UPdate workflow

.github/workflows/deploy.yml

@@ -1,49 +1,57 @@
-name: Deploy to Media Server
+name: Deploy Media Server
-
 on:
   push:
-    branches: [ master ]
+    branches: [ "master" ]
-  workflow_dispatch:
+  workflow_dispatch: {}
-
+permissions:
+  contents: read
+concurrency:
+  group: deploy-media-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  deploy:
+  build:
     runs-on: ubuntu-latest
-    
     steps:
-    - uses: actions/checkout@v3
+      - name: Checkout
-    
+        uses: actions/checkout@v4
-    - name: Setup .NET
+      - name: Setup .NET
-      uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@v4
-      with:
+        with:
-        dotnet-version: '8.0.x'
+          dotnet-version: '8.0.x'
-    
+      - name: Restore
-    - name: Restore dependencies
+        run: dotnet restore
-      run: dotnet restore
+      - name: Publish
-    
+        run: dotnet publish -c Release -o ./publish
-    - name: Build
+      - name: Upload artifact
-      run: dotnet build --configuration Release --no-restore
+        uses: actions/upload-artifact@v4
-    
+        with:
-    - name: Publish
+          name: media-publish
-      run: dotnet publish --configuration Release --no-build --output ./publish
+          path: ./publish
-    
+  deploy:
-    - name: Deploy to nginx server
+    needs: build
-      uses: appleboy/scp-action@master
+    runs-on: ubuntu-latest
-      with:
+    environment: production
-        host: joshheaps.net
+    steps:
-        username: deploy
+      - name: Download artifact
-        key: ${{ secrets.NGINX_SSH_KEY }}
+        uses: actions/download-artifact@v4
-        source: "publish/*"
+        with:
-        target: "/tmp/media-app-deploy"
+          name: media-publish
-        strip_components: 1
+          path: publish
-    
+      - name: Prepare SSH
-    - name: Copy to media server and restart
+        run: |
-      uses: appleboy/ssh-action@master
+          install -m 700 -d ~/.ssh
-      with:
+          echo "${{ secrets.MEDIA_SSH_KEY }}" > ~/.ssh/id_rsa
-        host: joshheaps.net
+          chmod 600 ~/.ssh/id_rsa
-        username: deploy
+          ssh-keyscan -p "${{ secrets.SSH_PORT || 22 }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts
-        key: ${{ secrets.NGINX_SSH_KEY }}
+      - name: Rsync to nginx server
-        script: |
+        run: |
-          ssh -o StrictHostKeyChecking=no [email protected] "mkdir -p /tmp/media-app-temp"
+          rsync -az --delete -e "ssh -p ${{ secrets.SSH_PORT || 22 }} -i ~/.ssh/id_rsa" \
-          scp -o StrictHostKeyChecking=no -r /tmp/media-app-deploy/* [email protected]:/tmp/media-app-temp/
+            publish/ ${{ secrets.MEDIA_DEPLOY_USER }}@${{ secrets.SSH_HOST }}:/tmp/media-app-deploy/
-          ssh -o StrictHostKeyChecking=no [email protected] "sudo rsync -av --delete /tmp/media-app-temp/ /var/www/media-app/ && sudo systemctl restart media-app && rm -rf /tmp/media-app-temp"
+      - name: Copy to media server and restart
-          rm -rf /tmp/media-app-deploy
+        run: |
+          ssh -i ~/.ssh/id_rsa -p "${{ secrets.SSH_PORT || 22 }}" \
+            ${{ secrets.MEDIA_DEPLOY_USER }}@${{ secrets.SSH_HOST }} \
+            "ssh [email protected] 'mkdir -p /tmp/media-app-temp' && \
+             scp -r /tmp/media-app-deploy/* [email protected]:/tmp/media-app-temp/ && \
+             ssh [email protected] 'sudo rsync -av --delete /tmp/media-app-temp/ /var/www/media-app/ && sudo systemctl restart media-app && rm -rf /tmp/media-app-temp' && \
+             rm -rf /tmp/media-app-deploy"