195 lines
7.2 KiB
YAML
195 lines
7.2 KiB
YAML
name: SSH Deploy (docker compose)
|
|
description: SSH into a remote host, pull the latest images, and recreate containers with docker compose.
|
|
|
|
inputs:
|
|
ssh_host:
|
|
description: Remote server hostname or IP address
|
|
required: true
|
|
ssh_port:
|
|
description: SSH port
|
|
required: false
|
|
default: "22"
|
|
ssh_username:
|
|
description: SSH username for the remote server
|
|
required: true
|
|
ssh_key:
|
|
description: SSH private key for the remote server (pass via secrets)
|
|
required: true
|
|
remote_dir:
|
|
description: Directory on the remote server containing docker-compose.yml
|
|
required: true
|
|
compose_files:
|
|
description: >-
|
|
Compose file(s) to use, space-separated (applied via -f flags).
|
|
When empty, docker compose uses its default file detection.
|
|
required: false
|
|
default: ""
|
|
image:
|
|
description: >-
|
|
Optional image base (host/path/name) WITHOUT tag. When set, ssh-deploy
|
|
pins every compose service whose image matches this base to `image_tag`
|
|
at deploy time. Docker-only feature — k8s deploys use deploy-restart and
|
|
are unaffected. Leave empty to deploy whatever the compose file pins.
|
|
required: false
|
|
default: ""
|
|
image_tag:
|
|
description: >-
|
|
Tag to pin `image` to when `image` is set. Defaults to `latest`.
|
|
(Comma-separated lists are NOT supported here — a deploy uses one tag.)
|
|
required: false
|
|
default: latest
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Validate inputs
|
|
shell: bash
|
|
env:
|
|
SSH_HOST: ${{ inputs.ssh_host }}
|
|
SSH_USERNAME: ${{ inputs.ssh_username }}
|
|
SSH_KEY: ${{ inputs.ssh_key }}
|
|
REMOTE_DIR: ${{ inputs.remote_dir }}
|
|
run: |
|
|
if [ -z "${SSH_HOST}" ] || [ "${SSH_HOST// }" = "" ]; then
|
|
echo "::error::ssh_host is not set or is empty."
|
|
exit 1
|
|
fi
|
|
if [ -z "${SSH_USERNAME}" ] || [ "${SSH_USERNAME// }" = "" ]; then
|
|
echo "::error::ssh_username is not set or is empty."
|
|
exit 1
|
|
fi
|
|
if [ -z "${SSH_KEY}" ] || [ "${SSH_KEY// }" = "" ]; then
|
|
echo "::error::ssh_key is not set or is empty."
|
|
exit 1
|
|
fi
|
|
if [ -z "${REMOTE_DIR}" ] || [ "${REMOTE_DIR// }" = "" ]; then
|
|
echo "::error::remote_dir is not set or is empty."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Set up SSH key and known_hosts
|
|
shell: bash
|
|
env:
|
|
SSH_KEY: ${{ inputs.ssh_key }}
|
|
SSH_HOST: ${{ inputs.ssh_host }}
|
|
SSH_PORT: ${{ inputs.ssh_port }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_KEY}" > ~/.ssh/id_deploy
|
|
chmod 600 ~/.ssh/id_deploy
|
|
|
|
# Populate known_hosts so StrictHostKeyChecking works without prompts
|
|
ssh-keyscan -p "${SSH_PORT}" "${SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
if ! grep -q "${SSH_HOST}" ~/.ssh/known_hosts; then
|
|
echo "::error::Failed to add ${SSH_HOST} to known_hosts (host may be unreachable)."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Pull and recreate containers
|
|
shell: bash
|
|
env:
|
|
SSH_HOST: ${{ inputs.ssh_host }}
|
|
SSH_PORT: ${{ inputs.ssh_port }}
|
|
SSH_USERNAME: ${{ inputs.ssh_username }}
|
|
REMOTE_DIR: ${{ inputs.remote_dir }}
|
|
COMPOSE_FILES: ${{ inputs.compose_files }}
|
|
OVERRIDE_IMAGE: ${{ inputs.image }}
|
|
OVERRIDE_TAG: ${{ inputs.image_tag }}
|
|
run: |
|
|
# Build -f flags if compose_files is provided
|
|
COMPOSE_FLAGS=""
|
|
if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then
|
|
for f in ${COMPOSE_FILES}; do
|
|
COMPOSE_FLAGS="${COMPOSE_FLAGS} -f \"${f}\""
|
|
done
|
|
fi
|
|
|
|
echo "Connecting to ${SSH_USERNAME}@${SSH_HOST}:${SSH_PORT}"
|
|
echo "Working directory: ${REMOTE_DIR}"
|
|
if [ -n "${COMPOSE_FLAGS}" ]; then
|
|
echo "Compose files: ${COMPOSE_FILES}"
