ci: use a deploy key in publish-docs

.github/workflows/publish-docs.yml

@@ -27,6 +27,7 @@ jobs:
 
       - name: Publish
         env:
+          DOCS_DEPLOY_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
           SUPABASE_KEY: ${{ secrets.SUPABASE_KEY }}
         run: |
           ./scripts/docs/node_modules/.bin/tsx ./scripts/docs/ci-publish-docs.ts ${{ github.event.ref }}

scripts/docs/ci-publish-docs.ts

@@ -3,6 +3,8 @@ import glob from 'fast-glob'
 import { green } from 'kleur/colors'
 import mri from 'mri'
 import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
 import { supabase } from 'radashi-db/supabase.js'
 
 main()
@@ -108,6 +110,10 @@ async function main() {
     newReleaseId += '-' + newReleaseParts[3]
   }
 
+  if (process.env.DOCS_DEPLOY_KEY) {
+    await installDeployKey(process.env.DOCS_DEPLOY_KEY)
+  }
+
   log('Publishing docs for version:', newReleaseId)
 
   log('Cloning main branch of radashi-org.github.io')
@@ -353,3 +359,14 @@ async function coerceTagToVersion(tag: string) {
 
   return { version, metaId }
 }
+
+async function installDeployKey(deployKey: string) {
+  const sshDir = path.join(os.homedir(), '.ssh')
+  await fs.mkdir(sshDir, { recursive: true })
+
+  const keyPath = path.join(sshDir, 'deploy_key')
+  await fs.writeFile(keyPath, deployKey, { mode: 0o600 })
+
+  // Set GIT_SSH_COMMAND to use the deploy key
+  process.env.GIT_SSH_COMMAND = `ssh -i ${keyPath} -o StrictHostKeyChecking=no`
+}