Add authenticated photo uploads and GitHub Actions publishing

2026-09-19 14:16:13 +03:30
parent 0e7c825215
commit 25c82662b7
17 changed files with 873 additions and 12 deletions
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${DEPLOY_HOST:?Missing DEPLOY_HOST}"
+: "${DEPLOY_USER:?Missing DEPLOY_USER}"
+: "${DEPLOY_PATH:?Missing DEPLOY_PATH}"
+: "${DEPLOY_SSH_KEY:?Configure the DEPLOY_SSH_KEY Actions secret}"
+: "${DEPLOY_KNOWN_HOSTS:?Configure the DEPLOY_KNOWN_HOSTS Actions secret}"
+: "${GITHUB_SHA:?Missing build commit}"
+: "${GITHUB_RUN_NUMBER:?Missing run number}"
+: "${GITHUB_RUN_ATTEMPT:?Missing run attempt}"
+DEPLOY_PORT=${DEPLOY_PORT:-22}
+
+# These values cross an SSH shell boundary. Reject shell syntax.
+[[ $DEPLOY_HOST =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]*$ ]]
+[[ $DEPLOY_USER =~ ^[a-zA-Z0-9_][a-zA-Z0-9_-]*$ ]]
+[[ $DEPLOY_PATH =~ ^/[a-zA-Z0-9_/-]+$ && $DEPLOY_PATH != / ]]
+[[ $DEPLOY_PORT =~ ^[0-9]+$ && $GITHUB_SHA =~ ^[a-f0-9]{40}$ ]]
+[[ $GITHUB_RUN_NUMBER =~ ^[0-9]+$ && $GITHUB_RUN_ATTEMPT =~ ^[0-9]+$ ]]
+test -f _site/art/index.html
+test -f _site/photo-publication.json
+
+credentials=$(mktemp -d)
+trap 'rm -rf "$credentials"' EXIT
+chmod 700 "$credentials"
+printf '%s\n' "$DEPLOY_SSH_KEY" > "$credentials/key"
+printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$credentials/known_hosts"
+chmod 600 "$credentials/key" "$credentials/known_hosts"
+target="$DEPLOY_USER@$DEPLOY_HOST"
+release="$DEPLOY_PATH/releases/$GITHUB_RUN_NUMBER-$GITHUB_RUN_ATTEMPT-$GITHUB_SHA"
+ssh_options=(-i "$credentials/key" -p "$DEPLOY_PORT" -o BatchMode=yes
+    -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes
+    -o "UserKnownHostsFile=$credentials/known_hosts")
+ssh "${ssh_options[@]}" "$target" "mkdir -p '$release'"
+# Checksums and hard links avoid retransmitting existing photos on every build.
+printf -v transport 'ssh -i %q -p %q -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=%q' \
+    "$credentials/key" "$DEPLOY_PORT" "$credentials/known_hosts"
+rsync -azc --delete --link-dest="$DEPLOY_PATH/current/" -e "$transport" _site/ "$target:$release/"
+ssh "${ssh_options[@]}" "$target" "bash -s -- '$DEPLOY_PATH' '$release' '$GITHUB_RUN_NUMBER'" <<'REMOTE'
+set -euo pipefail
+destination=$1
+release=$2
+run=$3
+exec 9>"$destination/deploy.lock"
+flock 9
+test -f "$release/art/index.html"
+test -f "$release/photo-publication.json"
+previous=0
+if [ -f "$destination/current/deployment-run" ]; then
+    previous=$(cat "$destination/current/deployment-run")
+fi
+if (( run < previous )); then
+    echo "A newer workflow has already deployed; leaving the current site intact."
+    exit 0
+fi
+printf '%s\n' "$run" > "$release/deployment-run"
+chmod -R a+rX "$release"
+temporary="$destination/.current-$run-$$"
+ln -s "releases/$(basename "$release")" "$temporary"
+mv -Tf "$temporary" "$destination/current"
+echo "Deployed $release"
+REMOTE