deploy.yml

name: Deploy to Production

on:
  push:
    branches: [master]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20' # or your version

      - name: Install dependencies
        run: npm ci

      - name: Build project
        run: npm run build

      # rsync, not scp: scp only copies INTO the target and never removes what
      # is no longer in dist/. Vite content-hashes every bundle, so each build
      # emits new filenames and the old generation stays forever — this webroot
      # had accumulated 255 asset files (39 MB) from ~6 builds. --delete makes
      # the webroot an exact mirror of dist/.
      #
      # .well-known is excluded on purpose: on this server it can hold
      # hand-placed NIP-05 (nostr.json) and ACME challenge files that are not
      # part of any build, and --delete would otherwise destroy them.
      - name: Deploy to production server
        uses: burnett01/rsync-deployments@v9
        with:
          # No -p, plus --omit-dir-times: the webroot is root:deployers and the
          # deploy user can write INSIDE it but does not own it. Preserving
          # permissions or directory times makes rsync chmod/utimensat the
          # target directory itself, which returns EPERM and exits 23 — turning
          # a fully successful transfer into a red build.
          # Files still land 644 root-group-inherited: the directory is setgid
          # (2775 root:deployers), so new files get group deployers, and the
          # deploy user's umask gives 644.
          switches: -rlt --omit-dir-times --delete --exclude='.well-known/'
          path: dist/
          remote_path: ${{ secrets.PROD_PATH }}
          remote_host: ${{ secrets.PROD_HOST }}
          remote_port: ${{ secrets.PROD_PORT }}
          remote_user: ${{ secrets.PROD_USER }}
          remote_key: ${{ secrets.PROD_SSH_KEY }}