From f39c471e8ec937f8b78a3251d0791c07d78a4d83 Mon Sep 17 00:00:00 2001
From: Aswin Biju <aswinbs@cosq.net>
Date: Thu, 5 Nov 2026 00:12:45 +0530
Subject: [PATCH] chore: added deploy pipeline for srsapp.cloud

---
 .gitea/workflows/deploy.yml | 48 +++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .gitea/workflows/deploy.yml

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..49d8607
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,48 @@
+name: deploy
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://github.com/subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+        with:
+          flutter-version: 3.44.1
+          channel: stable
+          cache: true
+
+      - run: flutter pub get --enforce-lockfile
+      - run: flutter analyze
+      - run: flutter test
+      - run: flutter build web --release
+
+      - name: Put it live on the VPS
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key && chmod 600 ~/.ssh/deploy_key
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=15 srs@$DEPLOY_HOST"
+
+          # Unpack into releases/<commit>, switch `current` to it in one step, keep the newest 3.
+          tar -czf - -C build/web . | $SSH "flock -w 300 ~/.srs-web-deploy.lock bash -c '
+            set -euo pipefail
+            cd /var/www/srs-pwa && mkdir -p releases
+            rm -rf releases/$GITHUB_SHA releases/.incoming && mkdir releases/.incoming
+            tar -xz -C releases/.incoming && mv releases/.incoming releases/$GITHUB_SHA
+            ln -sfn releases/$GITHUB_SHA current.new && mv -Tf current.new current
+            ls -1t releases | tail -n +4 | xargs -r -I{} rm -rf releases/{}
+            echo Live: \$(readlink current)
+          '"