From be0e3eb060d0586d6c10fd397c599d9c3a951e5a Mon Sep 17 00:00:00 2001
From: Loyyd <konradkunkel@gmx.de>
Date: Wed, 8 Jul 2026 11:40:01 +0200
Subject: [PATCH] Harden FamilyFed deploy workflow

---
 .forgejo/workflows/deploy.yml | 65 +++++++++++++++++++++++++----------
 1 file changed, 46 insertions(+), 19 deletions(-)

diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index 89777ee4..e0504d27 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -9,8 +9,17 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: self-hosted
+    runs-on: docker
+    container:
+      image: node:24-bookworm
+    timeout-minutes: 30
     steps:
+      - name: Install deploy tools
+        run: |
+          set -eu
+          apt-get update -qq
+          apt-get install -y -q ca-certificates curl git jq
+
       - name: Build Astro and restart Nomad
         env:
           NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
@@ -24,37 +33,55 @@ jobs:
           REPO_URL: https://git.bcgen.ie/familyfedie/familyfedie-website.git
         run: |
           set -eu
-          rm -rf source
           export REF_NAME="${GITHUB_REF_NAME:-main}"
 
-          nix --extra-experimental-features "nix-command flakes" \
-            shell nixpkgs#git \
-            -c git clone --depth 1 --branch "$REF_NAME" "$REPO_URL" source
+          git config --global http.lowSpeedLimit 1024
+          git config --global http.lowSpeedTime 60
+
+          for attempt in 1 2 3; do
+            echo "Cloning $REPO_URL ($REF_NAME), attempt $attempt/3"
+            rm -rf source
+            if timeout 180 git clone --depth 1 --branch "$REF_NAME" "$REPO_URL" source; then
+              break
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "git clone failed after 3 attempts" >&2
+              exit 1
+            fi
+            sleep $((attempt * 10))
+          done
 
           cd source
-          nix --extra-experimental-features "nix-command flakes" \
-            shell nixpkgs#nodejs_24 \
-            -c npm ci
+          npm ci --no-audit --no-fund
           rm -rf dist
-          nix --extra-experimental-features "nix-command flakes" \
-            shell nixpkgs#nodejs_24 \
-            -c npm run build
+          npm run build
 
           test -f dist/index.html
           test -f dist/admin/index.html
           test -f dist/speeches/index.html
           test -f dist/assets/icons/familyfed-favicon.png
 
-          ALLOC_ID=$(nix --extra-experimental-features "nix-command flakes" \
-            shell nixpkgs#curl nixpkgs#jq \
-            -c sh -c 'curl -sf -H "X-Nomad-Token: $NOMAD_TOKEN" "$NOMAD_ADDR/v1/job/familyfed/allocations" | jq -r "map(select(.ClientStatus == \"running\"))[0].ID"')
+          ALLOC_ID=$(
+            curl -fsS \
+              --connect-timeout 15 \
+              --max-time 60 \
+              --retry 3 \
+              --retry-delay 5 \
+              --retry-all-errors \
+              -H "X-Nomad-Token: $NOMAD_TOKEN" \
+              "$NOMAD_ADDR/v1/job/familyfed/allocations" \
+              | jq -r 'map(select(.ClientStatus == "running"))[0].ID'
+          )
 
           test -n "$ALLOC_ID"
           test "$ALLOC_ID" != "null"
           echo "Stopping allocation to trigger fresh prestart: $ALLOC_ID"
-          nix --extra-experimental-features "nix-command flakes" \
-            shell nixpkgs#curl \
-            -c curl -sf -X POST \
-              -H "X-Nomad-Token: $NOMAD_TOKEN" \
-              "$NOMAD_ADDR/v1/allocation/$ALLOC_ID/stop"
+          curl -fsS -X POST \
+            --connect-timeout 15 \
+            --max-time 60 \
+            --retry 3 \
+            --retry-delay 5 \
+            --retry-all-errors \
+            -H "X-Nomad-Token: $NOMAD_TOKEN" \
+            "$NOMAD_ADDR/v1/allocation/$ALLOC_ID/stop"
           echo "Deploy triggered. Nomad will schedule a new alloc that re-fetches the site."