From 773d21b7091297aa2862869bf8d7d89df12076b1 Mon Sep 17 00:00:00 2001 From: Leander Furumo Date: Fri, 30 Oct 2026 22:40:21 +0100 Subject: [PATCH] Shorten deploy downtime and limit workflow permissions Build the new image before replacing the running container instead of stopping the site first, prune old images, prevent overlapping deploys, and drop the unused pull-requests permission. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 246821f..370c4c7 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -5,6 +5,11 @@ on: branches: - main +# Let a running deploy finish before the next one starts +concurrency: + group: deploy + cancel-in-progress: false + jobs: run_pull: runs-on: ubuntu-latest @@ -17,12 +22,13 @@ jobs: chmod 600 ~/.ssh/id_ed25519 # This should be redundant but seems to do the trick. ssh-keyscan -H ${{ vars.SSH_HOST }} > ~/.ssh/known_hosts + # up --build builds the new image while the old container keeps serving, + # then swaps the container. Old images are pruned so they don't fill the disk - name: Connect, pull, build and deploy - run: ssh ${{ secrets.SSH_USER }}@${{ vars.SSH_HOST }} "cd ${{ secrets.WORK_DIR }} && git checkout ${{ vars.MAIN_BRANCH }} && git pull && docker compose down && docker compose up -d --build && exit" + run: ssh ${{ secrets.SSH_USER }}@${{ vars.SSH_HOST }} "cd ${{ secrets.WORK_DIR }} && git checkout ${{ vars.MAIN_BRANCH }} && git pull && docker compose up -d --build && docker image prune -f && exit" - name: Clean up run: rm -rf ~/.ssh permissions: contents: read - pull-requests: write