Add CD: deploy to dev on merge to main #29

Merged

rbrooks merged 1 commit from feat/cd-dev-deploy into main

2026-06-24 04:12:33 +00:00

rbrooks commented

2026-06-24 01:59:05 +00:00

Owner

Implements #12 (dev-only, SSH-to-dev rebuild — per the chosen approach).

What

.forgejo/workflows/cd.yml — on push to main: run the test suite, then deploy to dev over SSH (git pull → APP_VERSION=$(git describe --tags) docker compose up -d --build app → health check). The deploy job needs the test job, so a red suite blocks deploy.
Safe before secrets exist — the deploy step is gated on a DEV_SSH_KEY secret; if unset it logs "skipping" and the run still passes. So merging this never reds-out main, and deploys start automatically once you add the secret.
ci.yml → pull_request only — CD now covers push-to-main, so CI no longer double-runs there. The required check context CI / test (pull_request) is unchanged.
Dockerfile — moved the APP_VERSION arg/env after the pip-install layer so version bumps don't invalidate the cached dependency layer (faster CD rebuilds).

One-time setup you need to do (repo Settings → Actions)

Secret DEV_SSH_KEY — a private SSH key whose public half is in the dev deploy user's ~/.ssh/authorized_keys (the current flow uses claude@10.1.1.14).
(optional) Variable DEV_HOST — user@host override; defaults to claude@10.1.1.14.
Ensure the Forgejo Actions runner can reach the dev host on the network.

Until the secret is added, every merge tests on CI and skips the deploy step.

Notes

Dev-only for now; prod-on-tag is deferred (separate follow-up when a prod env exists).
The deploy mirrors the manual flow we've been running, so behavior is already proven on dev.

Closes #12

Implements #12 (dev-only, SSH-to-dev rebuild — per the chosen approach). ## What - **`.forgejo/workflows/cd.yml`** — on push to `main`: run the test suite, then **deploy to dev over SSH** (`git pull` → `APP_VERSION=$(git describe --tags) docker compose up -d --build app` → health check). The deploy job `needs` the test job, so a red suite blocks deploy. - **Safe before secrets exist** — the deploy step is gated on a `DEV_SSH_KEY` secret; if unset it logs "skipping" and the run still passes. So merging this never reds-out `main`, and deploys start automatically once you add the secret. - **`ci.yml` → pull_request only** — CD now covers push-to-main, so CI no longer double-runs there. The required check context `CI / test (pull_request)` is unchanged. - **Dockerfile** — moved the `APP_VERSION` arg/env after the pip-install layer so version bumps don't invalidate the cached dependency layer (faster CD rebuilds). ## One-time setup you need to do (repo Settings → Actions) 1. **Secret `DEV_SSH_KEY`** — a private SSH key whose public half is in the dev deploy user's `~/.ssh/authorized_keys` (the current flow uses `claude@10.1.1.14`). 2. *(optional)* **Variable `DEV_HOST`** — `user@host` override; defaults to `claude@10.1.1.14`. 3. Ensure the Forgejo Actions runner can reach the dev host on the network. Until the secret is added, every merge tests on CI and skips the deploy step. ## Notes - Dev-only for now; prod-on-tag is deferred (separate follow-up when a prod env exists). - The deploy mirrors the manual flow we've been running, so behavior is already proven on dev. Closes #12

rbrooks added 1 commit

2026-06-24 01:59:05 +00:00

Add CD: deploy to dev on merge to main

CI / test (pull_request) Successful in 2m38s

Details

fa5ff8a4e6

Implements #12.

- .forgejo/workflows/cd.yml: on push to main, run the test suite then deploy to
  the dev server over SSH (git pull + version-stamped `docker compose up -d
  --build app` + health check). The deploy step is gated on a DEV_SSH_KEY secret
  — if it's unset the step is skipped and the run still passes, so this is safe
  to merge before the secret is configured.
- .forgejo/workflows/ci.yml: now runs on pull_request only (CD covers push to
  main), avoiding a duplicate test run. The required check context
  "CI / test (pull_request)" is unchanged.
- Dockerfile: move the APP_VERSION arg/env after the pip-install layer so version
  bumps don't bust the cached dependency layer (faster CD rebuilds).

Required one-time setup (repo Settings → Actions): add secret DEV_SSH_KEY
(private key authorized for the dev deploy user); optional variable DEV_HOST
(defaults to claude@10.1.1.14). The runner must be able to reach the dev host.

Closes #12

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

rbrooks merged commit 00242d377d into main

2026-06-24 04:12:33 +00:00

rbrooks deleted branch feat/cd-dev-deploy

2026-06-24 04:12:34 +00:00

rbrooks referenced this pull request from a commit

2026-06-24 04:12:35 +00:00

Merge pull request 'Add CD: deploy to dev on merge to main' (#29) from feat/cd-dev-deploy into main