From 8c0f1a50362fdb69d94375668bb62ceb786818b0 Mon Sep 17 00:00:00 2001
From: karitham <kar@karitham.dev>
Date: Sat, 18 Apr 2026 20:06:45 +0200
Subject: [PATCH] CI :+1:

---
 .tangled/workflows/deploy-site.yml | 70 ++++++++++++++++++++++++++++++
 flake.lock                         |  6 +--
 2 files changed, 73 insertions(+), 3 deletions(-)
 create mode 100644 .tangled/workflows/deploy-site.yml

diff --git a/.tangled/workflows/deploy-site.yml b/.tangled/workflows/deploy-site.yml
new file mode 100644
index 0000000..044b636
--- /dev/null
+++ b/.tangled/workflows/deploy-site.yml
@@ -0,0 +1,70 @@
+when:
+  - event: ["push"]
+    branch: ["main"]
+
+engine: "nixery"
+
+dependencies:
+  github:NixOS/nixpkgs/nixpkgs-unstable:
+    - gleam
+    - erlang
+    - bun
+    - tailwindcss_4
+    - elixir
+    - nodejs
+    - rebar3
+    - openssh
+    - git
+    - nss_wrapper
+    - gnused
+
+steps:
+  - name: Install dependencies
+    command: gleam deps download
+
+  - name: Build app
+    command: gleam run -m lustre/dev build --minify --outdir=dist
+
+  - name: Fix asset paths for subdirectory deployment
+    command: |
+      # Rewrite root-relative paths to /gpreview subdirectory
+      sed -i 's|href="/gpreview\.css"|href="/gpreview/gpreview.css"|g' dist/index.html
+      sed -i 's|src="/gpreview\.js"|src="/gpreview/gpreview.js"|g' dist/index.html
+
+  - name: Push to dist branch
+    command: |
+      # 1. Identity Setup (NSS Wrapper files)
+      export HOME_DIR=$(pwd)/.git_home
+      mkdir -p "$HOME_DIR/.ssh"
+      echo "root:x:0:0:root:$HOME_DIR:/bin/sh" > "$HOME_DIR/passwd"
+      echo "root:x:0:" > "$HOME_DIR/group"
+
+      # 2. Resolve nss_wrapper path
+      NSS_PATH=$(nix build github:NixOS/nixpkgs/nixpkgs-unstable#nss_wrapper \
+        --no-link --print-out-paths \
+        --extra-experimental-features "nix-command flakes")
+      export NSS_LIB="$NSS_PATH/lib/libnss_wrapper.so"
+
+      # 3. SSH Setup
+      echo "$DEPLOY_KEY" > "$HOME_DIR/id_ed25519"
+      chmod 600 "$HOME_DIR/id_ed25519"
+
+      # Use ssh-keyscan to trust the remote host dynamically
+      # We target port 22 (default) for tangled.org
+      ssh-keyscan -t ed25519 tangled.org > "$HOME_DIR/known_hosts" 2>/dev/null
+
+      # 4. Git Initialization
+      cd dist
+      git init
+      git config user.name "Tangled Spindle"
+      git config user.email "deploy@tangled.org"
+      git add .
+      git commit -m "Deploy ${TANGLED_SHA}"
+      git branch -M dist
+      git remote add origin "ssh://git@tangled.org/karitham.dev/gpreview"
+
+      # 5. The Push
+      # We use our LD_PRELOAD trick to bypass the 'uid 0' issue
+      export GIT_SSH_COMMAND="env LD_PRELOAD=$NSS_LIB NSS_WRAPPER_PASSWD=$HOME_DIR/passwd NSS_WRAPPER_GROUP=$HOME_DIR/group ssh -F /dev/null -i $HOME_DIR/id_ed25519 -o UserKnownHostsFile=$HOME_DIR/known_hosts -o StrictHostKeyChecking=yes"
+
+      git push --force origin dist
diff --git a/flake.lock b/flake.lock
index abd1e7a..4b8e88e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772736753,
-        "narHash": "sha256-au/m3+EuBLoSzWUCb64a/MZq6QUtOV8oC0D9tY2scPQ=",
+        "lastModified": 1776329215,
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "917fec990948658ef1ccd07cef2a1ef060786846",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
-- 
2.51.2