deploy.yml

name: deploy
on:
  push:
    branches: [ master ]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: '22.x'
        cache: 'npm'
    - run: npm install
    - run: npm audit --audit-level=moderate || true
    - name: Create placeholder keys for tests
      run: cp src/environments/keys.example.ts src/environments/keys.ts
    - name: Cache manifest data
      uses: actions/cache@v4
      with:
        path: |
          tools/manifest/.cache
          src/assets/destiny2-*.json
        key: manifest-v1-${{ hashFiles('src/assets/destiny2-version.json') }}
        restore-keys: manifest-v1-
    - name: Fetch Bungie manifest
      run: npm run manifest:fetch
      env:
        BUNGIE_API_KEY: ${{ secrets.API_KEY }}
    - run: npm run test:ci
    - run: npm run stage-prod-keys
      env:
        PROD_API_KEY: ${{ secrets.API_KEY }}
        PROD_CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
        PROD_DIM_API_KEY: ${{ secrets.DIM_API_KEY }}
    - run: npx ng build --configuration production
    - name: Deploy via rsync
      env:
        SSH_KEY: ${{ secrets.SSH }}
      run: |
        mkdir -p ~/.ssh
        echo "$SSH_KEY" > ~/.ssh/deploy_key
        chmod 600 ~/.ssh/deploy_key
        # Two-phase deploy so clients never load the new index.html (and the new
        # ?v= asset URLs baked into it) before every asset it references is fully
        # uploaded. A request for a new-versioned URL mid-upload returns the OLD
        # file, which Cloudflare then caches for 30 days under the NEW cache key,
        # poisoning the manifest for every client (see missing-guns bug, Jun 2026).
        rsync -avz --exclude=index.html \
          -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.PORT }}" \
          ./dist/browser/ \
          ${{ secrets.UID }}@${{ secrets.HOST }}:/home/${{ secrets.UID }}/d2checklist/
        rsync -avz --delete \
          -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.PORT }}" \
          ./dist/browser/ \
          ${{ secrets.UID }}@${{ secrets.HOST }}:/home/${{ secrets.UID }}/d2checklist/
        rm -f ~/.ssh/deploy_key