Move deploy to private repo

.github/workflows/pr-merge-main.yml

@@ -1,13 +1,14 @@
 name: PR Merge (main)
 
+# This workflow publishes secret-free CI images used by pubstudio's integration tests.
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
 env:
   WORKSPACE_ROOT: .
-  ENVIRONMENT: stg
   CACHE_SUFFIX: c # cache busting
 
 # Cancel redundant workflow runs
@@ -62,7 +63,7 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/env-setup
       - name: Build apps
-        run: npx nx run-many -t build --projects="web*" --parallel=3 && npx nx build-hydrate web-site && npx nx build ssg
+        run: npx nx run-many -t build --projects="web*" --parallel=3 && npx nx build-hydrate web-site
       - name: Upload web-site bundle
         uses: actions/upload-artifact@v7
         with:
@@ -79,31 +80,12 @@ jobs:
             ./dist/apps/web-site-hydrate/site.js
           if-no-files-found: error
           retention-days: 1
-      - name: Upload ssg bundle
-        uses: actions/upload-artifact@v7
-        with:
-          name: ssg-bundle
-          path: |
-            ./dist/apps/ssg
-          if-no-files-found: error
-          retention-days: 1
 
   build-backend:
     needs: pre_job
     if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
     name: Build Backend
     runs-on: ubuntu-22.04
-    env:
-      TARGET_FLAGS:
-      CARGO: cargo
-      CROSS_VERSION: v0.2.5
-    strategy:
-      matrix:
-        include:
-          - target: aarch64-unknown-linux-gnu
-            folder: linux/arm64
-          - target: x86_64-unknown-linux-gnu
-            folder: linux/amd64
     steps:
       - name: Checkout code into workspace directory
         uses: actions/checkout@v7
@@ -113,43 +95,28 @@ jobs:
         uses: dtolnay/rust-toolchain@master
         with:
           toolchain: '1.90.0'
-      - name: Use Cross
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
-        run: |
-          # In the past, new releases of 'cross' have broken CI. So for now, we
-          # pin it. We also use their pre-compiled binary releases because cross
-          # has over 100 dependencies and takes a bit to compile.
-          dir="$RUNNER_TEMP/cross-download"
-          mkdir "$dir"
-          echo "$dir" >> $GITHUB_PATH
-          cd "$dir"
-          curl -LO "https://github.com/cross-rs/cross/releases/download/$CROSS_VERSION/cross-x86_64-unknown-linux-musl.tar.gz"
-          tar xf cross-x86_64-unknown-linux-musl.tar.gz
-          echo "CARGO=cross" >> $GITHUB_ENV
-          echo "TARGET_FLAGS=--target ${{ matrix.target }}" >> $GITHUB_ENV
-          # echo "TARGET_DIR=./target/${{ matrix.target }}" >> $GITHUB_ENV
       - name: Cache build
         uses: Swatinem/rust-cache@v2
         with:
-          key: pr-${{ matrix.target }}-${{ env.CACHE_SUFFIX }}
+          key: pr-x86_64-unknown-linux-gnu-${{ env.CACHE_SUFFIX }}
           workspaces: backend
       - name: Build app in release mode
-        run: cd backend && ${{ env.CARGO }} build --release --target ${{ matrix.target }}
-      - name: Copy app to target folder for Docker multi-arch build
+        run: cd backend && cargo build --release --target x86_64-unknown-linux-gnu
+      - name: Copy app to target folder for Docker build
         run: |
-          mkdir -p ./backend/target/${{ matrix.folder }}/release
-          cp ./backend/target/${{ matrix.target }}/release/site-api ./backend/target/${{ matrix.folder }}/release/site-api
+          mkdir -p ./backend/target/linux/amd64/release
+          cp ./backend/target/x86_64-unknown-linux-gnu/release/site-api ./backend/target/linux/amd64/release/site-api
       - name: Upload binaries
         uses: actions/upload-artifact@v7
         with:
-          name: backend-binaries-${{ matrix.target }}
+          name: backend-binaries-x86_64-unknown-linux-gnu
           path: |
-            ./backend/target/${{ matrix.folder }}/release/site-api
+            ./backend/target/linux/amd64/release/site-api
           if-no-files-found: error
           retention-days: 1
 
