From b8cd36abc3c6140ba93de0ac24bb01c28c2529f3 Mon Sep 17 00:00:00 2001
From: Moheeb Zara <hackbuildvideo@gmail.com>
Date: Thu, 14 May 2026 15:41:33 -0700
Subject: [PATCH] ci: GitHub Actions auto-deploy to production droplet on push
 to main

Workflow SSHes into the production droplet as `deploy` and runs
`/opt/hackerspace-ops/deploy.sh` which:
  - git fetches and resets to origin/main
  - rebuilds the app image with NEXT_PUBLIC_* baked in from .env.local
  - applies any new scripts/0NN_*.sql migrations not in the
    public._migrations_applied tracking table
  - hot-swaps the app container with `docker compose up -d --no-deps app`
  - prunes dangling images

Repo secrets DROPLET_HOST and DEPLOY_SSH_PRIVATE_KEY are configured.

Concurrency group `deploy-prod` with cancel-in-progress=false so two
pushes in quick succession queue rather than racing.

Also gitignores `secrets/` and `*.pem` so production credentials never
get committed.
---
 .github/workflows/deploy.yml | 28 ++++++++++++++++++++++++++++
 .gitignore                   |  4 ++++
 2 files changed, 32 insertions(+)
 create mode 100644 .github/workflows/deploy.yml

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..df4ad40
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,28 @@
+name: Deploy to production
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Run deploy script on the droplet
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DROPLET_HOST }}
+          username: deploy
+          key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
+          port: 22
+          # Strict host key checking would need us to pin a known_hosts;
+          # for now the droplet's host key is trusted on first use.
+          script_stop: true
+          script: |
+            /opt/hackerspace-ops/deploy.sh
diff --git a/.gitignore b/.gitignore
index 52013c4..4dae1ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,7 @@ playwright-report/
 # Supabase CLI local state
 supabase/.branches/
 supabase/.temp/
+
+# Production deployment secrets (never commit)
+secrets/
+*.pem