From 1cbc0c0c097dccb0aa8f3640a2146d9bc94072ac Mon Sep 17 00:00:00 2001
From: obchain <riteshnikhoriya94@gmail.com>
Date: Mon, 22 Jun 2026 15:23:39 +0530
Subject: [PATCH 1/2] ci(deploy): move server identity (host, user, dir) into
 secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The deploy workflow hard-coded the SSH host alias, the login user, and the
remote deploy directory in plaintext. Pull them from new repo secrets
(SERVER_SSH_HOST, SERVER_USER, SERVER_DEPLOY_DIR) so the deploy target is
not baked into the public workflow. GitHub masks the values in job logs.
No behavioural change — same host, user, and directory, sourced indirectly.
---
 .github/workflows/deploy.yml | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e166564..4a5b973 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -75,6 +75,10 @@ jobs:
         env:
           SSH_KEY_B64: ${{ secrets.SERVER_SSH_KEY }}
           KNOWN_HOSTS: ${{ secrets.SERVER_KNOWN_HOSTS }}
+          # Server identity (host alias + login user) come from secrets so the
+          # deploy target is not hard-coded in the public workflow.
+          SERVER_SSH_HOST: ${{ secrets.SERVER_SSH_HOST }}
+          SERVER_USER: ${{ secrets.SERVER_USER }}
         run: |
           mkdir -p ~/.ssh
           echo "$SSH_KEY_B64" | base64 --decode > ~/.ssh/id_ed25519
@@ -90,8 +94,8 @@ jobs:
             echo "::warning::SERVER_KNOWN_HOSTS not set — using accept-new (TOFU). Set it (ssh-keyscan output) to pin the host key."
           fi
           cat > ~/.ssh/config <<EOF
-          Host ssh.ancilar.com
-            User lavesh
+          Host $SERVER_SSH_HOST
+            User $SERVER_USER
             IdentityFile ~/.ssh/id_ed25519
             ProxyCommand cloudflared access ssh --hostname %h
             StrictHostKeyChecking $CHECK
@@ -100,7 +104,10 @@ jobs:
 
       - name: Ship compose + deploy script, then pull & apply
         env:
-          DEPLOY_DIR: /home/lavesh/volx-deploy
+          # Deploy target (host alias + dir) from secrets — keep the server
+          # identity out of the public workflow.
+          SERVER_SSH_HOST: ${{ secrets.SERVER_SSH_HOST }}
+          DEPLOY_DIR: ${{ secrets.SERVER_DEPLOY_DIR }}
           # Keeper runtime secrets — written into the server .env each deploy.
           # GitHub masks these values in the logs.
           SEPOLIA_RPC_URL: ${{ secrets.SEPOLIA_RPC_URL }}
@@ -109,19 +116,19 @@ jobs:
           # default can never drift from the images that were just built.
           VOLX_REGISTRY: ${{ secrets.DOCKER_USERNAME }}
         run: |
-          ssh ssh.ancilar.com "mkdir -p $DEPLOY_DIR"
-          scp docker/docker-compose.prod.yml ssh.ancilar.com:"$DEPLOY_DIR/docker-compose.prod.yml"
-          scp docker/clickhouse-init.sql     ssh.ancilar.com:"$DEPLOY_DIR/clickhouse-init.sql"
-          scp scripts/deploy.sh              ssh.ancilar.com:"$DEPLOY_DIR/deploy.sh"
+          ssh "$SERVER_SSH_HOST" "mkdir -p $DEPLOY_DIR"
+          scp docker/docker-compose.prod.yml "$SERVER_SSH_HOST:$DEPLOY_DIR/docker-compose.prod.yml"
+          scp docker/clickhouse-init.sql     "$SERVER_SSH_HOST:$DEPLOY_DIR/clickhouse-init.sql"
+          scp scripts/deploy.sh              "$SERVER_SSH_HOST:$DEPLOY_DIR/deploy.sh"
           # Write the runtime .env on the server from the GitHub secrets (umask
           # 077 -> 0600). docker compose auto-loads it; the keeper reads the keys.
           # Docker Hub repos must be PUBLIC (no server-side login is configured).
-          ssh ssh.ancilar.com "umask 077; cat > $DEPLOY_DIR/.env" <<EOF
+          ssh "$SERVER_SSH_HOST" "umask 077; cat > $DEPLOY_DIR/.env" <<EOF
           SEPOLIA_RPC_URL=$SEPOLIA_RPC_URL
           PRIVATE_KEY=$PRIVATE_KEY
           VOLX_REGISTRY=$VOLX_REGISTRY
           EOF
-          ssh ssh.ancilar.com "cd $DEPLOY_DIR && chmod +x deploy.sh && VOLX_TAG=latest ./deploy.sh"
+          ssh "$SERVER_SSH_HOST" "cd $DEPLOY_DIR && chmod +x deploy.sh && VOLX_TAG=latest ./deploy.sh"
 
       - name: Wipe SSH key
         if: always()

From 2c87c84814c35ef7a456ab39600ffcb9fc7f8163 Mon Sep 17 00:00:00 2001
From: obchain <riteshnikhoriya94@gmail.com>
Date: Mon, 22 Jun 2026 15:27:33 +0530
Subject: [PATCH 2/2] ci: skip CI (and deploy) for docs-only changes

CI has no path filter, so a docs-only merge to main runs the full pipeline
and, on success, triggers a rebuild + redeploy via the deploy workflow's
workflow_run hook. Add paths-ignore for markdown, docs/, and LICENSE on the
push trigger so documentation edits no longer rebuild images or redeploy the
server. Pull-request runs are unchanged (still validate every PR).
---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ded7f6..fce3b73 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,13 @@ name: ci
 on:
   push:
     branches: [main]
+    # Docs-only changes don't affect the build/tests — skip CI (and therefore
+    # the deploy that runs on CI success) so a README edit never rebuilds
+    # images or redeploys the server.
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
   pull_request:
 
 # A new push to the same branch supersedes the prior run.