deploy.yml

name: Deploy to VPS

on:
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy over SSH
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_PORT || '22' }}
          script_stop: true
          script: |
            set -euo pipefail
            cd "${{ secrets.DEPLOY_PATH }}"
            git fetch origin main
            git reset --hard origin/main
            if [ -d .opencode/skills/web-access ] && [ ! -e .opencode/skills/web-access/.git ]; then
              rm -rf .opencode/skills/web-access
            fi
            git submodule sync --recursive
            git submodule update --init --recursive --checkout --force
            # Load .env so notes auth (NOTES_REPO_TOKEN) and any overrides are
            # available to ensure-notes.sh and the credential helper below.
            if [ -f .env ]; then set -a; . ./.env; set +a; fi
            bash scripts/ensure-notes.sh
            NOTES_BRANCH="$(git -C notes rev-parse --abbrev-ref HEAD)"
            if [ "$NOTES_BRANCH" = "HEAD" ]; then
              NOTES_BRANCH="${NOTES_REPO_BRANCH:-main}"
            fi
            NOTES_REMOTE="${NOTES_REPO_REMOTE:-origin}"
            # A notes sync issue (divergence, credentials) must never block
            # deploying the agent code itself.
            git -C notes pull --rebase --autostash "$NOTES_REMOTE" "$NOTES_BRANCH" \
              || echo "[deploy] notes pull failed; continuing with current notes checkout"
            export DEPLOY_COMMIT_SHA="${{ github.sha }}"
            # Read the deployed commit's subject from the freshly reset checkout
            # (robust for both push and workflow_dispatch triggers).
            export DEPLOY_COMMIT_MESSAGE="$(git log -1 --pretty=format:%s)"
            export DEPLOY_RUN_ID="${{ github.run_id }}"
            export DEPLOY_ACTOR="${{ github.actor }}"
            export DEPLOYED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
            docker compose up -d --build
            docker compose ps