deploy-infra.yml

name: Deploy site infra

on:
  push:
    branches:
      - ovh/infra/production
  workflow_dispatch:
    inputs:
      tags:
        description: 'Tags to specify which parts of the playbook to run'
        required: false
        default: ''
  schedule:
    - cron: '0 6 * * *'

concurrency:
  group: deploy-infra-ovh
  cancel-in-progress: false

env:
  ANSIBLE_FORCE_COLOR: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - uses: actions/setup-python@v4
        with:
          python-version: '3.12'
          cache: 'pip'

      - name: Save ansible private key to file
        run: |
          mkdir -p infra/keys/ansible
          echo "${{ secrets.ANSIBLE_SSH_PRIVATE_KEY }}" > infra/keys/ansible/id_ed25519
          chmod 600 infra/keys/ansible/id_ed25519
          ssh-keygen -y -f infra/keys/ansible/id_ed25519 > infra/keys/ansible/id_ed25519.pub

      - name: Install python3 deps
        run: pip3 install -r requirements.txt
        working-directory: infra

      - name: Run ansible galaxy install
        run: ansible-galaxy install -r ./requirements.yml
        working-directory: infra

      - name: Run configure playbook
        working-directory: infra
        run: |
          if [ -n "${{ github.event.inputs.tags }}" ]; then
            ansible-playbook ./configure.yml --tags "${{ github.event.inputs.tags }}"
          else
            ansible-playbook ./configure.yml
          fi
        env:
          PODMAN_REGISTRY_USERNAME: ${{ secrets.PRODUCTION_PODMAN_REGISTRY_USERNAME }}
          PODMAN_REGISTRY_PASSWORD: ${{ secrets.PRODUCTION_PODMAN_REGISTRY_PASSWORD }}
          RAILS_MASTER_KEY: ${{ secrets.PRODUCTION_RAILS_MASTER_KEY }}