privacyguides.org/.github/workflows/deploy.yml

name: 📦 Deploy Website

on:
  workflow_dispatch:
  release:
    types: [published]

env:
  PYTHON_VERSION: 3.x

jobs:
  build:
    name: Build website
    runs-on: ubuntu-latest
    steps:

      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: '0'
          ref: ${{github.event.pull_request.head.ref}}
          repository: ${{github.event.pull_request.head.repo.full_name}}
          ssh-key: ${{ secrets.ACTIONS_SSH_KEY }}
          submodules: 'true'

      - name: Set up Python runtime
        uses: actions/setup-python@v4
        with:
          python-version: '3.7'
      
      - name: Cache files
        uses: actions/cache@v3.0.5
        with:
          key: ${{ github.ref }}
          path: .cache

      - name: Install Python dependencies
        run: |
          pip install pipenv
          pipenv install

      - name: Build website
        run: |
          pipenv run mkdocs build
          mv .well-known site/
          tar cvf site.tar site
          pipenv run mkdocs --version

      - name: Package website
        uses: actions/upload-artifact@v3
        with:
          name: generated-site
          path: site.tar

  deploy:
    name: Rsync Deploy
    runs-on: ubuntu-latest
    environment: production
    needs: build

    steps:
      - name: Download generated Jekyll site
        uses: actions/download-artifact@v3
        with:
          name: generated-site
      - run: tar xvf site.tar
      - name: Copy built site to production
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_rsa
          chmod 700 ~/.ssh/id_rsa
          ssh-keyscan -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts
          rsync -azP --delete site/ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:${{ secrets.SSH_PATH }}