deployments.yaml

name: Deployments
on:
  # Run the deployment only once staging has been prepared.
  workflow_run:
    workflows: ["Dry activations"]
    branches: [main]
    types:
      - completed
  push:
    branches: [main, production]
jobs:
  deploy-environment:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - environment: staging
            host: staging-tracker.security.nixos.org
            branch: main
          - environment: production
            host: tracker.security.nixos.org
            branch: production
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v29
      - uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
      - name: Trust staging server public SSH host keys
        run: cat ./infra/host_keys >> ~/.ssh/known_hosts
      - name: Deploy to ${{ matrix.environment }}
        # Only deploy production when on production branch
        if: github.ref_name == matrix.branch
        run: nix-shell default.nix -A ci --run "deploy switch ${{ matrix.host }}"