name: branch-deploy

on:

issue_comment:

types: [created]

# Permissions needed for reacting and adding comments for IssueOps commands

permissions:

pull-requests: write

deployments: write

contents: write

checks: read

statuses: read

jobs:

deploy:

environment: production-secrets

if: # only run on pull request comments and very specific comment body string as defined in our branch-deploy settings

${{ github.event.issue.pull_request &&

(contains(github.event.comment.body, '.deploy') ||

contains(github.event.comment.body, '.lock') ||

contains(github.event.comment.body, '.noop') ||

contains(github.event.comment.body, '.help') ||

contains(github.event.comment.body, '.wcid') ||

contains(github.event.comment.body, '.unlock')) }}

runs-on: ubuntu-latest

steps:

- uses: github/branch-deploy@v9

id: branch-deploy

with:

admins: the-hideout/core-contributors

admins_pat: ${{ secrets.BRANCH_DEPLOY_ADMINS_PAT }}

environment_targets: production

sticky_locks: "true"

- name: checkout

if: ${{ steps.branch-deploy.outputs.continue == 'true' }}

uses: actions/checkout@v4

with:

ref: ${{ steps.branch-deploy.outputs.sha }}

- name: SSH Remote Deploy

if: ${{ steps.branch-deploy.outputs.continue == 'true' && steps.branch-deploy.outputs.noop != 'true' }}

uses: appleboy/ssh-action@7eaf76671a0d7eec5d98ee897acda4f968735a17 # pin@v1.2.0

with:

host: ${{ secrets.SSH_HOST }}

username: ${{ secrets.SSH_USERNAME }}

key: ${{ secrets.SSH_KEY }}

port: ${{ secrets.SSH_PORT }}

script_stop: true

script: ~/cache/script/deploy -r "${{ steps.branch-deploy.outputs.sha }}" -f "${{ steps.branch-deploy.outputs.fork_checkout }}" -d "/home/${{ secrets.SSH_USERNAME }}/cache" -n "${{ steps.branch-deploy.outputs.fork_full_name }}"