|
|
fi
|
|
|
|
# Optional tag override (Docker-only). When `image` is set, pin every
|
|
# compose service whose image base matches `image` to `image_tag`.
|
|
# We generate a remote override file (layered on the compose files via
|
|
# -f, later wins) so the deploy pulls/starts exactly the requested tag.
|
|
# The override is built on the runner (simple shell) then scp'd to the
|
|
# remote, avoiding fragile quoting inside an SSH command.
|
|
OVERRIDE_FLAGS=""
|
|
if [ -n "${OVERRIDE_IMAGE}" ] && [ "${OVERRIDE_IMAGE// }" != "" ]; then
|
|
if [ -z "${OVERRIDE_TAG}" ] || [ "${OVERRIDE_TAG// }" = "" ]; then
|
|
echo "::error::image is set but image_tag is empty. Provide image_tag (defaults to latest)."
|
|
exit 1
|
|
fi
|
|
echo "Pinning image ${OVERRIDE_IMAGE} to tag :${OVERRIDE_TAG}"
|
|
|
|
# 1) Fetch the merged remote compose config to the runner.
|
|
ssh -i ~/.ssh/id_deploy \
|
|
-p "${SSH_PORT}" \
|
|
-o StrictHostKeyChecking=yes \
|
|
"${SSH_USERNAME}@${SSH_HOST}" \
|
|
"cd '${REMOTE_DIR}' && docker compose ${COMPOSE_FLAGS} config" \
|
|
> /tmp/ssh-deploy-remote.yml
|
|
|
|
# 2) Emit a minimal override: only matching services, retagged.
|
|
awk -v img="${OVERRIDE_IMAGE}" -v tag="${OVERRIDE_TAG}" '
|
|
/^services:/ { s=1; next }
|
|
s && /^ [A-Za-z0-9_-]+:/ { svc=$1; sub(/:$/, "", svc); next }
|
|
s && /^ image:/ {
|
|
val=$0; sub(/^ image:[ \t]*/, "", val)
|
|
last_slash = 0
|
|
for (i = length(val); i > 0; i--) {
|
|
if (substr(val, i, 1) == "/") {
|
|
last_slash = i
|
|
break
|
|
}
|
|
}
|
|
last_colon = 0
|
|
for (i = length(val); i > 0; i--) {
|
|
if (substr(val, i, 1) == ":") {
|
|
last_colon = i
|
|
break
|
|
}
|
|
}
|
|
if (last_colon > last_slash) {
|
|
b = substr(val, 1, last_colon - 1)
|
|
} else {
|
|
b = val
|
|
}
|
|
if (b == img) {
|
|
out = out sprintf(" %s:\n image: %s:%s\n", svc, img, tag)
|
|
count++
|
|
}
|
|
}
|
|
END {
|
|
if (count > 0) {
|
|
print "services:"
|
|
printf "%s", out
|
|
}
|
|
}
|
|
' /tmp/ssh-deploy-remote.yml > /tmp/ssh-deploy-override.yml
|
|
|
|
if [ ! -s /tmp/ssh-deploy-override.yml ]; then
|
|
echo "::warning::No compose service uses image base '${OVERRIDE_IMAGE}'. Deploying without override."
|
|
else
|
|
# 3) Push the override to /tmp on the remote (not into remote_dir,
|
|
# so future tag-less deploys don't inherit a stale pinned tag).
|
|
scp -i ~/.ssh/id_deploy \
|
|
-P "${SSH_PORT}" \
|
|
-o StrictHostKeyChecking=yes \
|
|
/tmp/ssh-deploy-override.yml \
|
|
"${SSH_USERNAME}@${SSH_HOST}:/tmp/.ssh-deploy-override.yml"
|
|
OVERRIDE_FLAGS="-f /tmp/.ssh-deploy-override.yml"
|
|
fi
|
|
fi
|
|
|
|
ssh -i ~/.ssh/id_deploy \
|
|
-p "${SSH_PORT}" \
|
|
-o StrictHostKeyChecking=yes \
|
|
"${SSH_USERNAME}@${SSH_HOST}" \
|
|
"cd '${REMOTE_DIR}' \
|
|
&& docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} pull \
|
|
&& docker compose ${COMPOSE_FLAGS} ${OVERRIDE_FLAGS} up -d --force-recreate"
|