PORT: ${{ secrets.SSH_PORT }}
          SSH_KEY: ${{ secrets.DESTINATION_SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
        run: |
          if [ -z "$SSH_KNOWN_HOSTS" ]; then
            echo "::error::SSH_KNOWN_HOSTS secret is not set for this environment"
            exit 1
          fi
          install -d -m 700 ~/.ssh
          printf '%s\n' "$SSH_KEY" > ~/.ssh/deploy_key
          printf '%s\n' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/deploy_key ~/.ssh/known_hosts
          cat > ~/.ssh/config <<EOF
          Host deploy-target
            HostName $SSH_HOST
            User $SSH_USER
            Port $SSH_PORT
            IdentityFile ~/.ssh/deploy_key
            IdentitiesOnly yes
            StrictHostKeyChecking yes
            ServerAliveInterval 30
          EOF

      # Moves the server to exactly the commit built above, then installs PHP dependencies
      - name: Update code on target
        env:
          SSH_PATH: ${{ secrets.SSH_PATH }}
          STASH_MESSAGE: "Stashed by ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ job.check_run_id }}"
        run: |
          # Values below are expanded on the runner on purpose
          # shellcheck disable=SC2029
          # Resolve the remote root once, so the sync step targets an absolute path
          remote_root=$(ssh deploy-target "cd $SSH_PATH && pwd -P")
          echo "REMOTE_ROOT=$remote_root" >> "$GITHUB_ENV"

          # ssh joins its arguments into one remote command line, so quote them for the remote shell
          # shellcheck disable=SC2029
          ssh deploy-target "bash -s -- $(printf '%q ' "$remote_root" "$GITHUB_SHA" "$STASH_MESSAGE")" <<'EOF'
          set -euo pipefail
          cd "$1"
          git stash -m "$3"
          git fetch
          # Refuse a commit that is not on the branch this server tracks, such as
          # a production deployment dispatched from develop
          if ! git merge-base --is-ancestor "$2" '@{upstream}'; then
            echo "::error::$2 is not on $(git rev-parse --abbrev-ref '@{upstream}'); refusing to deploy it"
            exit 1
          fi
          git merge --ff-only "$2"
          composer install --no-dev --optimize-autoloader
          EOF

      - name: Sync plugin assets to target
        run: |
          for plugin in $ASSET_PLUGINS; do
            rsync -rlt --delete --chmod=D755,F644 \
              "web/app/plugins/$plugin/assets/" \
              "deploy-target:$REMOTE_ROOT/web/app/plugins/$plugin/assets/"
          done

      # Synced patterns are posts, so the academy theme's synced-patterns/ files
      # only reach lessons once they are written to the academy site's database
      - name: Sync academy patterns on target
        env:
          ACADEMY_URL: ${{ vars.ACADEMY_URL }}
        run: |
          if [ -z "$ACADEMY_URL" ]; then
            echo "::error::ACADEMY_URL variable is not set for this environment"
            exit 1
          fi
          # shellcheck disable=SC2029
          ssh deploy-target "bash -s -- $(printf '%q ' "$REMOTE_ROOT" "$ACADEMY_URL")" <<'EOF'
          set -euo pipefail
          cd "$1"
          vendor/bin/wp cbf patterns sync --url="$2"
          EOF

  check:
    needs: [deploy]
    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    # Set target environment
    environment:
      name: "${{ inputs.destinationEnvironment }}"

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Sets the Node version
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
      - name: Check site
        uses: jtalk/url-health-check-action@e7d5ebdc9027fbf494d2d034f3e8fc78f8b7a2b9
        with:
          url: ${{ vars.DESTINATION_URL }}