a

dotnet-systemd-ssh.yml

@@ -0,0 +1,24 @@
+on:
+  workflow_call:
+    inputs:
+      project_path: { required: true, type: string }   # e.g. Backend/EZLineGo
+      env:          { required: true, type: string }   # prod | stage
+      ssh_user:     { required: true, type: string }
+      ssh_host:     { required: true, type: string }
+      stamp:        { required: true, type: string }
+    secrets:
+      SSH_KEY: { required: true }
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: dotnet publish ${{ inputs.project_path }} -c Release -r linux-x64 --no-self-contained -o publish
+      - run: cd publish && zip -rq ../payload.zip .
+      - name: Add SSH key
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ inputs.ssh_host }} >> ~/.ssh/known_hosts
+      - run: |
+          scp payload.zip ${{ inputs.ssh_user }}@${{ inputs.ssh_host }}:/tmp/${{ inputs.stamp }}-$(basename ${{ inputs.project_path }}).zip

static-aws.yml

@@ -0,0 +1,26 @@
+on:
+  workflow_call:
+    inputs:
+      build_cmd:     { required: true,  type: string }
+      dist_dir:      { required: true,  type: string }
+      s3_bucket:     { required: true,  type: string }
+      cf_dist_id:    { required: true,  type: string }
+      exclude_glob:  { required: false, type: string, default: "" }
+    secrets:
+      AWS_ACCESS_KEY_ID:     { required: true }
+      AWS_SECRET_ACCESS_KEY: { required: true }
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: ${{ inputs.build_cmd }}
+      - env:
+          AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION:    eu-central-1
+        run: |
+          EXCLUDES=""
+          [ -n "${{ inputs.exclude_glob }}" ] && for g in ${{ inputs.exclude_glob }}; do EXCLUDES="$EXCLUDES --exclude $g"; done
+          aws s3 sync ${{ inputs.dist_dir }}/ s3://${{ inputs.s3_bucket }}/ --delete $EXCLUDES
+          aws cloudfront create-invalidation --distribution-id ${{ inputs.cf_dist_id }} --paths "/*"

static-rsync-ssh.yml

@@ -0,0 +1,24 @@
+on:
+  workflow_call:
+    inputs:
+      build_cmd:    { required: true, type: string }
+      dist_dir:     { required: true, type: string }
+      ssh_user:     { required: true, type: string }
+      ssh_host:     { required: true, type: string }
+      remote_path:  { required: true, type: string }
+    secrets:
+      SSH_KEY: { required: true }
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: ${{ inputs.build_cmd }}
+      - name: Add SSH key
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ inputs.ssh_host }} >> ~/.ssh/known_hosts
+      - run: |
+          rsync -az --delete ${{ inputs.dist_dir }}/ ${{ inputs.ssh_user }}@${{ inputs.ssh_host }}:${{ inputs.remote_path }}/
+          ssh ${{ inputs.ssh_user }}@${{ inputs.ssh_host }} "sudo nginx -t && sudo systemctl reload nginx"