deploy: pull git BEFORE update.sh runs (avoid self-update bootstrap) #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy landing (fleetwatch.ohmaseclaro.dev) | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "deploy/**" | |
| - "README.md" | |
| - "LICENSE" | |
| - ".github/workflows/deploy-landing.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: fleetwatch-deploy-landing | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| name: Deploy via SSH | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: landing | |
| url: https://fleetwatch.ohmaseclaro.dev | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify required secrets are present | |
| env: | |
| SSH_HOST: ${{ secrets.SSH_HOST }} | |
| SSH_USER: ${{ secrets.SSH_USER }} | |
| run: | | |
| if [ -z "$SSH_HOST" ]; then | |
| echo "::error::SSH_HOST is empty. Add it as a repo or environment secret (Settings → Secrets and variables → Actions)." | |
| exit 1 | |
| fi | |
| if [ -z "$SSH_USER" ]; then | |
| echo "::error::SSH_USER is empty. Add it next to SSH_HOST (e.g. deploy)." | |
| exit 1 | |
| fi | |
| - name: Pull latest + reload nginx | |
| uses: appleboy/ssh-action@v1.2.0 | |
| with: | |
| host: ${{ secrets.SSH_HOST }} | |
| username: ${{ secrets.SSH_USER }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| timeout: 60s | |
| command_timeout: 5m | |
| script: | | |
| set -e | |
| cd ${{ secrets.FLEETWATCH_DEPLOY_DIR || '/home/fleetwatch' }} | |
| # Pull FIRST (outside update.sh) so the new in-memory version of | |
| # update.sh runs — see the comment in deploy/update.sh. | |
| git fetch --tags origin | |
| git reset --hard origin/main | |
| ./deploy/update.sh | |
| # Public-URL checks are best-effort: | |
| # • before DNS is set → DNS NXDOMAIN, treat as warning | |
| # • before cert is issued → TLS handshake fails, treat as warning | |
| # • after both are in place → real assertion (status 200, .com → .dev 301) | |
| # The deploy itself already smoke-checked via loopback inside update.sh. | |
| - name: Smoke check (public URL via Cloudflare) | |
| run: | | |
| STATUS=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 10 https://fleetwatch.ohmaseclaro.dev/ 2>/dev/null || echo "000") | |
| echo "GET https://fleetwatch.ohmaseclaro.dev/ → $STATUS" | |
| case "$STATUS" in | |
| 200) echo "✓ landing live" ;; | |
| 000) echo "::warning::no response — DNS or TLS likely not finalized yet (loopback check inside update.sh already passed)" ;; | |
| *) echo "::warning::landing returned $STATUS (expected 200)" ;; | |
| esac | |
| - name: Smoke check (.com → .dev redirect) | |
| run: | | |
| REDIRECT=$(curl -sS -o /dev/null -w "%{redirect_url}" --max-time 10 https://fleetwatch.ohmaseclaro.com/ 2>/dev/null || echo "") | |
| echo "GET https://fleetwatch.ohmaseclaro.com/ → Location: $REDIRECT" | |
| case "$REDIRECT" in | |
| https://fleetwatch.ohmaseclaro.dev/*) echo "✓ canonical redirect ok" ;; | |
| "") echo "::warning::no redirect — DNS or TLS likely not finalized yet" ;; | |
| *) echo "::warning::expected redirect to fleetwatch.ohmaseclaro.dev, got '$REDIRECT'" ;; | |
| esac |