Automate deployment: push to main now deploys itself

Registered a repo-scoped self-hosted runner (hcl-local-deploy) directly on the box serving hcl.archipelago-foundation.org, running in host (not docker) execution mode. Deploy is a plain local rsync — no SSH keys or remote credentials needed, since the runner already has filesystem access to the docroot. Runs as the debian user with no sudo; docroot ownership was changed from www-data to debian so this works without any privilege escalation (nginx only needs read access to serve it). ci.yml now runs on pull_request only — deploy.yml already validates before deploying on push to main, so running both on every push would just duplicate the check. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-03 22:55:26 +00:00
parent 38223d1a3b
commit dcc09ddee4
3 changed files with 53 additions and 9 deletions
@@ -0,0 +1,23 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    # Runs on a repo-scoped self-hosted runner living on the same box that
+    # serves hcl.archipelago-foundation.org, specifically so deploy is a
+    # plain local file copy — no SSH keys or remote credentials to manage.
+    runs-on: hcl-deploy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Build and validate every report
+        run: python3 scripts/build.py
+
+      - name: Deploy to the live docroot
+        run: rsync -a --delete site/ /var/www/hcl.archipelago-foundation.org/