From c1e48faa561429f4fd8a94dd340d8d0df3d52586 Mon Sep 17 00:00:00 2001 From: Kenneth Obsequio Date: Sat, 1 Aug 2026 14:26:11 +0800 Subject: [PATCH] ci: auto-deploy to droplet on push to main Adds a GitHub Actions workflow that SSHes into the API droplet on every push to main and runs deploy.sh (git pull + npm install + systemctl restart). The deploy key is restricted server-side via a forced-command in authorized_keys, so it can only ever run that one script. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/deploy.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..7c073d2 --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,21 @@ +name: Deploy to droplet + +on: + push: + branches: [main] + workflow_dispatch: {} + +jobs: + deploy: + runs-on: ubuntu-latest + steps: + # The key below is restricted server-side to only run + # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the + # droplet) — it can't run arbitrary commands even if this secret leaks. + - name: Deploy via SSH + uses: appleboy/ssh-action@v1 + with: + host: ${{ secrets.DEPLOY_HOST }} + username: root + key: ${{ secrets.DEPLOY_SSH_KEY }} + script: deploy