   build-docker-site-api-ci:
-    needs: [pre_job, build-backend, repo-metadata]
+    needs: [pre_job, build-apps, build-backend, repo-metadata]
     if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
     name: Site API CI Image
     runs-on: ubuntu-22.04
@@ -182,13 +149,11 @@ jobs:
           registry: ghcr.io
           username: ${{github.actor}}
           password: ${{secrets.GITHUB_TOKEN}}
-      - name: Build and push prod docker image
+      - name: Build and push CI docker image
         id: docker_build
         uses: docker/build-push-action@v7
         with:
           context: ${{env.WORKSPACE_ROOT}}
-          # Include non-secret args so we don't need them in the site-api server env
-          # Except SITE_API_HOST, which is unique to each server
           build-args: |
             "EXEC_ENV=ci"
             "PLATFORM_WEB_URL=http://127.0.0.1:3000"
@@ -212,115 +177,3 @@ jobs:
           tags: |
             ${{needs.repo-metadata.outputs.repo_slug}}/ci/${{env.APP_NAME}}:${{env.BRANCH_NAME}}-${{needs.repo-metadata.outputs.sha8}}-${{github.run_number}}
             ${{needs.repo-metadata.outputs.repo_slug}}/ci/${{env.APP_NAME}}:latest
-
-  build-docker-site-api-stg:
-    needs: [pre_job, build-backend, repo-metadata]
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
-    name: Site API Production Image
-    runs-on: ubuntu-22.04
-    env:
-      APP_NAME: site-api
-      BRANCH_NAME: main
-    steps:
-      - name: Checkout code into workspace directory
-        uses: actions/checkout@v7
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-      - name: Download arm64 binary
-        uses: actions/download-artifact@v8
-        with:
-          name: backend-binaries-aarch64-unknown-linux-gnu
-          path: ./backend/target/linux/arm64/release/${{env.APP_NAME}}
-      - name: Download amd64 binary
-        uses: actions/download-artifact@v8
-        with:
-          name: backend-binaries-x86_64-unknown-linux-gnu
-          path: ./backend/target/linux/amd64/release/${{env.APP_NAME}}
-      - name: Download web-site bundle
-        uses: actions/download-artifact@v8
-        with:
-          name: web-site-bundle
-          path: ./dist/apps/web-site/index.html
-      - name: Download hydration runtime
-        uses: actions/download-artifact@v8
-        with:
-          name: web-site-hydrate-bundle
-          path: ./dist/apps/web-site-hydrate/site.js
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{secrets.GITHUB_TOKEN}}
-      - name: Build and push prod docker image
-        id: docker_build
-        uses: docker/build-push-action@v7
-        with:
-          context: ${{env.WORKSPACE_ROOT}}
-          # Include non-secret args so we don't need them in the site-api server env
-          # Except SITE_API_HOST, which is unique to each server
-          build-args: |
-            "EXEC_ENV=stg"
-            "PLATFORM_WEB_URL=https://stg.pubstud.io"
-            "DATABASE_URL=sqlite:site-api/db/metadata/sites_metadata.db"
-            "SITE_API_PORT=3100"
-            "SITE_API_HOST=0.0.0.0"
