setup-autodeploy.yml

name: Setup auto deploy

on:
  workflow_dispatch:
    inputs:
      project:
        description: "Project/subdomain name (e.g. 'lab')"
        required: true
        type: string
      repo:
        description: "Target repository, as 'owner/name'"
        required: true
        type: string
      branch:
        description: "Branch whose pushes trigger a deploy"
        required: false
        type: string
        default: master
      dry_run:
        description: "Print every call it would make, and make none"
        required: false
        type: boolean
        default: false
      skip_workflow_file:
        description: "Don't commit the workflow to the repository, just print it"
        required: false
        type: boolean
        default: false
      skip_secrets:
        description: "Leave the repository secrets alone"
        required: false
        type: boolean
        default: false
      skip_ftp:
        description: "Leave the FTP account alone, it already exists (with skip_secrets + force this updates only the workflow)"
        required: false
        type: boolean
        default: false
      force:
        description: "Overwrite a deploy workflow that is already there and different"
        required: false
        type: boolean
        default: false
      skip_posthog_check:
        description: "Don't check the repository for the PostHog snippet (for sites created without PostHog)"
        required: false
        type: boolean
        default: false

# Il job non usa il GITHUB_TOKEN: scrive sul repository di destinazione con
# GITHUB_PAT, e su questo repository non gli serve nessuno scope.
permissions: {}

jobs:
  setup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - run: pip install -r requirements.txt

      - name: Set up the auto deploy
        env:
          CPANEL_HOST: ${{ secrets.CPANEL_HOST }}
          CPANEL_USER: ${{ secrets.CPANEL_USER }}
          CPANEL_API_TOKEN: ${{ secrets.CPANEL_API_TOKEN }}
          ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
          SERVER_IP: ${{ secrets.SERVER_IP }}
          # PAT personale, NON il GITHUB_TOKEN del run: quest'ultimo vale solo
          # per questo repository e non potrebbe scrivere su quello di
          # destinazione. Serve lo scope 'workflow' oltre a 'repo'.
          GITHUB_PAT: ${{ secrets.DEPLOY_GITHUB_PAT }}
          # Gli input passano dall'ambiente, NON interpolati dentro lo script:
          # "${{ inputs.project }}" verrebbe incollato prima che bash lo parsi,
          # e un valore tipo  x") ; comando ; ARGS=("y  eseguirebbe codice
          # arbitrario con tutti i secrets qui sopra nell'ambiente.
          PROJECT: ${{ inputs.project }}
          REPO: ${{ inputs.repo }}
          BRANCH: ${{ inputs.branch }}
          DRY_RUN: ${{ inputs.dry_run }}
          SKIP_WORKFLOW_FILE: ${{ inputs.skip_workflow_file }}
          SKIP_SECRETS: ${{ inputs.skip_secrets }}
          SKIP_FTP: ${{ inputs.skip_ftp }}
          FORCE: ${{ inputs.force }}
          SKIP_POSTHOG_CHECK: ${{ inputs.skip_posthog_check }}
        run: |
          ARGS=("$PROJECT" --repo "$REPO" --branch "$BRANCH")
          [ "$DRY_RUN" = "true" ] && ARGS+=(--dry-run)
          [ "$SKIP_WORKFLOW_FILE" = "true" ] && ARGS+=(--skip-workflow-file)
          [ "$SKIP_SECRETS" = "true" ] && ARGS+=(--skip-secrets)
          [ "$SKIP_FTP" = "true" ] && ARGS+=(--skip-ftp)
          [ "$FORCE" = "true" ] && ARGS+=(--force)
          [ "$SKIP_POSTHOG_CHECK" = "true" ] && ARGS+=(--skip-posthog-check)
          # Niente --show-password: qui finirebbe nel log del run. La password
          # generata è già dentro il secret FTP_PASSWORD del repository di
          # destinazione; per WinSCP resettala da cPanel → FTP Accounts.
          python setup_autodeploy.py "${ARGS[@]}"