deploy.yml.example

name: Deploy PiClock to the Pi

# TEMPLATE — this file does nothing where it sits. To activate it, copy it to
# .gitea/workflows/deploy.yml, replace <pi-host> below, and complete the
# one-time host bootstrap described in deploy/README.md.
#
# Deploys are triggered ONLY by prod-* tags, never by a branch push. Note: the
# workflow that runs is the version in the tagged commit's tree, so only tag
# commits that already contain this file.
on:
  push:
    tags:
      - prod-*

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Check out tagged source
        uses: actions/checkout@v4
        # If your Gitea instance serves a self-signed certificate, uncomment:
        # env:
        #   GIT_SSL_NO_VERIFY: "true"

      - name: Build deploy artifact
        id: artifact
        run: |
          set -eu
          deploy_sha="$(git rev-parse --short=12 HEAD)"
          echo "sha=$deploy_sha" >> "$GITHUB_OUTPUT"
          # Ship only the runtime clock bundle. Host bootstrap files, docs,
          # tests, CI config, and any operator-only tree stay out of the Pi
          # deploy payload.
          git archive --format=tar -o "piclock-${deploy_sha}.tar" HEAD \
            main.py piclock requirements.txt requirements-homekit.txt
          gzip -9 "piclock-${deploy_sha}.tar"

      - name: Deploy artifact to the Pi
        env:
          PICLOCK_DEPLOY_KEY: ${{ secrets.PICLOCK_DEPLOY_KEY }}
          PICLOCK_HOST_KEY: ${{ secrets.PICLOCK_HOST_KEY }}
          DEPLOY_SHA: ${{ steps.artifact.outputs.sha }}
        run: |
          set -eu
          key_file="$(mktemp)"
          known_hosts="$(mktemp)"
          trap 'rm -f "$key_file" "$known_hosts"' EXIT
          printf '%s\n' "$PICLOCK_DEPLOY_KEY" > "$key_file"
          chmod 600 "$key_file"
          # Host key pinning: PICLOCK_HOST_KEY is the Pi's public host key (the
          # one-time `ssh-keyscan -t ed25519 <pi-host>` line — see
          # deploy/README.md). CI then verifies it is talking to the real Pi
          # rather than trusting whatever answers, and a deploy fails loudly if
          # the host key ever changes (e.g. after reimaging the SD card —
          # re-run ssh-keyscan and update the secret).
          printf '%s\n' "$PICLOCK_HOST_KEY" > "$known_hosts"

          # The piclock-deploy account's key is pinned to a forced command
          # (piclock-receive), so the requested command below is only a label it
          # validates/logs; the gzipped tarball is piped in over stdin.
          # Replace <pi-host> with your Pi's hostname or IP (it must match the
          # host field of the PICLOCK_HOST_KEY line).
          ssh -i "$key_file" \
            -o UserKnownHostsFile="$known_hosts" \
            -o StrictHostKeyChecking=yes \
            -o BatchMode=yes \
            piclock-deploy@<pi-host> \
            "deploy ${DEPLOY_SHA}" < "piclock-${DEPLOY_SHA}.tar.gz"