feat: add build-and-push and ssh-deploy composite actions with image tagging support

ssh-deploy/action.yaml

@@ -19,11 +19,25 @@ inputs:
     description: Directory on the remote server containing docker-compose.yml
     required: true
   compose_files:
-    description: >
+    description: >-
       Compose file(s) to use, space-separated (applied via -f flags).
       When empty, docker compose uses its default file detection.
     required: false
     default: ""
+  image:
+    description: >-
+      Optional image base (host/path/name) WITHOUT tag. When set, ssh-deploy
+      pins every compose service whose image matches this base to `image_tag`
+      at deploy time. Docker-only feature — k8s deploys use deploy-restart and
+      are unaffected. Leave empty to deploy whatever the compose file pins.
+    required: false
+    default: ""
+  image_tag:
+    description: >-
+      Tag to pin `image` to when `image` is set. Defaults to `latest`.
+      (Comma-separated lists are NOT supported here — a deploy uses one tag.)
+    required: false
+    default: latest
 
 runs:
   using: composite
@@ -80,6 +94,8 @@ runs:
         SSH_USERNAME: ${{ inputs.ssh_username }}
         REMOTE_DIR: ${{ inputs.remote_dir }}
         COMPOSE_FILES: ${{ inputs.compose_files }}
+        OVERRIDE_IMAGE: ${{ inputs.image }}
+        OVERRIDE_TAG: ${{ inputs.image_tag }}
       run: |
         # Build -f flags if compose_files is provided
         COMPOSE_FLAGS=""
@@ -95,10 +111,84 @@ runs:
           echo "Compose files: ${COMPOSE_FILES}"
         fi
 
+        # Optional tag override (Docker-only). When `image` is set, pin every
+        # compose service whose image base matches `image` to `image_tag`.
+        # We generate a remote override file (layered on the compose files via
+        # -f, later wins) so the deploy pulls/starts exactly the requested tag.
+        # The override is built on the runner (simple shell) then scp'd to the
+        # remote, avoiding fragile quoting inside an SSH command.
+        OVERRIDE_FLAGS=""
+        if [ -n "${OVERRIDE_IMAGE}" ] && [ "${OVERRIDE_IMAGE// }" != "" ]; then
+          if [ -z "${OVERRIDE_TAG}" ] || [ "${OVERRIDE_TAG// }" = "" ]; then
+            echo "::error::image is set but image_tag is empty. Provide image_tag (defaults to latest)."
+            exit 1
+          fi
+          echo "Pinning image ${OVERRIDE_IMAGE} to tag :${OVERRIDE_TAG}"
+
+          # 1) Fetch the merged remote compose config to the runner.
+          ssh -i ~/.ssh/id_deploy \
+            -p "${SSH_PORT}" \
+            -o StrictHostKeyChecking=yes \
+            "${SSH_USERNAME}@${SSH_HOST}" \
+            "cd '${REMOTE_DIR}' && docker compose ${COMPOSE_FLAGS} config" \
+            > /tmp/ssh-deploy-remote.yml
+
+          # 2) Emit a minimal override: only matching services, retagged.
+          awk -v img="${OVERRIDE_IMAGE}" -v tag="${OVERRIDE_TAG}" '
+            /^services:/ { s=1; next }
+            s && /^  [A-Za-z0-9_-]+:/ { svc=$1; sub(/:$/, "", svc); next }
+            s && /^    image:/ {
+              val=$0; sub(/^    image:[ \t]*/, "", val)
+              last_slash = 0
+              for (i = length(val); i > 0; i--) {
+                if (substr(val, i, 1) == "/") {
+                  last_slash = i
+                  break
+                }
+              }
+              last_colon = 0
+              for (i = length(val); i > 0; i--) {
+                if (substr(val, i, 1) == ":") {
+                  last_colon = i
+                  break
+                }
+              }
+              if (last_colon > last_slash) {
+                b = substr(val, 1, last_colon - 1)
+              } else {
+                b = val
+              }
+              if (b == img) {
+                out = out sprintf("  %s:\n    image: %s:%s\n", svc, img, tag)
+                count++
+              }
+            }
+            END {
+              if (count > 0) {
+                print "services:"
+                printf "%s", out
+              }
+            }
+          ' /tmp/ssh-deploy-remote.yml > /tmp/ssh-deploy-override.yml
+
+          if [ ! -s /tmp/ssh-deploy-override.yml ]; then
+            echo "::warning::No compose service uses image base '${OVERRIDE_IMAGE}'. Deploying without override."
+          else
+            # 3) Push the override to /tmp on the remote (not into remote_dir,
+            # so future tag-less deploys don't inherit a stale pinned tag).
+            scp -i ~/.ssh/id_deploy \
+              -P "${SSH_PORT}" \
+              -o StrictHostKeyChecking=yes \
+              /tmp/ssh-deploy-override.yml \
+              "${SSH_USERNAME}@${SSH_HOST}:/tmp/.ssh-deploy-override.yml"
+            OVERRIDE_FLAGS="-f /tmp/.ssh-deploy-override.yml"
+          fi
+        fi
+
         ssh -i ~/.ssh/id_deploy \
           -p "${SSH_PORT}" \
           -o StrictHostKeyChecking=yes \
           "${SSH_USERNAME}@${SSH_HOST}" \
           "cd '${REMOTE_DIR}' \
-            && docker compose ${COMPOSE_FLAGS} pull \
-            && docker compose ${COMPOSE_FLAGS} up -d --force-recreate"
+            && docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} pull \
+            && docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} up -d --force-recreate"