add staging manual deploy step (#379)

.github/workflows/ci.yml

@@ -104,9 +104,10 @@ jobs:
         uses: webfactory/ssh-agent@v0.7.0
         with:
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
-      - name: Set up Ruby
+      - name: Setup Ruby
         uses: ruby/setup-ruby@v1
         with:
+          bundler: default
           bundler-cache: true
       - name: Deploy
         env:

.github/workflows/deploy-staging.yml

@@ -0,0 +1,36 @@
+name: Deploy to Staging
+
+on: workflow_dispatch
+
+jobs:
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-20.04
+    timeout-minutes: 20
+    env:
+      DOCKER_BUILDKIT: 1
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@v0.7.0
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler: default
+          bundler-cache: true
+      - name: Deploy to Staging
+        env:
+          VERSION: ${{ github.sha }}
+          KAMAL_REGISTRY_PASSWORD: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
+          KAMAL_RAILS_MASTER_KEY: ${{ secrets.KAMAL_RAILS_MASTER_KEY }}
+          MEILI_MASTER_KEY: ${{ secrets.MEILI_MASTER_KEY }}
+        run: bundle exec kamal deploy -d staging
+      - name: Cleanup on cancellation
+        if: always() && steps.deploy.conclusion == 'cancelled'
+        run: bundle exec kamal lock release

.gitignore

@@ -81,9 +81,6 @@ service_account.json
 # asdf
 .tool-versions
 
-# kamal
-.kamal/secrets.staging
-
 .DS_Store
 
 .ssh-keys/

.kamal/secrets.staging

@@ -0,0 +1,16 @@
+# Secrets defined here are available for reference under registry/password, env/secret, builder/secrets,
+# and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either
+# password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git.
+
+# Option 1: Read secrets from the environment
+KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD
+RAILS_MASTER_KEY=$KAMAL_RAILS_MASTER_KEY
+MEILI_MASTER_KEY=$MEILI_MASTER_KEY
+# Option 2: Read secrets via a command
+# RAILS_MASTER_KEY=$(cat config/master.key)
+
+# Option 3: Read secrets via kamal secrets helpers
+# These will handle logging in and fetching the secrets in as few calls as possible
+# There are adapters for 1Password, LastPass + Bitwarden
+#
+