nixos-config/.github/workflows/deploy.yml

name: Deploy to staging
on:
  workflow_dispatch:
    inputs:
      job_name:
        description: "Job name that has completed"
        required: true
        type: string
      rev:
        description: "Revision of succeeded comit"
        required: true
        type: string
jobs:
  deploy:
    name: Deploy to staging
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.rev }}
          token: ${{ secrets.PUBLISH_TOKEN }}
      - run: |
          JOB_NAME=$(echo $JOB_NAME | sed 's|:|/|g')
          git fetch --all --tags
          git tag --list | grep $JOB_NAME || (git tag $JOB_NAME $REV && git push --tags)
          if [[ ! git merge-base --is-ancestor $REV $JOB_NAME ]]; then
            git tag -f $JOB_NAME $REV
            git push --tags --force
          fi
        env:
          JOB_NAME: ${{ github.event.inputs.job_name }}
          REV: ${{ github.event.inputs.rev }}