name: Deploy site

# Auto-deploy the Hugo site to /var/www/furtka.org on push-to-main.
# Only fires when content under website/ changes — everything else
# (Python code, ISO build, runbook docs) is unaffected.
#
# Runs on the self-hosted runner, which is forge-runner-01 — the same
# host that serves furtka.org. So the "deploy" is just a local rsync
# of the Hugo source into /srv/furtka-site and a `hugo` build into
# /var/www/furtka.org. No SSH, no secrets, no cross-host anything.
#
# Requires two bind-mounts on the runner container (/srv/furtka-site
# and /var/www/furtka.org → same paths inside). See compose.yml.
on:
  push:
    branches: [main]
    paths:
      - 'website/**'

concurrency:
  group: deploy-site
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: self-hosted
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4

      - name: Install hugo + rsync
        # Runner image is alpine-based; apk is fast and cached.
        # Pinning is intentionally skipped — alpine:latest moves hugo
        # forward in lockstep with upstream, and the site only uses
        # baseline features.
        run: apk add --no-cache hugo rsync

      - name: Deploy
        run: ./website/deploy-ci.sh