privacyguides.org/.github/workflows/production.yml

name: Production Deploy
concurrency:
  group: Production
  cancel-in-progress: true

on:
  push:
    branches: [ main ]

env:
  FONTAWESOME_NPM_AUTH_TOKEN: ${{ secrets.FONTAWESOME_NPM_AUTH_TOKEN }}

jobs:
  build:
    name: Jekyll Build
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: true
    - uses: actions/setup-node@v3
      with:
        node-version: '14'
    - name: Cache Jekyll build
      uses: actions/cache@v2
      with:
        path: |
          .jekyll-cache
          .sass-cache          
        key: ${{ runner.os }}-jekyll-${{ hashFiles('**/*.??m[ld]') }}
    - name: Install dependencies
      run: npm install
    - name: Build website
      uses: ./.github/actions/build
    - run: tar cvf site.tar _site
    - name: Upload generated Jekyll site
      uses: actions/upload-artifact@v2
      with:
        name: generated-site
        path: site.tar

  deploy:
    name: Rsync Deploy
    runs-on: ubuntu-latest
    environment: production
    needs: build

    steps:
    - name: Download generated Jekyll site
      uses: actions/download-artifact@v2
      with:
        name: generated-site
    - run: tar xvf site.tar
    - name: Copy built site to production
      run: |
        mkdir -p ~/.ssh
        echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_rsa
        chmod 700 ~/.ssh/id_rsa
        ssh-keyscan -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts
        rsync -azP --delete _site/ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:${{ secrets.SSH_PATH }}