beeeeg update

.gitea/workflows/deploy-production.yml

@@ -0,0 +1,41 @@
+name: Deploy production
+on:
+  workflow_dispatch:
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    steps:
+      # Always test the staging branch, regardless of which branch the button
+      # appears on in Gitea's Actions UI.
+      - uses: actions/checkout@v4
+        with:
+          ref: staging
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+      - name: Check staging source
+        run: |
+          bun install --frozen-lockfile
+          bun run test:unit -- --run
+
+      - name: Configure deployment SSH key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+        run: |
+          set -euo pipefail
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 172.17.0.1 >> ~/.ssh/known_hosts
+
+      - name: Promote the exact staging image
+        run: |
+          set -euo pipefail
+          commit=$(git rev-parse HEAD)
+          ssh -o BatchMode=yes deploy@172.17.0.1 "bash -s -- '$commit'" \
+            < scripts/verify-staging-image.sh
+          ssh -o BatchMode=yes deploy@172.17.0.1 \
+            "bash -s -- '$commit' '/opt/personal-website' 'https://stanrunge.dev'" \
+            < scripts/deploy-remote.sh