name: SSH Deploy (docker compose) description: SSH into a remote host, pull the latest images, and recreate containers with docker compose. inputs: ssh_host: description: Remote server hostname or IP address required: true ssh_port: description: SSH port required: false default: "22" ssh_username: description: SSH username for the remote server required: true ssh_key: description: SSH private key for the remote server (pass via secrets) required: true remote_dir: description: Directory on the remote server containing docker-compose.yml required: true compose_files: description: >- Compose file(s) to use, space-separated (applied via -f flags). When empty, docker compose uses its default file detection. required: false default: "" image: description: >- Optional image base (host/path/name) WITHOUT tag. When set, ssh-deploy pins every compose service whose image matches this base to `image_tag` at deploy time. Docker-only feature — k8s deploys use deploy-restart and are unaffected. Leave empty to deploy whatever the compose file pins. required: false default: "" image_tag: description: >- Tag to pin `image` to when `image` is set. Defaults to `latest`. (Comma-separated lists are NOT supported here — a deploy uses one tag.) required: false default: latest runs: using: composite steps: - name: Validate inputs shell: bash env: SSH_HOST: ${{ inputs.ssh_host }} SSH_USERNAME: ${{ inputs.ssh_username }} SSH_KEY: ${{ inputs.ssh_key }} REMOTE_DIR: ${{ inputs.remote_dir }} run: | if [ -z "${SSH_HOST}" ] || [ "${SSH_HOST// }" = "" ]; then echo "::error::ssh_host is not set or is empty." exit 1 fi if [ -z "${SSH_USERNAME}" ] || [ "${SSH_USERNAME// }" = "" ]; then echo "::error::ssh_username is not set or is empty." exit 1 fi if [ -z "${SSH_KEY}" ] || [ "${SSH_KEY// }" = "" ]; then echo "::error::ssh_key is not set or is empty." exit 1 fi if [ -z "${REMOTE_DIR}" ] || [ "${REMOTE_DIR// }" = "" ]; then echo "::error::remote_dir is not set or is empty." exit 1 fi - name: Set up SSH key and known_hosts shell: bash env: SSH_KEY: ${{ inputs.ssh_key }} SSH_HOST: ${{ inputs.ssh_host }} SSH_PORT: ${{ inputs.ssh_port }} run: | mkdir -p ~/.ssh echo "${SSH_KEY}" > ~/.ssh/id_deploy chmod 600 ~/.ssh/id_deploy # Populate known_hosts so StrictHostKeyChecking works without prompts ssh-keyscan -p "${SSH_PORT}" "${SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null if ! grep -q "${SSH_HOST}" ~/.ssh/known_hosts; then echo "::error::Failed to add ${SSH_HOST} to known_hosts (host may be unreachable)." exit 1 fi - name: Pull and recreate containers shell: bash env: SSH_HOST: ${{ inputs.ssh_host }} SSH_PORT: ${{ inputs.ssh_port }} SSH_USERNAME: ${{ inputs.ssh_username }} REMOTE_DIR: ${{ inputs.remote_dir }} COMPOSE_FILES: ${{ inputs.compose_files }} OVERRIDE_IMAGE: ${{ inputs.image }} OVERRIDE_TAG: ${{ inputs.image_tag }} run: | # Build -f flags if compose_files is provided COMPOSE_FLAGS="" if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then for f in ${COMPOSE_FILES}; do COMPOSE_FLAGS="${COMPOSE_FLAGS} -f \"${f}\"" done fi echo "Connecting to ${SSH_USERNAME}@${SSH_HOST}:${SSH_PORT}" echo "Working directory: ${REMOTE_DIR}" if [ -n "${COMPOSE_FLAGS}" ]; then echo "Compose files: ${COMPOSE_FILES}" fi # Optional tag override (Docker-only). When `image` is set, pin every # compose service whose image base matches `image` to `image_tag`. # We generate a remote override file (layered on the compose files via # -f, later wins) so the deploy pulls/starts exactly the requested tag. # The override is built on the runner (simple shell) then scp'd to the # remote, avoiding fragile quoting inside an SSH command. OVERRIDE_FLAGS="" if [ -n "${OVERRIDE_IMAGE}" ] && [ "${OVERRIDE_IMAGE// }" != "" ]; then if [ -z "${OVERRIDE_TAG}" ] || [ "${OVERRIDE_TAG// }" = "" ]; then echo "::error::image is set but image_tag is empty. Provide image_tag (defaults to latest)." exit 1 fi echo "Pinning image ${OVERRIDE_IMAGE} to tag :${OVERRIDE_TAG}" # 1) Fetch the merged remote compose config to the runner. ssh -i ~/.ssh/id_deploy \ -p "${SSH_PORT}" \ -o StrictHostKeyChecking=yes \ "${SSH_USERNAME}@${SSH_HOST}" \ "cd '${REMOTE_DIR}' && docker compose ${COMPOSE_FLAGS} config" \ > /tmp/ssh-deploy-remote.yml # 2) Emit a minimal override: only matching services, retagged. awk -v img="${OVERRIDE_IMAGE}" -v tag="${OVERRIDE_TAG}" ' /^services:/ { s=1; next } s && /^ [A-Za-z0-9_-]+:/ { svc=$1; sub(/:$/, "", svc); next } s && /^ image:/ { val=$0; sub(/^ image:[ \t]*/, "", val) last_slash = 0 for (i = length(val); i > 0; i--) { if (substr(val, i, 1) == "/") { last_slash = i break } } last_colon = 0 for (i = length(val); i > 0; i--) { if (substr(val, i, 1) == ":") { last_colon = i break } } if (last_colon > last_slash) { b = substr(val, 1, last_colon - 1) } else { b = val } if (b == img) { out = out sprintf(" %s:\n image: %s:%s\n", svc, img, tag) count++ } } END { if (count > 0) { print "services:" printf "%s", out } } ' /tmp/ssh-deploy-remote.yml > /tmp/ssh-deploy-override.yml if [ ! -s /tmp/ssh-deploy-override.yml ]; then echo "::warning::No compose service uses image base '${OVERRIDE_IMAGE}'. Deploying without override." else # 3) Push the override to /tmp on the remote (not into remote_dir, # so future tag-less deploys don't inherit a stale pinned tag). scp -i ~/.ssh/id_deploy \ -P "${SSH_PORT}" \ -o StrictHostKeyChecking=yes \ /tmp/ssh-deploy-override.yml \ "${SSH_USERNAME}@${SSH_HOST}:/tmp/.ssh-deploy-override.yml" OVERRIDE_FLAGS="-f /tmp/.ssh-deploy-override.yml" fi fi ssh -i ~/.ssh/id_deploy \ -p "${SSH_PORT}" \ -o StrictHostKeyChecking=yes \ "${SSH_USERNAME}@${SSH_HOST}" \ "cd '${REMOTE_DIR}' \ && docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} pull \ && docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} up -d --force-recreate"