From aa3b49093a4109f79b8502776c4c7420391ec398 Mon Sep 17 00:00:00 2001 From: Leander Furumo Date: Mon, 2 Nov 2026 22:47:49 +0100 Subject: [PATCH] ci: deploy through the restricted uiogaming-deploy script The old workflow ran docker compose in the repo folder, which failed because the containers belong to the server's top-level compose project. The deploy key can now only run /usr/local/bin/uiogaming-deploy (see UiO-Gaming/drift), so the workflow just passes the service name. Also adds manual runs and prevents overlapping deploys. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy.yml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 246821f..2a30d53 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -4,25 +4,29 @@ on: push: branches: - main + workflow_dispatch: + +# Never run two deploys of this repo at the same time +concurrency: deploy jobs: - run_pull: + deploy: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Set up SSH run: | install -m 600 -D /dev/null ~/.ssh/id_ed25519 echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 # This should be redundant but seems to do the trick. ssh-keyscan -H ${{ vars.SSH_HOST }} > ~/.ssh/known_hosts - - name: Connect, pull, build and deploy - run: ssh ${{ secrets.SSH_USER }}@${{ vars.SSH_HOST }} "cd ${{ secrets.WORK_DIR }} && git checkout ${{ vars.MAIN_BRANCH }} && git pull && docker compose down && docker compose up -d --build && exit" + # The deploy key can only run /usr/local/bin/uiogaming-deploy on the server. It takes the + # service name from the top-level docker-compose.yml (see drift/driftsdokumentasjon.md). + - name: Deploy + run: ssh ${{ secrets.SSH_USER }}@${{ vars.SSH_HOST }} mustaboard - name: Clean up + if: always() run: rm -rf ~/.ssh - - permissions: - contents: read - pull-requests: write