deploy.yml

name: Deploy CMS Undershows

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v5

      - name: Install SSH Client
        run: sudo apt-get update && sudo apt-get install -y openssh-client

      - name: Setup SSH Key 🔐
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          # Fixe a chave do host num secret SSH_KNOWN_HOSTS (saída de `ssh-keyscan <host>`)
          # para verificação estrita. Sem ele, accept-new confia na 1ª conexão mas ainda
          # rejeita se a chave do host mudar depois (bloqueia MITM em deploys seguintes).
          if [ -n "${{ secrets.SSH_KNOWN_HOSTS }}" ]; then
            echo "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
            chmod 600 ~/.ssh/known_hosts
          fi
          cat >> ~/.ssh/config << EOF
          Host server
            HostName ${{ secrets.SSH_HOST }}
            User ${{ secrets.SSH_USER }}
            IdentityFile ~/.ssh/deploy_key
            UserKnownHostsFile ~/.ssh/known_hosts
            StrictHostKeyChecking accept-new
          EOF

      - name: Deploy to Server 🚀
        run: |
          ssh server << 'EOF'
            set -euo pipefail

            cd /var/www/cms/
            git fetch --all
            git reset --hard origin/main

            DOCKER_BUILDKIT=1 docker build \
              --cache-from undershows-cms:cache \
              --build-arg BUILDKIT_INLINE_CACHE=1 \
              -t undershows-cms \
              -t undershows-cms:cache \
              .

            docker stop undershows-cms || true
            docker rm undershows-cms || true

            docker run -d --name undershows-cms --restart unless-stopped --env-file .env -p 127.0.0.1:1337:1337 -v $(pwd)/public/uploads:/app/public/uploads --read-only --tmpfs /tmp --tmpfs /app/.cache --tmpfs /app/.tmp --cap-drop ALL --security-opt no-new-privileges:true undershows-cms

            sleep 2
            docker ps --filter "name=undershows-cms" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
            docker logs --tail=80 undershows-cms

          EOF