Deploy website workflow (TimMcCool/scratchattach)

name: Deploy website
 
on:
  push:
    branches:
      - main
    paths:
      - 'website/**'
  workflow_dispatch:
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  deploy:
    timeout-minutes: 30
    environment: release
    runs-on: latchkey-small
    permissions:
      contents: write
      deployments: write
      statuses: write
      pull-requests: write
 
    steps:
      - name: Checkout main branch
        uses: actions/checkout@v7
 
      - name: Deploy website directory to website branch
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./website
          publish_branch: website
          keep_files: true
          destination_dir: api
          user_name: 'github-actions[bot]'
          user_email: 'github-actions[bot]@users.noreply.github.com'
          commit_message: ${{ github.event.head_commit.message }}
 
      - name: Set up Python 3.12
        uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: "3.12"
 
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install uv
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
          pip install cryptography scratchattach
 
      - name: Generate and mask Vercel secrets
        id: generate_vars
        env:
          FERNET_KEY: ${{ secrets.FERNET_KEY }}
        run: |
          cd tests
          # Extract secrets securely
          vercel_token_val=$(python -m util vercel | sed -n '1p')
          org_id_val=$(python -m util vercel | sed -n '2p')
          project_id_val=$(python -m util vercel | sed -n '3p')
 
          # Mask values so they never appear in logs
          echo "::add-mask::$vercel_token_val"
          echo "::add-mask::$org_id_val"
          echo "::add-mask::$project_id_val"
 
          # Store them as environment variables (scoped to this job)
          echo "vercel_token=$vercel_token_val" >> $GITHUB_ENV
          echo "org_id=$org_id_val" >> $GITHUB_ENV
          echo "project_id=$project_id_val" >> $GITHUB_ENV
 
          cd ..
        shell: bash
 
      - name: Checkout website branch
        uses: actions/checkout@v7
        with:
          ref: 'website'
 
      - uses: nexterias/actions-vercel@v2
        id: vercel
        with:
          token: ${{ env.vercel_token }}
          org-id: ${{ env.org_id }}
          project-id: ${{ env.project_id }}
          production: true
          prebuilt: true