feat: init deploy workflow

.github/workflows/deploy.yml

@@ -0,0 +1,49 @@
+name: Play Deploy
+
+on: workflow_dispatch
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: prod
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: recursive
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12.1
+        cache: pipenv
+    - name: Install pipenv
+      run: |
+        python -m pip install --upgrade pip
+        pip install pipenv
+        pipenv install --dev
+    - name: Create .ansible_ssh_key
+      env:
+        SSH_PRIVATE_KEY: ${{secrets.SSH_PRIVATE_KEY}}
+      run: |
+        echo ${SSH_PRIVATE_KEY} > .ansible_ssh_key
+        chmod 600 .ansible_ssh_key
+    - name: Create .ansible_known_hosts
+      env:
+        ANSIBLE_KNOWN_HOSTS: ${{vars.ANSIBLE_KNOWN_HOSTS}}
+      run: echo ${ANSIBLE_KNOWN_HOSTS} > .ansible_known_hosts
+    - name: Create SSL PEM
+      env:
+        SSL_PEM: ${{secrets.SSL_PEM}}
+        LOCAL_CERTS_DIR: ${{vars.LOCAL_CERTS_DIR}}
+      run: |
+        mkdir ${LOCAL_CERTS_DIR}
+        echo ${SSL_PEM} > ${LOCAL_CERTS_DIR}/ssl.pem
+    - name: Run Deploy
+      env:
+        DOCKER_APP_IMAGE_TAG: ${GITHUB_SHA}
+        DOCKER_STATICS_IMAGE_TAG: ${GITHUB_SHA}
+        DOCKER_REGISTRY_USERNAME: ${{vars.DOCKER_REGISTRY_USERNAME}}
+        DOCKER_REGISTRY_PASSWORD: ${{vars.DOCKER_REGISTRY_PASSWORD}}
+        LOCAL_CERTS_DIR: ${{vars.LOCAL_CERTS_DIR}}
+        ROLL_SUBDOMAIN_BASE: ${{vars.ROLL_SUBDOMAIN_BASE}}
+      run: pipenv run deploy --key-file .ansible_ssh_key --ssh-common-args="-o UserKnownHostsFile=.ansible_known_hosts"
+

Pipfile

@@ -11,8 +11,6 @@ deploy = "ansible-playbook -i inventories/inventory.yml -e @variables.yml playbo
 [packages]
 ansible = "*"
 requests = "*"
-certbot = "*"
-certbot-dns-cloudflare = "*"
 
 [dev-packages]