deploy.yml

name: Deploy to server

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Configure SSH
        env:
          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.DEPLOY_SSH_KNOWN_HOSTS }}
        run: |
          set -euo pipefail

          : "${SSH_PRIVATE_KEY:?DEPLOY_SSH_PRIVATE_KEY is required}"
          : "${SSH_KNOWN_HOSTS:?DEPLOY_SSH_KNOWN_HOSTS is required}"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

          printf '%s\n' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - name: Pull latest code on server
        env:
          SERVER_HOST: ${{ secrets.DEPLOY_SERVER_HOST }}
          SERVER_PORT: ${{ secrets.DEPLOY_SERVER_PORT }}
          SERVER_USER: ${{ secrets.DEPLOY_SERVER_USER }}
          SERVER_PATH: ${{ secrets.DEPLOY_SERVER_PATH }}
        run: |
          set -euo pipefail

          : "${SERVER_HOST:?DEPLOY_SERVER_HOST is required}"
          : "${SERVER_USER:?DEPLOY_SERVER_USER is required}"
          : "${SERVER_PATH:?DEPLOY_SERVER_PATH is required}"

          ssh -i ~/.ssh/deploy_key \
            -p "${SERVER_PORT:-22}" \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            "$SERVER_USER@$SERVER_HOST" \
            "cd '$SERVER_PATH' && git pull --ff-only origin main"