Github Actions Workflow to build and deploy Nuxt 3 SSR with PM2, as well as node-canvas, on ARM64, utilizing cache for `pnpm` and `apt` including the build for `node-canvas`

nuxt3-pm2-build-deploy-on-arm.yaml

name: "Build and deploy Nuxt SSR with PM2"
on: [push]
jobs:
  build:
    name: "Build Nuxt Application"
    runs-on: [self-hosted, ARM64] # you can also use buildjet.com
    environment:
      name: "Production"
    steps:
    - uses: actions/checkout@v3

    # We need to adjust permissions on the apt cache folder to restore the cache
    - name: "Fix cache permissions"
     run: |
       sudo chmod aoug+rw -R /var/cache/apt

    - name: "Restore apt package cache"
     uses: actions/cache@v3
     with:
       path: |
         /var/cache/apt/archives/**.deb
         !/var/cache/apt/archives/partial
         !/var/cache/apt/archives/lock
       key: ${{ runner.os }}-apt1-${{ hashFiles('**/lock-requirements-apt.txt') }}
       restore-keys: ${{ runner.os }}-apt1-

    - name: "Update Apt database"
     run: sudo apt-get update

    - name: "Setup build tools for `node-canvas`"
     run: sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev

    - name: "Install Node.js"
     uses: actions/setup-node@v3
     with:
       node-version: '18.x'

    - name: "Install and setup pnpm"
      run: |
        npm install -g pnpm
        pnpm config set store-dir ~/.pnpm-store

    - name: "Restore pnpm cache"
     uses: actions/cache@v3
     with:
       path: |
         **/node_modules/.pnpm/canvas@2.11.0
         ~/.pnpm-store
         ~/.npm
       key: ${{ runner.os }}-pnpm1-${{ hashFiles('**/pnpm-lock.yaml') }}
       restore-keys: ${{ runner.os }}-pnpm1-

    - name: "Install dependencies"
      run: pnpm install --shamefully-hoist

    - name: "Run build task"
      run: pnpm run build --if-present

    # rsync only required folders from the build
    - name: "Deploy to Server"
      uses: easingthemes/ssh-deploy@main
      env:
         SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         ARGS: "-rlgoDzvc -i --delete"
         SOURCE: .output fonts src
         REMOTE_HOST: ${{ vars.REMOTE_HOST }}
         REMOTE_USER: ${{ vars.REMOTE_USER }}
         TARGET: ${{ vars.REMOTE_TARGET }}

 followup:
   name: "Follow-up Tasks (PM2, CloudFront)"
   runs-on: ubuntu-latest
   needs: [build]
   environment:
     name: "Production"
   steps:
   - name: "Restart PM2 task"
     uses: appleboy/ssh-action@v0.1.7
     with:
         host: ${{ env.REMOTE_HOST }}
         username: ${{ env.REMOTE_USER }}
         key: ${{ env.SSH_PRIVATE_KEY }}
         script: "source ~/.nvm/nvm.sh && pm2 restart ${{ vars.PM2_NAME }}"
     env:
         SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         REMOTE_HOST: ${{ vars.REMOTE_HOST }}
         REMOTE_USER: ${{ vars.REMOTE_USER }}

   - name: "Invalidate AWS CloudFront"
     uses: chetan/invalidate-cloudfront-action@v2
     env:
         DISTRIBUTION: ${{ vars.DISTRIBUTION }}
         PATHS: ${{ vars.INVALIDATE_PATHS }}
         AWS_REGION: ${{ vars.AWS_REGION }}
         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         REMOTE_HOST: ${{ vars.REMOTE_HOST }}
         REMOTE_USER: ${{ vars.REMOTE_USER }}

setup.txt

# Required secrets 

AWS_ACCESS_KEY_ID # for cloudfront 
AWS_SECRET_ACCESS_KEY # for cloudfront
SSH_PRIVATE_KEY # for destination server

# Required variables

REMOTE_HOST # for destination server
REMOTE_USER # for destination server
DISTRIBUTION # cloudfront distribution ID
INVALIDATE_PATHS # invalidation path (probably want /*)
AWS_REGION # us-east-1
REMOTE_TARGET # target directory on destination server