deploy.yml

# yamllint --format github .github/workflows/deploy.yml
---
name: deploy

# We only deploy release tags
#
# See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
on:
  push:
    tags: '[0-9]+.[0-9]+.[0-9]+**'  # Ex. 8.272.10 or 21.0.1_p12

jobs:
  deploy:
    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1  # only needed to get the sha label
      # Don't attempt to cache Docker. Sensitive information can be stolen
      # via forks, and login session ends up in ~/.docker. This is ok because
      # we publish DOCKER_PARENT_IMAGE to ghcr.io, hence local to the runner.
      - name: Deploy
        env:
          # GH_USER=<user that created GH_TOKEN>
          GH_USER: ${{ secrets.GH_USER }}
          # GH_TOKEN=<hex token value>
          #   - pushes Docker images to ghcr.io
          #   - create via https://github.com/settings/tokens
          #   - needs repo:status, public_repo, write:packages, delete:packages
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        run: |  # GITHUB_REF will be refs/heads/master or refs/tags/MAJOR.MINOR.PATCH
          build-bin/configure_deploy &&
          build-bin/deploy $(echo ${GITHUB_REF} | cut -d/ -f 3)