From 624bcfaa11e80bddcace2a2652469aec44534b0a Mon Sep 17 00:00:00 2001
From: jheaps <jheaps@conservice.com>
Date: Wed, 8 Oct 2025 15:25:10 -0600
Subject: [PATCH] UPdate workflow

---
 .github/workflows/deploy.yml | 96 +++++++++++++++++++-----------------
 1 file changed, 52 insertions(+), 44 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index abaeb7c..283fd4f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,49 +1,57 @@
-name: Deploy to Media Server
-
+name: Deploy Media Server
 on:
   push:
-    branches: [ master ]
-  workflow_dispatch:
-
+    branches: [ "master" ]
+  workflow_dispatch: {}
+permissions:
+  contents: read
+concurrency:
+  group: deploy-media-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-    
     steps:
-    - uses: actions/checkout@v3
-    
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: '8.0.x'
-    
-    - name: Restore dependencies
-      run: dotnet restore
-    
-    - name: Build
-      run: dotnet build --configuration Release --no-restore
-    
-    - name: Publish
-      run: dotnet publish --configuration Release --no-build --output ./publish
-    
-    - name: Deploy to nginx server
-      uses: appleboy/scp-action@master
-      with:
-        host: joshheaps.net
-        username: deploy
-        key: ${{ secrets.NGINX_SSH_KEY }}
-        source: "publish/*"
-        target: "/tmp/media-app-deploy"
-        strip_components: 1
-    
-    - name: Copy to media server and restart
-      uses: appleboy/ssh-action@master
-      with:
-        host: joshheaps.net
-        username: deploy
-        key: ${{ secrets.NGINX_SSH_KEY }}
-        script: |
-          ssh -o StrictHostKeyChecking=no josh@10.0.0.180 "mkdir -p /tmp/media-app-temp"
-          scp -o StrictHostKeyChecking=no -r /tmp/media-app-deploy/* josh@10.0.0.180:/tmp/media-app-temp/
-          ssh -o StrictHostKeyChecking=no josh@10.0.0.180 "sudo rsync -av --delete /tmp/media-app-temp/ /var/www/media-app/ && sudo systemctl restart media-app && rm -rf /tmp/media-app-temp"
-          rm -rf /tmp/media-app-deploy
\ No newline at end of file
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+      - name: Restore
+        run: dotnet restore
+      - name: Publish
+        run: dotnet publish -c Release -o ./publish
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: media-publish
+          path: ./publish
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: media-publish
+          path: publish
+      - name: Prepare SSH
+        run: |
+          install -m 700 -d ~/.ssh
+          echo "${{ secrets.MEDIA_SSH_KEY }}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -p "${{ secrets.SSH_PORT || 22 }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts
+      - name: Rsync to nginx server
+        run: |
+          rsync -az --delete -e "ssh -p ${{ secrets.SSH_PORT || 22 }} -i ~/.ssh/id_rsa" \
+            publish/ ${{ secrets.MEDIA_DEPLOY_USER }}@${{ secrets.SSH_HOST }}:/tmp/media-app-deploy/
+      - name: Copy to media server and restart
+        run: |
+          ssh -i ~/.ssh/id_rsa -p "${{ secrets.SSH_PORT || 22 }}" \
+            ${{ secrets.MEDIA_DEPLOY_USER }}@${{ secrets.SSH_HOST }} \
+            "ssh josh@10.0.0.180 'mkdir -p /tmp/media-app-temp' && \
+             scp -r /tmp/media-app-deploy/* josh@10.0.0.180:/tmp/media-app-temp/ && \
+             ssh josh@10.0.0.180 'sudo rsync -av --delete /tmp/media-app-temp/ /var/www/media-app/ && sudo systemctl restart media-app && rm -rf /tmp/media-app-temp' && \
+             rm -rf /tmp/media-app-deploy"
\ No newline at end of file