deploy.yml

name: Build and Deploy
on:
  push:
    branches:
      - master
jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      # Runs before the build because `vuepress build` executes any <script>
      # block found in a Markdown file during server-side rendering. Checking
      # first means unsafe content stops the job instead of running in it.
      - name: Check Markdown for executable content 🔍
        run: node scripts/check-markdown.js

      - name: Install and Build 🔧
        run: |
          export NODE_OPTIONS=--openssl-legacy-provider
          # --frozen-lockfile: install exactly the tree pinned in yarn.lock
          #   (every entry carries an integrity hash) and fail if package.json
          #   and the lockfile have drifted apart. The previous `npm install`
          #   ignored yarn.lock entirely and re-resolved every ^ range on each
          #   deploy, so any new release in the tree shipped straight to prod.
          # --ignore-scripts: the only install hooks in this tree are core-js
          #   and vuepress funding notices; neither is needed to build.
          yarn install --frozen-lockfile --ignore-scripts
          yarn docs:build

      - name: Deploy 🚀
        env:
          SSH_HOST: ${{ secrets.DOCS_SSH_HOST }}
          SSH_PORT: ${{ secrets.DOCS_SSH_PORT }}
          SSH_USER: ${{ secrets.DOCS_SSH_USER }}
          SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
          REMOTE_PATH: ${{ secrets.DOCS_REMOTE_PATH }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > ~/.ssh/known_hosts 2>/dev/null

          rsync -avz --delete \
            -e "ssh -p $SSH_PORT -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts" \
            docs/.vuepress/dist/ "$SSH_USER@$SSH_HOST:$REMOTE_PATH/"