name: Deploy to droplet

on:
  push:
    branches: [main]
  workflow_dispatch: {}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      # The key below is restricted server-side to only run
      # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
      # droplet) — it can't run arbitrary commands even if this secret leaks.
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: root
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: deploy