-            "SITE_ADMIN_PUBLIC_KEY=LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUF4WUdaVEVrbVltZXpCVGxNWlF1cwp4MU5uMHY1MGZRdVIySUZsaE1uelcybjkveEhDc3Btb29BT0MyTklVRGNyVEV5clZ6WVNvZ1dzU1lDTWNGM1A5CjRFTkR3ZjhtWFZYS3dST0Jwa2ZFNDJCTHFPdElzVFc0RkxjeWtPUXBrOS91K1hNOENrT1Ywa2xRSlRqZndCT24KWnlFZ2JVT2NmTHBGNXVDMDBBWURlOUxwWW52WjZ3RWZhckZIcmY0cHhhNTQ3aXZqZ3poSlhCVy9aSWFNTmNyawoyU1Z6UzE0a0ZVOEtGckNQTytIT2J0ek1HQllIbWwwL3RldFl2L0RLcDdVM0pLRlJSODhpY1JwMjhhWWNCemlJCnNMN00xb1haWjlIRDZpZ0ppajlsdXdPM01mMkZ4REh0L2huL0U1TnNjdkpTMXZ3dGNIM3YyQUFLajg5UlljUUMKWllyaDNnSlgyQkJOUis0S1hlRE9QTm94RDFYWEY2cFVQSVZ3VzVlZWEzQUNQZmRyVitQRnluL2t0RGl0M28rMQpKQThGcG9xeGZpdS9yRXh0YUFKQTlxZTUvSWxBYUxQRmRUVklQU050L1VraGRibDlsaGY1VW9FMGFuU3FISGIvCmxqelc2YVl3ekZTT1dIRzJSNk5YN1EyTWY5ZjFtUXdicG9ZNTg0YjFqM1JRT1lGSVhVeENEOTlEVTlMcmtMdlEKa1YrR2dMMTFtOWxYTWMxOHFDb3hkREdJVnNlbkFCMVJlR1ZYQUFJTEU5Qy9JeWNiZlFVRnBCVE1Sb05aOUhEVgovSzhxRjJSSlZGb1gzdnpKcDhPUWk1NTU2Tjd3dnJlYVVlVS9lTzJBdzFyWEZQekgrRmNuejNnLzlDbCtDdnVkCm1WY1VZYWVmOC90T2FrNm4zRTVuakZNQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo="
-            "S3_URL=https://5c1306ea6e8d53469625b2c687ab7190.r2.cloudflarestorage.com"
-            "S3_ACCESS_KEY_ID=2f0c694897771fb4c2650fba24fc483e"
-            "S3_SECRET_ACCESS_KEY=${{ secrets.S3_SECRET_ACCESS_KEY_STG }}"
-            "MAX_BACKUPS=10"
-            "MAILSENDER_API_KEY=${{ secrets.MAILSENDER_API_KEY_STG }}"
-            "SLACK_WEBHOOK_INFO_URL=${{ secrets.SITE_API_SLACK_WEBHOOK_URL_STG }}"
-            "SLACK_WEBHOOK_ERROR_URL=${{ secrets.SITE_API_SLACK_WEBHOOK_URL_STG }}"
-            "LAST_COMMIT_SHA=${{needs.repo-metadata.outputs.sha8}}"
-            "RELEASE_VERSION=${{needs.repo-metadata.outputs.next_version}}"
-          push: true
-          file: ${{env.WORKSPACE_ROOT}}/backend/${{env.APP_NAME}}/Dockerfile
-          target: prod
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{needs.repo-metadata.outputs.repo_slug}}/${{env.ENVIRONMENT}}/${{env.APP_NAME}}:${{env.BRANCH_NAME}}-${{needs.repo-metadata.outputs.sha8}}-${{github.run_number}}
-            ${{needs.repo-metadata.outputs.repo_slug}}/${{env.ENVIRONMENT}}/${{env.APP_NAME}}:latest
-
-  build-docker-ssg-stg:
-    needs: [pre_job, build-apps, repo-metadata]
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
-    name: SSG Staging Image
-    runs-on: ubuntu-22.04
-    env:
-      APP_NAME: ssg
-      BRANCH_NAME: main
-    steps:
-      - name: Checkout code into workspace directory
-        uses: actions/checkout@v7
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-      - name: Download ssg bundle
-        uses: actions/download-artifact@v8
-        with:
-          name: ssg-bundle
-          path: ./dist/apps/${{env.APP_NAME}}
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{github.actor}}
-          password: ${{secrets.GITHUB_TOKEN}}
-      - name: Build and push ssg docker image
-        id: docker_build
-        uses: docker/build-push-action@v7
-        with:
-          context: ${{env.WORKSPACE_ROOT}}
-          push: true
-          # The generator is an app, not a backend service, so its Dockerfile
-          # lives under apps/ rather than backend/
-          file: ${{env.WORKSPACE_ROOT}}/apps/${{env.APP_NAME}}/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{needs.repo-metadata.outputs.repo_slug}}/${{env.ENVIRONMENT}}/${{env.APP_NAME}}:${{env.BRANCH_NAME}}-${{needs.repo-metadata.outputs.sha8}}-${{github.run_number}}
-            ${{needs.repo-metadata.outputs.repo_slug}}/${{env.ENVIRONMENT}}/${{env.APP_NAME}}:latest