From f9e7a6259ba9023fe7607201a600f04c758b642c Mon Sep 17 00:00:00 2001
From: trisdoan <doanminhtri8183@gmail.com>
Date: Tue, 8 Sep 2026 11:56:06 +0700
Subject: [PATCH] feat: add enable_deploy copier gate and deploy workflow

Add an independently switchable enable_deploy Copier prompt (only
asked when enable_github_action is true) gating a templated
deploy.yaml GitHub Actions workflow, following the existing
directory-name gate idiom used by enable_docs_site.

- workflow_dispatch only, with a deploy concurrency group
- preflight step names each missing DEPLOY_* secret via ::error::
  before pinning deploy_type: python and dispatching trobz/deploy.py
- Summary step passes github.ref_name/sha through env vars to avoid
  script injection via ref names
- contents: read permissions; no odoo/service/db inputs exposed
---
 copier.yaml                                   |  6 +++
 .../workflows/deploy.yaml                     | 49 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 template/{% if enable_deploy %}.github{% endif%}/workflows/deploy.yaml

diff --git a/copier.yaml b/copier.yaml
index c7f206d..1e7e145 100644
--- a/copier.yaml
+++ b/copier.yaml
@@ -76,6 +76,12 @@ publish_to_pypi:
   default: False
   when: "{{ enable_github_action }}"
 
+enable_deploy:
+  type: bool
+  default: False
+  when: "{{ enable_github_action }}"
+  help: Add a manual deploy workflow using the trobz/deploy.py action
+
 ############# Tasks ##################
 _tasks:
   - "ln -sf AGENTS.md CLAUDE.md"
diff --git a/template/{% if enable_deploy %}.github{% endif%}/workflows/deploy.yaml b/template/{% if enable_deploy %}.github{% endif%}/workflows/deploy.yaml
new file mode 100644
index 0000000..629716e
--- /dev/null
+++ b/template/{% if enable_deploy %}.github{% endif%}/workflows/deploy.yaml	
@@ -0,0 +1,49 @@
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check deploy secrets
+        env:
+          DEPLOY_SSH_HOST: ${{ secrets.DEPLOY_SSH_HOST }}
+          DEPLOY_SSH_USER: ${{ secrets.DEPLOY_SSH_USER }}
+          DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          DEPLOY_INSTANCE: ${{ secrets.DEPLOY_INSTANCE }}
+        run: |
+          missing=()
+          for v in DEPLOY_SSH_HOST DEPLOY_SSH_USER DEPLOY_SSH_PRIVATE_KEY DEPLOY_INSTANCE; do
+            [[ -n "${!v}" ]] || missing+=("$v")
+          done
+          if (( ${#missing[@]} )); then
+            echo "::error::Deploy is not configured. Missing secrets: ${missing[*]}. See https://github.com/trobz/trobz-python-template/blob/main/docs/deployment-guide.md" >&2
+            exit 1
+          fi
+
+      - name: Deploy
+        uses: trobz/deploy.py@v0.23.1   # TODO: bump to the Phase 1 tag once trobz/deploy.py#47 merges and releases
+        with:
+          deploy_ssh_host: ${{ secrets.DEPLOY_SSH_HOST }}
+          deploy_ssh_port: ${{ secrets.DEPLOY_SSH_PORT || '22' }}
+          deploy_ssh_user: ${{ secrets.DEPLOY_SSH_USER }}
+          deploy_ssh_private_key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          deploy_instance: ${{ secrets.DEPLOY_INSTANCE }}
+          deploy_type: python
+          deploy_repo_branch: ${{ github.ref_name }}
+
+      - name: Summary
+        env:
+          REF: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+        run: |
+          echo "Deployed \`$REF\` @ \`$SHA\`" >> "$GITHUB_STEP_SUMMARY"