Automatically deploy site

Author: tomjaguarpaw

.github/workflows/deploy.yml

@@ -0,0 +1,51 @@
+name: Deploy
+
+# We deploy the site *only* on
+#
+# 1. A push to master, or
+# 2. A manually triggered Deploy build
+#
+# We don't want to deploy for every branch and PR of course!
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v12
+
+      # The CI Github Action also builds the site and puts it in an
+      # artifact.  However, downloading an artifact from a different
+      # workflow seems to be difficult.
+      #
+      # https://github.com/actions/download-artifact/issues/3
+      #
+      # We'll just build the whole site again here.  It only takes a
+      # couple of minutes.
+      - name: Build Site
+        # we run the checks as a separate step
+        run: nix build -f . built -o built-site --arg doCheck false
+
+      - name: Check Links
+        run: nix run --quiet -f . linkchecker -c linkchecker built-site
+
+      - name: Deploy
+        shell: bash
+        env:
+          # Create the secret with:
+          #
+          # Settings -> Secrets -> New Repository Secret ->
+          #
+          #   Name: WWW_HASKELL_ORG_SSH_KEY
+          #   Value: The text of the ssh private key
+          WWW_HASKELL_ORG_SSH_KEY: ${{ secrets.WWW_HASKELL_ORG_SSH_KEY }}
+        run: |
+          nix run --quiet -f . lftp -c sh ./deploy.sh --DEPLOY-IT-LIVE

README.md

@@ -76,3 +76,7 @@ You may then run the builder binary from the `result` directory:
 ```
 ./result/bin/haskell-org-site build
 ```
+
+### Deploying
+
+The site will automatically be deployed live to <http://www.haskell.org/> every time a branch is merged to `master`. Alternatively an admin for this GitHub repository can deploy the site by visiting the [Deploy workflow page](https://github.com/haskell-infra/www.haskell.org/actions/workflows/deploy.yml), clicking the "Run workflow" dropdown, choosing the branch to build and deploy, and clicking the "Run workflow" button.

default.nix

@@ -33,4 +33,4 @@ let
   };
 in
   if pkgs.lib.inNixShell then builder
-  else { inherit builder built; inherit (pkgs) linkchecker; }
+  else { inherit builder built; inherit (pkgs) linkchecker lftp; }

deploy.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# TODO: make this with tempfile
+KEYFILE=__TEMP_INPUT_KEY_FILE
+
+echo "${WWW_HASKELL_ORG_SSH_KEY}" > "$KEYFILE"
+chmod 600 "$KEYFILE"
+
+if [ "$1" = --DEPLOY-IT-LIVE ]; then
+    DESTINATION=www
+else
+    DESTINATION=www-test
+fi
+
+# WARNING: --delete is dangerous.  Be absolutely sure you are
+# deploying to the correct directory.  Existing contents of the
+# destination directory will be removed.
+#
+# Permissions: We have to recursively set write permissions because
+# lftp isn't able to remove a file if its directory is not writeable.
+lftp --norc -c "set net:max-retries 1; set sftp:connect-program \"ssh -o StrictHostKeyChecking=no -a -x -i $KEYFILE\"; open -u www-sftp, sftp://webhost.haskell.org; chmod --recursive u+w $DESTINATION; mirror --delete --verbose --reverse --transfer-all built-site $DESTINATION"