pipeline-actions/ssh-deploy/action.yaml

name: SSH Deploy (docker compose)
description: SSH into a remote host, pull the latest images, and recreate containers with docker compose.

inputs:
  ssh_host:
    description: Remote server hostname or IP address
    required: true
  ssh_port:
    description: SSH port
    required: false
    default: "22"
  ssh_username:
    description: SSH username for the remote server
    required: true
  ssh_key:
    description: SSH private key for the remote server (pass via secrets)
    required: true
  remote_dir:
    description: Directory on the remote server containing docker-compose.yml
    required: true
  compose_files:
    description: >-
      Compose file(s) to use, space-separated (applied via -f flags).
      When empty, docker compose uses its default file detection.
    required: false
    default: ""
  image:
    description: >-
      Optional image base (host/path/name) WITHOUT tag. When set, ssh-deploy
      pins every compose service whose image matches this base to `image_tag`
      at deploy time. Docker-only feature — k8s deploys use deploy-restart and
      are unaffected. Leave empty to deploy whatever the compose file pins.
    required: false
    default: ""
  image_tag:
    description: >-
      Tag to pin `image` to when `image` is set. Defaults to `latest`.
      (Comma-separated lists are NOT supported here — a deploy uses one tag.)
    required: false
    default: latest

runs:
  using: composite
  steps:
    - name: Validate inputs
      shell: bash
      env:
        SSH_HOST: ${{ inputs.ssh_host }}
        SSH_USERNAME: ${{ inputs.ssh_username }}
        SSH_KEY: ${{ inputs.ssh_key }}
        REMOTE_DIR: ${{ inputs.remote_dir }}
      run: |
        if [ -z "${SSH_HOST}" ] || [ "${SSH_HOST// }" = "" ]; then
          echo "::error::ssh_host is not set or is empty."
          exit 1
        fi
        if [ -z "${SSH_USERNAME}" ] || [ "${SSH_USERNAME// }" = "" ]; then
          echo "::error::ssh_username is not set or is empty."
          exit 1
        fi
        if [ -z "${SSH_KEY}" ] || [ "${SSH_KEY// }" = "" ]; then
          echo "::error::ssh_key is not set or is empty."
          exit 1
        fi
        if [ -z "${REMOTE_DIR}" ] || [ "${REMOTE_DIR// }" = "" ]; then
          echo "::error::remote_dir is not set or is empty."
          exit 1
        fi

    - name: Set up SSH key and known_hosts
      shell: bash
      env:
        SSH_KEY: ${{ inputs.ssh_key }}
        SSH_HOST: ${{ inputs.ssh_host }}
        SSH_PORT: ${{ inputs.ssh_port }}
      run: |
        mkdir -p ~/.ssh
        echo "${SSH_KEY}" > ~/.ssh/id_deploy
        chmod 600 ~/.ssh/id_deploy

        # Populate known_hosts so StrictHostKeyChecking works without prompts
        ssh-keyscan -p "${SSH_PORT}" "${SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null

        if ! grep -q "${SSH_HOST}" ~/.ssh/known_hosts; then
          echo "::error::Failed to add ${SSH_HOST} to known_hosts (host may be unreachable)."
          exit 1
        fi

    - name: Pull and recreate containers
      shell: bash
      env:
        SSH_HOST: ${{ inputs.ssh_host }}
        SSH_PORT: ${{ inputs.ssh_port }}
        SSH_USERNAME: ${{ inputs.ssh_username }}
        REMOTE_DIR: ${{ inputs.remote_dir }}
        COMPOSE_FILES: ${{ inputs.compose_files }}
        OVERRIDE_IMAGE: ${{ inputs.image }}
        OVERRIDE_TAG: ${{ inputs.image_tag }}
      run: |
        # Build -f flags if compose_files is provided
        COMPOSE_FLAGS=""
        if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then
          for f in ${COMPOSE_FILES}; do
            COMPOSE_FLAGS="${COMPOSE_FLAGS} -f \"${f}\""
          done
        fi

        echo "Connecting to ${SSH_USERNAME}@${SSH_HOST}:${SSH_PORT}"
        echo "Working directory: ${REMOTE_DIR}"
        if [ -n "${COMPOSE_FLAGS}" ]; then
          echo "Compose files: ${COMPOSE_FILES}"
        fi

        # Optional tag replacement in compose files on the remote.
        # When `image` is set, find the files and replace the tag directly in them.
        if [ -n "${OVERRIDE_IMAGE}" ] && [ "${OVERRIDE_IMAGE// }" != "" ]; then
          if [ -z "${OVERRIDE_TAG}" ] || [ "${OVERRIDE_TAG// }" = "" ]; then
            echo "::error::image is set but image_tag is empty. Provide image_tag (defaults to latest)."
            exit 1
          fi
          echo "Replacing image ${OVERRIDE_IMAGE} tag with :${OVERRIDE_TAG} in remote compose files"

          # Escape image name for sed
          ESC_IMAGE=$(echo "${OVERRIDE_IMAGE}" | sed 's/[.[\*^$()|?+]/\\&/g')
          SED_EXPR="s@(image:[[:space:]]*${ESC_IMAGE})(:[^[:space:]]*)?([[:space:]]|\$)@\1:${OVERRIDE_TAG}\3@g"

          # Determine which files to modify on the remote host
          if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then
            # If explicit files are specified, modify those
            REMOTE_COMMAND=""
            for f in ${COMPOSE_FILES}; do
              REMOTE_COMMAND="${REMOTE_COMMAND} sed -E -i \"${SED_EXPR}\" '${REMOTE_DIR}/${f}';"
            done
          else
            # Otherwise, find all yml/yaml files in remote_dir and run sed on them
            REMOTE_COMMAND="find '${REMOTE_DIR}' -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) -exec sed -E -i \"${SED_EXPR}\" {} \+;"
          fi

          ssh -i ~/.ssh/id_deploy \
            -p "${SSH_PORT}" \
            -o StrictHostKeyChecking=yes \
            "${SSH_USERNAME}@${SSH_HOST}" \
            "${REMOTE_COMMAND}"
        fi

        ssh -i ~/.ssh/id_deploy \
          -p "${SSH_PORT}" \
          -o StrictHostKeyChecking=yes \
          "${SSH_USERNAME}@${SSH_HOST}" \
          "cd '${REMOTE_DIR}' \
            && docker compose ${COMPOSE_FLAGS} pull \
            && docker compose ${COMPOSE_FLAGS} up -d --force-recreate"