deploy.yml

name: Deploy

on:
  workflow_run:
    workflows:
      - Build
    types:
      - completed
    branches:
      - master

permissions:
  contents: read

jobs:
  deploy:
    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
    runs-on: ubuntu-latest
    concurrency:
      group: production-deploy
      cancel-in-progress: true

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Upload config and scripts to VPS
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ secrets.VPS_PORT }}
          source: "compose.yaml,bin/db-backup,bin/db-restore"
          target: ${{ secrets.VPS_APP_DIR }}/

      - name: Deploy to VPS
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ secrets.VPS_PORT }}
          script_stop: true
          script: |
            set -euo pipefail

            if [ -n "${{ secrets.GHCR_USERNAME }}" ] && [ -n "${{ secrets.GHCR_TOKEN }}" ]; then
              echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USERNAME }}" --password-stdin
            fi

            cd "${{ secrets.VPS_APP_DIR }}"
            chmod +x bin/db-backup bin/db-restore

            IMAGE_TAG="sha-${{ github.event.workflow_run.head_sha }}"
            printf 'IMAGE_TAG=%s\n' "$IMAGE_TAG" > .env.deploy
            export IMAGE_TAG

            docker compose pull
            docker compose up -d
            docker compose ps

      - name: Notify Telegram
        if: always()
        uses: appleboy/telegram-action@master
        with:
          to: ${{ secrets.TELEGRAM_CHAT_ID }}
          token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          format: markdown
          message: |
            *${{ job.status == 'success' && '✅ Deploy Succeeded' || '❌ Deploy Failed' }}*

            *Repo:* `${{ github.repository }}`
            *Commit:* `${{ github.event.workflow_run.head_sha }}`
            *Message:* ${{ github.event.workflow_run.head_commit.message }}
            *Author:* ${{ github.event.workflow_run.head_commit.author.name }}
            *Branch:* `master`

            [View Run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})