Matthew Binning
35d31bea2a
Now the private content is stored as a git submodule. This means I can keep that repo's source private, but still use it in the build product. The build product (website) relies on HTTP basic authentication, so access control is maintained throughout the SDLC.
40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
name: Nightly
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 2 * * *'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
submodules: false
|
|
- name: Build
|
|
run: |
|
|
git config --global url."https://oauth2:${{ secrets.WWW_PRIVATE_TOKEN }}@forgejo.binning.net/".insteadOf "https://forgejo.binning.net/"
|
|
git submodule update --init --depth=1
|
|
nix shell nixpkgs#mdbook --command mdbook build
|
|
printf "✓ Build complete!\n"
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: blog-${{ github.sha }}
|
|
path: book/
|
|
deploy:
|
|
needs: build
|
|
runs-on: self-hosted
|
|
steps:
|
|
- name: Download artifact
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
submodules: true
|
|
token: ${{ secrets.WWW_PRIVATE_TOKEN }}
|
|
with:
|
|
name: blog-${{ github.sha }}
|
|
path: book/
|
|
- name: Deploy
|
|
run: |
|
|
nix shell nixpkgs#rsync --command rsync -av --delete book/ /srv/www/binning.net/
|
|
printf "✓ Local deployment complete!\n"
|