initial

.forgejo/workflows/deploy.yml

@@ -0,0 +1,48 @@
+---
+name: Validate and deploy
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - closed
+
+jobs:
+  validate-and-deploy:
+    runs-on: docker
+    env:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+
+    steps:
+      - name: Check out repository
+        uses: https://data.forgejo.org/actions/checkout@v6
+
+      - name: Scan secrets
+        run: gitleaks detect --source . --redact --no-banner
+
+      - name: Check Terraform formatting
+        run: terraform fmt -check -recursive
+
+      - name: Initialize Terraform
+        run: terraform init -backend=false -input=false
+
+      - name: Validate Terraform
+        run: terraform validate
+
+      - name: Plan Terraform
+        run: terraform plan -input=false -no-color -out=tfplan
+
+      - name: Lint Ansible
+        run: ansible-lint deploy/site.yml
+
+      - name: Deploy
+        if: ${{ forgejo.event.action == 'closed' && forgejo.event.pull_request.merged == true }}
+        env:
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+        run: bash deploy/deploy.sh