deploy.yml

# Les variables suivantes doivent être configurées dans les Secrets du repo GitHub :
# CPANEL_USERNAME  : Nom d’utilisateur cPanel.
# CPANEL_API_TOKEN : Jeton d'API cPanel (cPanel > Sécurité > Gérer les jetons d'API).
#                    Remplace l'ancien CPANEL_PASSWORD : o2switch n'accepte plus l'authentification par mot de passe
#                    sur l'API de liste blanche SSH (https://faq.o2switch.fr/cpanel/outils/exception-parefeu/).
# CPANEL_SERVER    : Adresse du serveur cPanel (exemple : monserveur.o2switch.net).
# SSH_PRIVATE_KEY  : Clé privée SSH pour l’authentification.
# SUBMODULE_TOKEN  : Token GitHub permettant de récupérer le sous-module scripts.

name: Deploy to Production

on:
  push:
    branches: [master]
  repository_dispatch:
    types: [submodule_updated]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      # Utilisés par .github/scripts/ssh-whitelist.sh (les secrets sont masqués dans les logs)
      CPANEL_SERVER: ${{ secrets.CPANEL_SERVER }}
      CPANEL_USERNAME: ${{ secrets.CPANEL_USERNAME }}
      CPANEL_API_TOKEN: ${{ secrets.CPANEL_API_TOKEN }}
      WHITELIST: bash .github/scripts/ssh-whitelist.sh
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          submodules: recursive
          token: ${{ secrets.SUBMODULE_TOKEN }}

      - name: Update scripts submodule to latest master
        run: |
          cd scripts
          git checkout master
          git pull origin master
          cd ..
          echo "Scripts submodule is now at commit: $(git -C scripts rev-parse HEAD)"

      - name: Get the public IP of the GitHub runner
        id: ip
        run: |
          IP=$(curl -4 -sf --max-time 10 https://api.ipify.org || curl -4 -sf --max-time 10 https://checkip.amazonaws.com)
          IP=$(echo "$IP" | tr -d "[:space:]")
          if [[ ! "$IP" =~ ^[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+$ ]]; then
            echo "Impossible de déterminer l'IP publique du runner : '$IP'"
            exit 1
          fi
          echo "Runner public IP: $IP"
          echo "ipv4=$IP" >> "$GITHUB_OUTPUT"

      - name: List all whitelisted IPs
        id: list-ips
        run: $WHITELIST list

      #Les adresses IP à conserver dans la liste blanche du serveur sont à définir dans KEEP_IPS
      - name: Remove unneeded whitelisted IPs
        env:
          RUNNER_IP: ${{ steps.ip.outputs.ipv4 }}
          WHITELISTED_IPS: ${{ steps.list-ips.outputs.ips }}
        run: |
          KEEP_IPS="109.137.71.77 92.184.106.90 $RUNNER_IP"

          for ip in $(echo "$WHITELISTED_IPS" | tr ',' ' '); do
            if [[ " $KEEP_IPS " == *" $ip "* ]]; then
              echo "Keeping IP: $ip"
            else
              echo "Removing IP: $ip"
              $WHITELIST remove "$ip"
            fi
          done

      - name: Add runner IP to whitelist
        run: $WHITELIST add "${{ steps.ip.outputs.ipv4 }}"

      - name: Verify whitelist contains runner IP
        run: $WHITELIST verify "${{ steps.ip.outputs.ipv4 }}"

      - name: Installing the SSH Key
        run: |
          eval $(ssh-agent -s)
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 0400 ~/.ssh/id_rsa

      - name: Sending data with RSYNC
        run: |
          BACKUP_DIR=../backup_datan/$(date +%Y%m)
          rsync --timeout=300 -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
            --exclude='*/config/development' \
            --exclude='*/logs/log-*.php' \
            --exclude='*/cache/*' \
            --exclude='user_guide_src/build/*' \
            --exclude='user_guide_src/cilexer/build/*' \
            --exclude='user_guide_src/cilexer/dist/*' \
            --exclude='user_guide_src/cilexer/pycilexer.egg-info/*' \
            --exclude='application/logs/*' \
            --exclude='/vendor/' \
            --exclude='application/config/custom_config.php' \
            --exclude='node_modules' \
            --exclude='test' \
            --exclude='.sass-cache' \
            --exclude='package-lock.json' \
            --exclude='.gitattributes' \
            --exclude='ressources' \
            --exclude='.htaccess' \
            --exclude='.env' \
            --exclude='*.code-workspace' \
            --exclude='assets/opendata' \
            --exclude='assets/dataset_backup/general/*.sql' \
            --exclude='assets/imgs/deputes_original/' \
            --exclude='assets/imgs/deputes_ogp/' \
            --exclude='assets/imgs/deputes_webp/' \
            --exclude='assets/imgs/deputes_nobg/' \
            --exclude='assets/imgs/deputes_nobg_import/' \
            --exclude='assets/imgs/deputes_nobg_webp/' \
            --exclude='assets/imgs/posts/' \
            --exclude='assets/imgs/captcha/*.jpg' \
            --exclude='assets/data/*.json' \
            --exclude='assets/data/professions/election_4/*.pdf' \
            --exclude='assets/data/professions/election_6/*.pdf' \
            --exclude='assets/data/*.txt' \
            --exclude='assets/css/bootstrap*' \
            -av --backup --backup-dir=$BACKUP_DIR --delete ./ ${{ secrets.CPANEL_USERNAME }}@${{ secrets.CPANEL_SERVER }}:public_html

      - name: Clear cache on datan.fr
        run: |
          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa \
            ${{ secrets.CPANEL_USERNAME }}@${{ secrets.CPANEL_SERVER }} \
            "php /home/${{ secrets.CPANEL_USERNAME }}/public_html/index.php cache clear_cli"

      - name: Cleaning SSH keys
        if: always()
        run: rm -fr ~/.ssh