deploy.yml

name: Deploy to Bluehost — cassa.bd/courses/ast100

on:
  push:
    branches: [main]
  # Manual re-run from the Actions tab without needing a new commit.
  workflow_dispatch:

# Cancel an in-flight run if a newer push arrives on the same branch.
concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  deploy:
    name: Build & Sync to Bluehost
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22        # matches package.json engines (>=22.12.0)
          cache: npm              # cache ~/.npm across runs

      - name: Install dependencies (npm ci)
        run: npm ci

      - name: Build Astro static site
        run: npm run build

      # Write the CI deploy key + pinned host key. These are the SAME
      # credentials as the sibling `cassa` repo (rotated 2026-06-04).
      # IdentitiesOnly=yes is essential: it offers ONLY this key, avoiding the
      # server's "Too many authentication failures" disconnect.
      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.BLUEHOST_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          echo "${{ secrets.BLUEHOST_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts

      # rsync ./dist/ → public_html/courses/ast100/ on Bluehost. --delete
      # mirrors the build into THIS sub-directory only; it cannot touch the
      # sibling sites (the root / and /abekta) because they live outside the
      # destination path.
      - name: Deploy with rsync
        run: |
          rsync -avz --delete --human-readable \
            -e "ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o UserKnownHostsFile=~/.ssh/known_hosts" \
            dist/ \
            "${{ secrets.BLUEHOST_USER }}@${{ secrets.BLUEHOST_HOST }}:public_html/courses/ast100/"