Skip to content

Added a deployment step to github actions #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sfreeman422 merged 1 commit into from
Mar 22, 2026
Merged

Added a deployment step to github actions #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,4 +85,4 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Build Docker image
run: docker build -f packages/backend/Dockerfile -t mocker-backend:ci .
run: docker build -f packages/backend/Dockerfile -t muzzle:ci .
68 changes: 68 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
name: Deploy

on:
push:
branches: [master]

# GITHUB_TOKEN needs write access to push the image to GHCR.
permissions:
contents: read
packages: write

jobs:
deploy:
name: Build, Push & Deploy
runs-on: ubuntu-latest
# Scoping to a GitHub environment lets you add approval gates and
# view deployment history in the GitHub UI (Settings > Environments).
environment: production
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deploys can run concurrently if multiple commits are pushed close together, which risks pulling/starting different images out of order on the Linode host. Add a concurrency group (e.g., workflow-level or job-level) to serialize production deployments and optionally cancel in-progress runs when a newer commit is pushed.

Suggested change
environment: production
environment: production
concurrency:
group: production-deploy
cancel-in-progress: true

Copilot uses AI. Check for mistakes.

steps:
- uses: actions/checkout@v4

- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push Docker image
uses: docker/build-push-action@v6
with:
context: .
file: packages/backend/Dockerfile
push: true
# Always push :latest so the Linode deploy script can reference a stable tag.
# The SHA tag gives you an immutable rollback point.
tags: |
ghcr.io/${{ github.repository_owner }}/muzzle:latest
ghcr.io/${{ github.repository_owner }}/muzzle:${{ github.sha }}

- name: Deploy to Linode
uses: appleboy/ssh-action@v1
# The env block sets these variables on the runner, and `envs` passes
# them through to the remote shell — keeping the token off the command
# line and out of the remote process list.
env:
GHCR_TOKEN: ${{ secrets.GHCR_PAT }}
GHCR_USER: ${{ github.actor }}
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The remote docker login uses GHCR_USER set to github.actor, but GHCR_TOKEN is a fixed PAT secret; if a different actor triggers the workflow (e.g., another maintainer or Dependabot), the username may not match the PAT owner and the login can fail. Use a stable username (commonly ${{ github.repository_owner }}) or store the intended GHCR username alongside the PAT in secrets.

Suggested change
GHCR_USER: ${{ github.actor }}
GHCR_USER: ${{ github.repository_owner }}

Copilot uses AI. Check for mistakes.
IMAGE: ghcr.io/${{ github.repository_owner }}/muzzle:latest
with:
host: ${{ secrets.LINODE_HOST }}
username: ${{ secrets.LINODE_USER }}
password: ${{ secrets.LINODE_PASSWORD }}
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow authenticates to the Linode host using an SSH password (LINODE_PASSWORD). Prefer key-based SSH authentication (with key/key_path) to reduce the risk of credential exposure and to align with common hardening practices for production deployment access.

Suggested change
password: ${{ secrets.LINODE_PASSWORD }}
key: ${{ secrets.LINODE_SSH_KEY }}

Copilot uses AI. Check for mistakes.
envs: GHCR_TOKEN,GHCR_USER,IMAGE
script: |
# Authenticate and pull the freshly built image.
echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin
docker pull "$IMAGE"

# Tear down the currently running container (if any).
docker stop muzzle 2>/dev/null || true
docker rm muzzle 2>/dev/null || true

# Hand off to your existing startup script which handles volume
# mounts and env var injection.
# Update this path to wherever the script lives on your Linode.
/home/muzzle.lol/start-muzzle.sh
Loading