.github/workflows/deploy.yml is the one deploy for SiteOrigin sites. It logs in to the server as deploy, checks the server's key against a pinned copy, and runs one script from /home/deploy/bin. Those scripts, and so-deploy behind them, are in siteorigin/siteorigin-servers.
Each site repo has one .github/workflows/deploy.yml like this:
name: Deploy
on:
push:
branches: [master, testing]
jobs:
deploy:
uses: siteorigin/.github/.github/workflows/deploy.yml@v1
with:
live: deploy-siteorigin-theme
test: deploy-siteorigin-test-theme
secrets: inheritmaster or main deploys the live site. testing or staging deploys the test site. A repo that uses other branch names sets live-branches or test-branches, for example test-branches: develop. A repo with no test site leaves out test. Either way, push: branches: lists every branch that deploys.
After the deploy, the workflow checks that the script reported a commit and that the site answers with a 2xx or 3xx. If either fails, the run fails, and the deployed files stay in place. A new site adds its address to the "Check the deploy" step.
Each site repo holds the same secret names. The values never appear in this repo.
| Secret | What it is |
|---|---|
DEPLOY_SSH_KEY |
The private CI deploy key. It can only run deploy scripts; siteorigin-servers replaces it with scripts/rotate-ci-key.sh. |
DEPLOY_HOST |
The live site's server address. |
DEPLOY_KNOWN_HOSTS |
The live server's public key, as one known_hosts line. |
TEST_DEPLOY_HOST |
The test site's server address. Only with a test site. |
TEST_DEPLOY_KNOWN_HOSTS |
The test server's public key. Only with a test site. |
A missing secret fails the run and names it.
Site repos call @v1. A change that keeps every caller working moves the v1 tag. A change that needs callers to change is v2, and each repo moves when it is ready.