feat: add deploy-oci-site action

Composite action for deploying Nix flake OCI images to Nomad.
Owns the static-site parameterized Nomad job template, all infra
defaults (registry, S3, Nomad addr), and an optional smoke test.

Site repos only need to provide a flake with an ociImage output
and pass domain + 3 secrets (S3_ACCESS_KEY, S3_SECRET_KEY, NIX_SIGNING_KEY).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

deploy-oci-site/action.yaml

@@ -0,0 +1,97 @@
+name: Deploy OCI Site
+description: Build a Nix flake OCI image, push to registry, and deploy via Nomad
+
+inputs:
+  domain:
+    description: 'Domain the site is served at (e.g. toph.so)'
+    required: true
+
+  registry:
+    description: 'Container registry host'
+    required: false
+    default: 'registry.toph.so'
+
+  s3-endpoint:
+    description: 'S3 endpoint for the Nix binary cache'
+    required: false
+    default: 'https://s3.toph.so'
+
+  nomad-addr:
+    description: 'Nomad API address'
+    required: false
+    default: 'http://172.17.0.1:4646'
+
+  smoke-test:
+    description: 'Run a smoke test against the domain after deploy'
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - name: Install tools
+      shell: bash
+      run: nix profile install nixpkgs#skopeo nixpkgs#nomad
+
+    - name: Build OCI image
+      shell: bash
+      run: nix build .#ociImage --out-link result-image
+
+    - name: Push image to registry
+      shell: bash
+      run: |
+        IMAGE_TAG=$(nix eval --raw .#packages.x86_64-linux.ociImage.imageTag)
+        skopeo copy \
+          docker-archive:./result-image \
+          docker://${{ inputs.registry }}/${{ inputs.domain }}:${IMAGE_TAG}
+        skopeo copy \
+          docker-archive:./result-image \
+          docker://${{ inputs.registry }}/${{ inputs.domain }}:latest
+        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
+
+    - name: Sign and push Nix closure to cache
+      shell: bash
+      run: |
+        echo "${NIX_SIGNING_KEY}" > /tmp/nix-key
+        nix store sign -k /tmp/nix-key --recursive ./result-image
+        nix copy \
+          --to "s3://nix-cache?endpoint=${{ inputs.s3-endpoint }}&access-key-id=${S3_ACCESS_KEY}&secret-access-key=${S3_SECRET_KEY}" \
+          ./result-image
+        rm /tmp/nix-key
+      env:
+        NIX_SIGNING_KEY: ${{ env.NIX_SIGNING_KEY }}
+        S3_ACCESS_KEY: ${{ env.S3_ACCESS_KEY }}
+        S3_SECRET_KEY: ${{ env.S3_SECRET_KEY }}
+
+    - name: Register Nomad job
+      shell: bash
+      run: |
+        nomad job run "${{ github.action_path }}/static-site.hcl"
+      env:
+        NOMAD_ADDR: ${{ inputs.nomad-addr }}
+
+    - name: Dispatch deployment
+      shell: bash
+      run: |
+        nomad job dispatch \
+          -meta "image_tag=${IMAGE_TAG}" \
+          -meta "domain=${{ inputs.domain }}" \
+          static-site
+      env:
+        NOMAD_ADDR: ${{ inputs.nomad-addr }}
+
+    - name: Smoke test
+      if: inputs.smoke-test == 'true'
+      shell: bash
+      run: |
+        echo "Waiting for deployment..."
+        for i in $(seq 1 12); do
+          if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
+            echo "OK — https://${{ inputs.domain }}/ is up"
+            exit 0
+          fi
+          echo "Attempt ${i}/12 — retrying in 5s..."
+          sleep 5
+        done
+        echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
+        exit 1

deploy-oci-site/static-site.hcl

@@ -0,0 +1,50 @@
+job "static-site" {
+  namespace = "static-sites"
+  type      = "service"
+
+  parameterized {
+    meta_required = ["image_tag", "domain"]
+  }
+
+  group "site" {
+    count = 1
+
+    network {
+      port "http" { to = 8080 }
+    }
+
+    service {
+      name     = "static-site-${NOMAD_META_domain}"
+      port     = "http"
+      provider = "nomad"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.${NOMAD_META_domain}.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.${NOMAD_META_domain}.entrypoints=websecure",
+        "traefik.http.routers.${NOMAD_META_domain}.tls.certresolver=letsencrypt",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "30s"
+        timeout  = "5s"
+      }
+    }
+
+    task "server" {
+      driver = "docker"
+
+      config {
+        image = "registry.toph.so/${NOMAD_META_domain}:${NOMAD_META_image_tag}"
+        ports = ["http"]
+      }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
+    }
+  }
+}