in answer to a "how do you deploy Drupal" tweet @ https://twitter.com/xurizaemon/status/1450908729122045955

.gitlab-ci.deploy.yml

# Based on https://gitlab.com/mog33/gitlab-ci-drupal/-/blob/3.x-dev/.gitlab-ci/ci/06_deploy.yml
#
# Basic docker image with ssh to be able to access a remote.
# Each access must add a ssh key, see samples below.
.deploy_ssh:
  image: alpine:latest
  needs:
    - drush make
  rules:
    - if: '$CI_COMMIT_TAG != null'
  before_script:
    - |
      # Test if variable SSH_DEPLOY_KEY is set.
      if [ -z ${SSH_DEPLOY_KEY} ]; then
        echo -e "\033[1;31mMissing variable SSH_DEPLOY_KEY for SSH deploy\033[0;37m"
        exit 1
      fi
    - apk --no-cache add openssh-client rsync
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config
    - echo -e "${SSH_DEPLOY_KEY}" > ~/.ssh/id_rsa
    - chmod 400 ~/.ssh/id_rsa

ssh deploy:
  stage: deploy
  extends: .deploy_ssh
  # when: manual
  # Variables can be set from 'Gitlab CI UI > settings > CI/CD > variables' as
  # named below or directly here.
  variables:
    DEPLOY_USER: "${SSH_DEPLOY_USER}"
    DEPLOY_HOST: "${SSH_DEPLOY_HOST}"
    DEPLOY_ROOT: "${SSH_DEPLOY_PATH}"
    DEPLOY_DIR: "${SSH_DEPLOY_PATH}/${CI_COMMIT_TAG}"
    DEPLOY_KEY: "${SSH_PRIVATE_KEY}"
  script:
    - ssh ${DEPLOY_USER}@${DEPLOY_HOST} "if [ -d ${DEPLOY_DIR} ] ; then echo -e \"\033[1;31mDeploy target dir ${DEPLOY_DIR} exists already\033[0;37m\" ; exit 1 ; fi"
    - rsync -arz . ${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/
    - ssh ${DEPLOY_USER}@${DEPLOY_HOST} "cd ${DEPLOY_DIR} && DEPLOY_ROOT=${DEPLOY_ROOT} DEPLOY_DIR=${DEPLOY_DIR} ./scripts/deploy.sh"
#    - ssh -p22 ${ENV_USER}@${ENV_HOST} "mv ${ENV_PATH}/current ${ENV_PATH}/_previous && mv ${ENV_PATH}/_tmp ${ENV_PATH}/current"
#    - ssh -p22 ${ENV_USER}@${ENV_HOST} "${ENV_PATH}/scripts/deploy.sh --env=testing"

ssh release:
  stage: release
  extends: .deploy_ssh
  needs:
    - ssh deploy
  rules:
    - if: '$CI_COMMIT_TAG != null'
      when: manual
  # Variables can be set from 'Gitlab CI UI > settings > CI/CD > variables' as
  # named below or directly here.
  variables:
    DEPLOY_USER: "${SSH_DEPLOY_USER}"
    DEPLOY_HOST: "${SSH_DEPLOY_HOST}"
    DEPLOY_ROOT: "${SSH_DEPLOY_PATH}"
    DEPLOY_DIR: "${SSH_DEPLOY_PATH}/${CI_COMMIT_TAG}"
    DEPLOY_KEY: "${SSH_PRIVATE_KEY}"
  script:
    - ssh ${DEPLOY_USER}@${DEPLOY_HOST} "cd ${DEPLOY_DIR} && DEPLOY_ROOT=${DEPLOY_ROOT} DEPLOY_DIR=${DEPLOY_DIR} ./scripts/release.sh"

deploy.sh

#!/usr/bin/env bash
#
# This script should receive certain values:
# DEPLOY_ROOT: The base root for deployments.
# DEPLOY_DIR: The directory for this current deployment.
#
# The previous deployment is symlinked to from ${DEPLOY_ROOT}/latest
#

set -e

WEBROOT=${DEPLOY_ROOT}/current/web
PATH=${PATH}:${HOME}/bin

# Symlink sites directories into deploy dir.
cd "${DEPLOY_DIR}/web/sites" || (>&2 echo "Unable to cd to ${DEPLOY_DIR}/web/sites"; exit 1)
for DIR in "${DEPLOY_ROOT}/shared/"* ; do
  ln -sv "${DIR}" .
done

# Sites we'll target for auto-migration.
cd "${WEBROOT}"
MIGRATE_SITES=$(drush sa | grep '^@' | grep -Ev "^(@none|@self)$")

# Make DB backups from existing deploy location.
cd "${WEBROOT}"
for ALIAS in $MIGRATE_SITES; do
  echo "DB backup for ${ALIAS}"
  SITE="${ALIAS//@/}"
  BACKUP=/container/application/backups/${SITE}.deploy.$( basename "$DEPLOY_DIR" ).sql
  drush "${ALIAS}" sql-dump --result-file="${BACKUP}" --gzip --extra="--no-tablespaces --column-statistics=0"
done

cd "${DEPLOY_ROOT}"
ln -s "${DEPLOY_DIR}" next

release.sh

#!/usr/bin/env bash
#
# This script should receive certain values:
# DEPLOY_ROOT: The base root for deployments.
# DEPLOY_DIR: The directory for this current deployment.
#
# The current deployment is symlinked to from ${DEPLOY_ROOT}/current
# The previous deployment is symlinked to from ${DEPLOY_ROOT}/previous
#

set -e

WEBROOT=${DEPLOY_ROOT}/current/web
PATH=${PATH}:${HOME}/bin

# Sites we'll target for auto-migration.
cd "${WEBROOT}"
MIGRATE_SITES=$(drush sa | grep '^@' | grep -Ev "^(@none|@self)$")

# Make DB backups from existing deploy location.
cd "${WEBROOT}"
for SITE in $MIGRATE_SITES; do
  echo "DB backup for ${SITE}"
  BACKUP=/container/application/backups/${SITE}.pre-release.$( basename "$DEPLOY_DIR" ).sql
  drush "${SITE}" sql-dump --result-file="${BACKUP}" --gzip --extra="--no-tablespaces --column-statistics=0"
done

cd "${DEPLOY_ROOT}"
mv current previous
mv next current

# Execute DB updates & snapshot.
cd "${WEBROOT}"
for ALIAS in $MIGRATE_SITES; do
  echo "DB update for ${ALIAS}"
  SITE="${ALIAS//@/}"
  drush -y "${ALIAS}" updb
  BACKUP=/container/application/backups/${SITE}.post-update.$( basename "$DEPLOY_DIR" ).sql
  echo "DB dump for ${ALIAS}"
  drush "${ALIAS}" sql-dump --result-file="${BACKUP}" --gzip --extra="--no-tablespaces --column-statistics=0"
done